TarballCoLtd / iOS-Restrictions-Recovery

Finds Screen Time/Restrictions passcodes on iOS 7-12 (by @tarbaII)
GNU General Public License v3.0
51 stars 10 forks source link

KeyChainDumper Updated #8

Open carterlasalle opened 3 years ago

carterlasalle commented 3 years ago

Hey @alyxferrari,

It looks like keychain dumper has been updated! With ios15 released, what is the plan for this?

tarbaII commented 3 years ago

I'll look into it, I actually just jailbroke my phone again a couple days ago for the first time in months, so good timing :) Can't promise I'll have time anytime soon, but within 10 days or so I'll probably have a response for you with some info.

carterlasalle commented 3 years ago

I'll look into it, I actually just jailbroke my phone again a couple days ago for the first time in months, so good timing :) Can't promise I'll have time anytime soon, but within 10 days or so I'll probably have a response for you with some info.

Thank you so much. I just think this is a really cool project!

tarbaII commented 3 years ago

@RocketNinja15 After about 2 hours of fiddling around with it, I finally got it to work on the latest version, iOS 14.8. I'm really excited! I'll probably have iOS 12 through 14 support finished in the next week or two. Won't be too difficult because the groundwork is already there, just need to tweak some things.

Alyxs-iPhone:/usr/bin root# keychain_dumper > /private/var/mobile/kdout.txt

...
Generic Password
----------------
Service: ParentalControls
Account: user
Entitlement Group: apple
Label: (null)
Accessible Attribute: kSecAttrAccessibleWhenUnlockedThisDeviceOnly, protection level 5
Description: (null)
Comment: (null)
Synchronizable: 0
Generic Field: (null)
Keychain Data: 2458
...

As you can see, it successfully got the Screen Time passcode I set on my phone, which was 2458. I was a little relieved because I'd actually forgotten what I'd set it to 😆

carterlasalle commented 3 years ago

@RocketNinja15 After about 2 hours of fiddling around with it, I finally got it to work on the latest version, iOS 14.8. I'm really excited! I'll probably have iOS 12 through 14 support finished in the next week or two. Won't be too difficult because the groundwork is already there, just need to tweak some things.

Alyxs-iPhone:/usr/bin root# keychain_dumper > /private/var/mobile/kdout.txt

...
Generic Password
----------------
Service: ParentalControls
Account: user
Entitlement Group: apple
Label: (null)
Accessible Attribute: kSecAttrAccessibleWhenUnlockedThisDeviceOnly, protection level 5
Description: (null)
Comment: (null)
Synchronizable: 0
Generic Field: (null)
Keychain Data: 2458
...

As you can see, it successfully got the Screen Time passcode I set on my phone, which was 2458. I was a little relieved because I'd actually forgotten what I'd set it to 😆

That's Awesome @alyxferrari ! I just recently jailbroke my old iPad on ios 13 because my phone is on ios 15. I was running the .jar and it kept erroring on http://alyxferrari.github.io/iosrr/keychain_dumper. I'm assuming that's due to your fiddling around :) I'm excited to see where this project goes!

tarbaII commented 3 years ago

Oh wait my bad I deleted my GitHub pages repository a couple days ago, I forgot that this project uses it... oops- It'll be fixed with the iOS 14 update

carterlasalle commented 3 years ago

Oh wait my bad I deleted my GitHub pages repository a couple of days ago, I forgot that this project uses it... oops- It'll be fixed with the iOS 14 update

OK, no worries @alyxferrari! Is there a way to download manually, if not then no worries, I can't wait for the ios 14 :)

tarbaII commented 3 years ago

@RocketNinja15 Can you try this? https://drive.google.com/file/d/1BoWkK7hhQ-NSaG21oARNjzvhvLRz0WGa/view?usp=sharing

carterlasalle commented 3 years ago

@RocketNinja15 Can you try this? https://drive.google.com/file/d/1BoWkK7hhQ-NSaG21oARNjzvhvLRz0WGa/view?usp=sharing

@alyxferrari where should I put this, in the same directory as the other jar, or should I open this

tarbaII commented 3 years ago

Make a new folder somewhere and put the JAR I sent in there. Then just run it like normal

carterlasalle commented 3 years ago

Make a new folder somewhere and put the JAR I sent in there. Then just run it like normal

@alyxferrari I almost got it, but....

