KeychainViewer App for iOS 7

[GoogleCodeExporter]

1. Install the KeychainViewer0.3.deb using iFile.
2. Open the app.
3. See a completely empty database.

Is it posible to update this app? I have tested it on an iPad 2, iPad 3, iPhone 
5S, and iPod Touch 5 all running iOS 7.0.3. It does not work on any devices.

Original issue reported on code.google.com by IsaiahJT...@gmail.com on 6 Jan 2014 at 3:49

[GoogleCodeExporter]

Additionally, keychain_dump also returns an empty database.

Original comment by IsaiahJT...@gmail.com on 6 Jan 2014 at 3:52

[GoogleCodeExporter]

yes it needs to be fixed for ios7, i will update this issue when its done.

Original comment by jean.sig...@gmail.com on 7 Jan 2014 at 7:58

• Changed state: Accepted

[GoogleCodeExporter]

Any chance of a fix soon?

Original comment by IsaiahJT...@gmail.com on 15 Jan 2014 at 5:05

[GoogleCodeExporter]

here is a beta version that should work on ios7, if you can test on all your 
devices that would be great. thanks.

Original comment by jean.sig...@gmail.com on 16 Jan 2014 at 9:52

Attachments:

• keychainviewer0.4_beta.deb
• keychain_dump

[GoogleCodeExporter]

Tested on two devices for now. I will have my other devices and iOS 6 tonight 
and I'll test it on those as well.
iPhone 5S 7.0.4: Viewer and Dumper both working. Notes: Older (not working) 
version of app was still installed before installing this one. So upgrading 
works.
iPad 3 7.0.4: Viewer and Dumper both working. Notes: Didn't create an icon 
until I rebooted. Respringing wasn't sufficient. I think that is normal though.

Original comment by IsaiahJT...@gmail.com on 16 Jan 2014 at 11:12

[GoogleCodeExporter]

This issue was updated by revision 9449830bbb5f.

Original comment by jean.sig...@gmail.com on 25 Jan 2014 at 5:21

[GoogleCodeExporter]

As an update to this:

Was able to get this working on an iPhone 5 (A1429) with iOS 7.0.4 with no 
issues. Respringing for me turned out to be sufficient as well.

Original comment by tjae...@parabal.com on 25 Feb 2014 at 5:14

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

Hi there,

Would anyone know how to extract a certificate (identity) from i0s7 with 
jailbreak?

Many thanks,

Alex

Original comment by alexande...@gmail.com on 24 Aug 2014 at 7:52

[GoogleCodeExporter]

Here is the updated deb and the keychain_dump binary, they should work from iOS 
3 to iOS 7.

@alexanderbaird7 just run keychain_dump and inspect the cert.plist output file

Original comment by jean.sig...@gmail.com on 28 Aug 2014 at 10:07

Attachments:

• keychainviewer-5a7112512a97.deb
• keychain_dump

[GoogleCodeExporter]

Jean,

Is the plist files generated by keychain_dump sufficient for decrypting an ios 
image? I'm getting "Missing keyfile" even though I put the plist files in the 
same directory as the emf_decryptor.py

Thanks!

Original comment by orj...@gmail.com on 29 Aug 2014 at 10:22

[GoogleCodeExporter]

Hi there,

Thanks for that. How do i run the keychain_dump file?

Original comment by alexande...@gmail.com on 30 Aug 2014 at 6:18

[GoogleCodeExporter]

@alexanderbaird7 install openssh from cydia, upload the file on the device 
using scp and run it via ssh.

@orjanh this is only for the keychain and not related to the data partition 
encryption. i just answered you question in the README comments.

Original comment by jean.sig...@gmail.com on 30 Aug 2014 at 12:59

[GoogleCodeExporter]

Are there new protection classes in iOS7.1? The keychainviewer (both, the app 
and the command line tool attached to this issue) shows "Unknown protection 
class 43" (and others) for all keychain items.

Original comment by rene.v...@gmail.com on 3 Sep 2014 at 1:25

[GoogleCodeExporter]

This issue was updated by revision 757e81b3ffe3.

mask protection class field for iOS 7

Original comment by jean.sig...@gmail.com on 3 Sep 2014 at 4:06

[GoogleCodeExporter]

@rene.vogt
i forgot to include a patch, let me know if the new binaries work for you. 
thanks.

Original comment by jean.sig...@gmail.com on 3 Sep 2014 at 4:08

Attachments:

• keychain_dump
• keychainviewer-757e81b3ffe3.deb

[GoogleCodeExporter]

Hi Jean
Thank you for the updated binaries. However the new binaries fails on iOS7.1 
with the following error message:
IOConnectCallMethod returned e00002e2
decrypt_data_ios5 : AppleKeyStore_keyUnwrap = e00002e2

Original comment by rene.v...@gmail.com on 4 Sep 2014 at 9:37

[GoogleCodeExporter]

This issue was updated by revision 315130245677.

