How Do I get Battery Charge Cycles from a connected iOS device?

Question

I'm using MobileDevice.framework in an OS X application and I've been able to get how charged the battery of an iOS device connected over USB is using the AMDeviceCopyValue(device, domain, key) function with the arguments "com.apple.mobile.battery" for the domain and "BatteryCurrentCapacity" for the key.

I want to also get the number of Charge Cycles on the battery. I believe it's possible because iBackupBot is able to fetch that data. Does anyone know how it does this? I downloaded the free copy of the program and tested it on an iPhone 3GS, iPhone 4S, and an iPhone 5. It was able to grab the data for all three devices.

I have run iBackupBot through LLDB and logged its every usage of AMDeviceCopyValue(). In doing so, I determined that it isn't getting the Charge Cycles count from that.

Solution

You can grab CycleCount and a bunch of other information using an ioreg (IORegistry) dump of the device. For example, see here for an IORegistry dump of the iPhone 5S. Note this section:

 +-o AppleD2045PMUPowerSource  <class AppleD2045PMUPowerSource, busy 0, retain count 10>
    | |   |   |   |   {
    | |   |   |   |     "battery-data" = {
                            .....
                            "CycleCount" = 1
        | |   |   |   |     "ChargerConfiguration" = 960
        | |   |   |   |     "DesignCapacity" = 1550
        | |   |   |   |     "BatteryData" = {"BatterySerialNumber"="C0133237ALXFHCWBP","ChemID"=4484,"Flags"=256,"QmaxCell0"=1619,"Voltage"=4051,"CycleCount"=1,"StateOfCharge"=72,"DesignCapacity"=1550,"FullAvailableCapacity"=1573,"MaxCapacity"=1517,"MfgData"=<4330313333323337414c58464843574250000000000000010000010000000100>,"ManufactureDate"="1332"}
        | |   |   |   |     "AtCriticalLevel" = No

The private IOKit.framework on iOS has an API for accessing all of this information (you can look at the dump to figure out the property names, etc. in order to be able to access it programatically). Erica Sadun has some open source code that uses private IOKit functions to access some device hardware information (without a jailbreak, IIRC) so maybe that will be helpful.

As for grabbing this info from a Mac, no idea. If you have an on device app that can pull the information from the IORegistry and send it to the Mac over USB that would work. If you wanted to do it without having any additional software installed on the device, you would have to figure out a way to remotely get an ioreg dump.

Hope this gets you somewhere!

Comments

[ArtOfWarfare]

I awarded the bounty because I didn't want to see it go to waste (and certainly he provided me with a lot of relevant information I wasn't aware of) but it doesn't really answer the question, so I'm leaving this without an accepted answer until someone gives one. I'm planning on attacking iBackupBot (the application that already does this) with Hopper Decompiler later when I have more time... I'll post the solution here when I find it, if someone doesn't come up with it before me.

[ArtOfWarfare]

1 - I want the number of charge cycles on the battery. That is, how many times has the battery gone from full to empty and back since the battery was first put in the device. It's a good metric for knowing how much longer until your battery is going to die permanently. 2 - I want to access this number in an app running on a computer connected to an iOS device, not in an app running on the iOS device itself. Honestly though, at the end of the week I'll probably settle if anyone can just tell me how to get the charge cycles with an on-device app, even if it requires jailbreaking.

[ArtOfWarfare]

This code looks basically identical to code I've seen for getting the charge cycles off of a MacBook battery. I'll +1 this for now, and if nothing better comes up in a week I'll give you the bounty, but I'd prefer some code I can run on the Mac to get the data. Maybe the information is stored in a file on the iOS device that I can pull, for example? I imagine someone in the jailbreak community must know about all kinds of stuff in iOS's hidden file directories...

[ArtOfWarfare]

From Apple's documentation on the OS X version of IOKit: "A dynamic part of the I/O Kit, the Registry is not stored on disk or archived between boots. Instead, it is built at each system boot and resides in memory." (Source: developer.apple.com/library/mac/documentation/DeviceDrivers/‌​…)

[indragie]

Right, so it sounds like one way to get that from a Mac without installing additional software would be to find a way to invoke ioreg on the device remotely to produce a registry dump. SSH is one way, but that requires a jailbreak.

[ArtOfWarfare]

Okay. Now I need a solution that doesn't involve jailbreaking. (The only reason I keep mentioning jailbreaking is because I hope someone with an intimate understanding of what Apple has hidden will know about a gray area where you can get this value even though Apple hasn't publicly documented the means.)

[indragie]

You'll probably have better luck getting information on private APIs on more homebrew/jailbreak centric forums than SO :)

[ArtOfWarfare]

Somebody else suggested using the Hopper Decompiler to determine what methods iBackupBot uses to accomplish this same thing. So I'll give that a shot and see what comes of it.

[jimwan]

@ArtOfWarfare, did you find the solution now, i also want to do the same thing

[ArtOfWarfare]

@jimwan - Sorry, no. I gave up on this in early 2014.