Python python_scripts/keychain_tool.py C:\Users\\AppData\Roaming\Apple Computer\MobileSync\Backup\\ist C:\Users\\AppData\Roaming\Apple Computer\MobileSync\Backup\\ist From command prompt, navigate to iphone-dataprotection folder and run keychain_tool.py by supplying ist path and the backup folder path. From command prompt navigate to c:\construct-2.06 folder and type the below command.ġ1.
Decrypt Keychain.Plist download#
Download construct-2.06.rar and extract it to c:\ drive. From command prompt navigate to c:\progressbar-2.3 and type the below command.ġ0.
Decrypt Keychain.Plist install#
Install python dependencies - setuptools, M2Crypto, pycrypto & pyqtĩ. Download progressbar-2.3.rar and extract it to c:\ drive. Add C:\Python26 to system PATH environment variable.Ĩ. Download and install Python 2.6 in C :\Python26 folder.Ħ. It creates iphone-dataprotection folder in the current directory.ĥ. Grab the tools by running the below command from windows command prompt. Researchers at sogeti developed tools to decrypt the keychain files. Extract key 0×835 by following my previous blog post - Extracting AES keys from iPhone.Ĥ. Download & install mercurial. Default location is - C:\Users\\AppData\Roaming\Apple Computer\MobileSync\Backup\ģ. Steps to decrypt the backup Keychain (Windows 7):ġ. keychain-tool.py automatically decrypts the backup keychain content and displays it on the terminal. Navigate to iphone-dataprotection folder and run keychain_tool.py by supplying ist path and the backup folder path.ħ.
Decrypt Keychain.Plist mac os x#
Grab the tools by running the below command on Mac OS X terminal.Ħ. Extract key 0×835 by following my previous blog post – Extracting AES keys from iPhone.Ĥ. Download & install mercurial. Default location is -~/Library/Application Support/MobileSync/Backup/Ģ. So renaming the file 51a4616e576dd33cd2abadfea874eb8ff246bf0e to ist and editing with a plist editor opens the file but does not display the data in it.ġ. Keychain data stored in the backup is encrypted using a hardware generated key – key 0×835. The Keychain file gets stored with 51a4616e576dd33cd2abadfea874eb8ff246bf0e file name in the iTunes backup folder. In iTunes backup, the iPhone Keychain sqlite database is stored as a Plist file. keychain-tool.py automatically decrypts the backup keychain content and displays it on the terminal. Python python_scripts/keychain_tool.py ~/Library/Application Support/MobileSync/Backup//ist ~/Library/Application Support/MobileSync/Backup//istħ. Navigate to iphone-dataprotection folder and run keychain_tool.py by supplying ist path and the backup folder path.
Sudo ARCHFLAGS='-arch i386 -arch x86_64' easy_install pycrypto Sudo easy_install M2crypto construct progressbar setuptools
Grab the tools by running the below command on Mac OS X terminal.(sudo easy_install mercurial, mercurial是较为流行的分布式版本控制工具,用hg命令同步)
Steps to decrypt the backup Keychain (Mac OS X):