Mask protection class field only when converting to string description

Original comment by jean.sig...@gmail.com on 4 Sep 2014 at 9:51

[GoogleCodeExporter]

my patch was incorrect, now it should work ok i hope. thanks again

Original comment by jean.sig...@gmail.com on 4 Sep 2014 at 9:52

Attachments:

• keychain_dump_315130245677
• keychainviewer-315130245677.deb

[GoogleCodeExporter]

Thanks. The new version works now as expected.

Original comment by rene.v...@gmail.com on 4 Sep 2014 at 10:01

[GoogleCodeExporter]

Do you happen to have a link to the source for this latest version of 
keychain_dump?

It's working on my iPhone 4 running iOS 7.1.2

Original comment by wire...@gmail.com on 6 Sep 2014 at 7:10

[GoogleCodeExporter]

@wired33
https://code.google.com/p/iphone-dataprotection/source/list?repo=keychainviewer

Original comment by jean.sig...@gmail.com on 6 Sep 2014 at 9:31

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

there is no command line option to do that, sorry

Original comment by jean.sig...@gmail.com on 22 Sep 2014 at 7:31

[GoogleCodeExporter]

hey jean, something is wrong with your dump script. attached, check it out...  
in beginning is some kind error, in middle is error to and in the end, there is 
no real end, i can fix it by copying end from other plist file and deleting a 
little bit of it, but its not a real fix... tested on many 7.x.x devices...

Original comment by dainius....@gmail.com on 28 Sep 2014 at 1:40

[GoogleCodeExporter]

@dainius
thanks for reporting this, i suppose you trying to parse the file using python 
and it fails ?

just deleted the attachment since i guess you didnt mean to post someones 
(yours ?) keychain passwords in clear over the internet, right ?

Original comment by jean.sig...@gmail.com on 28 Sep 2014 at 4:24

[GoogleCodeExporter]

no, im running ./filename to get 4 .plist files generated,, all of them are ok, 
but not this one i atached..  im using winscp 5.5
p.s. where do you see passwords? i cant .. :)

Original comment by dainius....@gmail.com on 28 Sep 2014 at 6:12

[GoogleCodeExporter]

hi how can i find the matcher certificate key and how we can know what cert it 
is root or device or activation ? 

Original comment by tdriou...@gmail.com on 29 Sep 2014 at 6:34

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

any fix for my last problem?

https://code.google.com/p/iphone-dataprotection/issues/detail?id=122#c27

Original comment by dainius....@gmail.com on 5 Oct 2014 at 1:03

[GoogleCodeExporter]

@dainius
please explain in details what is the issue ? the plist file is not parsed 
correctly by python but since you said you were not using python to parse it 
what is the exact problem ?

@tdriouech
look at the python_scripts/keychain/keychain.py file to get an idea on how to 
match certificates and keys in python using m2crypto

Original comment by jean.sig...@gmail.com on 5 Oct 2014 at 4:37

[GoogleCodeExporter]

Will there be support for iOS8? iOS7 versions do not work properly on it. they 
display in iOS6 kind of window and the information is not visable. Here is a 
screenshot which can explain the problem better.

Original comment by xplode.t...@gmail.com on 1 Dec 2014 at 11:39

Attachments:

• IMG_0001[1].PNG

[GoogleCodeExporter]

for me its working i think, you just have to touch each field with finger to 
get an info :D

Original comment by dainius....@gmail.com on 2 Dec 2014 at 8:49

[GoogleCodeExporter]

Thanks you are right. Also i found that if i rotate screen the values show too. 
But still it should be an easy fix for that. Also the app does not work on full 
screen.

Original comment by xplode.t...@gmail.com on 2 Dec 2014 at 2:09

[GoogleCodeExporter]

This issue was updated by revision b5cbbdb9f205.

Use native iOS 7/8 UITableView style by patching LC_VERSION_MIN_IPHONEOS load 
command
Get SDK path in Makefile using xcodebuild

Original comment by jean.sig...@gmail.com on 10 Jan 2015 at 3:36

[GoogleCodeExporter]

where to download?

Original comment by dainius....@gmail.com on 10 Jan 2015 at 3:38

[GoogleCodeExporter]

This issue was updated by revision d63ef8451a51.

Add Default-568h@2x.png for fullscreen mode on new devices

Original comment by jean.sig...@gmail.com on 10 Jan 2015 at 4:14

[GoogleCodeExporter]

here is the updated package that fixes the ios 8 bug

Original comment by jean.sig...@gmail.com on 10 Jan 2015 at 4:16

Attachments:

• keychainviewer-d63ef8451a51.deb

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

I need keychianviewer for ios 8.1 updated version  

Original comment by haiderwa...@gmail.com on 2 Feb 2015 at 3:31

[GoogleCodeExporter]

here is the updated package that fixes the ios 8 bug

I think this is only ios 8.0 or 8.1?????

Original comment by haidrral...@gmail.com on 4 Feb 2015 at 5:24