iTMS-4-ALL 0.2

iTMS-4-ALL is a Perl CGI script that allows you to search Apples iTunes Music Store from any Web browser.

First of all, you can try the live script. Thanks to the people at Downhill Battle for hosting the script---they have also posted some interesting ideas about how the iTunes database can be used. Jason Terk has released a version of the script that uses CSS/XHTML, and you can try his live script.

You can also download the latest iTMS-4-ALL script package (v0.2, which works with Apples v4.5 server, thanks to nand). Three non-standard Perl modules are needed, but they are included (INET.pm and CBC.pm are pure Perl; Rijndael.pm needs to be compiled for your system). Extract the package, then run installRijndaelLocal.sh to build the Rijndael module. Copy the itms4all.pl script, the Crypt directory, the IO directory, and the auto directory into your servers cgi-bin directory. Make sure the itms4all.pl script is executable by your web server.

The script has been released under the GNU GPL.

You can can browse the store and access previews, but you cannot log in or purchase iTunes. David Hammerton has been working on logging in to iTunes.

Here is what I know about the iTunes Music Store Protocol so far:

1. iTunes communicates with Apple almost exclusively through HTTP [browsing the store and playing preview clips works through a web proxy, even with no direct connection to the Internet].
2. iTunes authentication (logging in so you can actually buy something) is not happening through HTTP [no requests hit my web proxy when iTunes tries to log in; logging in fails without a direct Internet connection].
3. iTunes fetches gzipped XML files from Apple to lay out its GUI (to display the store front, genre pages, and search results).
4. Every gzipped XML file is encrypted with AES-128 (Rijndael) in CBC mode. The CBC initialization vector is included in the HTTP header (x-apple-crypto-iv).
5. The AES key is 8a9dad399fb014c131be611820d78895. This key is hard-coded somehow in iTunes.