Unable to reach a settlement: [diffie-hellman-group1-sha1, diffie-hellman-group-exchange-sha1] and [curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group14-sha1]

tarbaII commented 3 years ago

Can you run it from the command prompt and take a screenshot of the output?

cd C:/Folder/That/Has/The/Jar java -jar putjarfilenamehere.jar

Replace the folder and file names of course

carterlasalle commented 3 years ago

Can you run it from the command prompt and take a screenshot of the output?

cd C:/Folder/That/Has/The/Jar java -jar putjarfilenamehere.jar

Replace the folder and file names of course

@alyxferrari https://hastebin.com/idibokokac.properties

I pasted it in there :)

tarbaII commented 3 years ago

Sorry for the intrusive question, but do you live outside the US? I read a while ago that some countries consider certain cryptography extensions weapons lol

carterlasalle commented 3 years ago

Sorry for the intrusive question, but do you live outside the US? I read a while ago that some countries consider certain cryptography implementations weapons lol

Haha, nope! I live in the US mainland @alyxferrari What do you see that is causing the issue?

tarbaII commented 3 years ago

Well then I have no clue why it's failing to get instances for whatever crypto extensions it's trying to access. I'll do some troubleshooting tomorrow and get back to you

carterlasalle commented 3 years ago

Well then I have no clue why it's failing to get instances for whatever crypto extensions it's trying to access. I'll do some troubleshooting tomorrow and get back to you

so what is the exact problem, is it trying to download something, connect to the web, decrypt something... what is is it trying to do and getting hung in @alyxferrari

tarbaII commented 3 years ago

SSH connections are encrypted and the OS isn't letting it access the crypto extensions it needs to encrypt and decrypt the connection data

carterlasalle commented 3 years ago

SSH connections are encrypted and the OS isn't letting it access the crypto extensions it needs to encrypt and decrypt the connection data

C:\Users\Rocket\Downloads\keychain-dumper>ssh root@MYIPThe authenticity of host 'MYIP (MYIP)' can't be established.RSA key fingerprint is SHA256:MYKEY.Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'MYIP' (RSA) to the list of known hosts.root@MYIP4's password:Rockets-iPad:~ root# ssh

@alyxferrari i can connect though terminal......

tarbaII commented 3 years ago

The SSH library I'm using is probably doing something weird. I'll look into it in the morning

carterlasalle commented 3 years ago

The SSH library I'm using is probably doing something weird. I'll look into it in the morning

Yea, no worries, sleep is precious :) I am going to be unavailable until Thursday so have a good week! Thank you so much for your support @alyxferrari !

carterlasalle commented 3 years ago

@alyxferrari I am back by the way, so you need me to test anything 👍

tarbaII commented 3 years ago

Did some research and apparently the crypto error is my fault because the JAR is unsigned. I'll still have to look into how to fix that. I'm also trying to get an iOS 12 device of mine working so I can test on it. I'll let you know when I have something for you.

carterlasalle commented 3 years ago

Did some research and apparently the crypto error is my fault because the JAR is unsigned. I'll still have to look into how to fix that. I'm also trying to get an iOS 12 device of mine working so I can test on it. I'll let you know when I have something for you.

@alyxferrari https://docs.oracle.com/javase/tutorial/deployment/jar/signindex.html

Is it this?

tarbaII commented 3 years ago

Probably although I'm not sure. I'll have to look more into it.

tarbaII commented 3 years ago

@RocketNinja15 Could you uninstall your current version of Java and install the OpenJDK? It seems like only official Oracle versions of Java have this problem. Another tester and I didn't have this problem because we were both using the OpenJDK.

https://adoptium.net/ choose either JDK 11 (what I would recommend) or JDK 17

carterlasalle commented 3 years ago

@RocketNinja15 Could you uninstall your current version of Java and install the OpenJDK? It seems like only official Oracle versions of Java have this problem. Another tester and I didn't have this problem because we were both using the OpenJDK.

https://adoptium.net/ choose either JDK 11 (what I would recommend) or JDK 17

@alyxferrari progress.... but image

tarbaII commented 3 years ago

Can you take a screenshot of the console or the main iOS-RR log window? Thank you for your testing btw :)

carterlasalle commented 3 years ago

Can you take a screenshot of the console or the main iOS-RR log window? Thank you for your testing btw :)

Yup @alyxferrari https://hastebin.com/tepuqevayu.apache

tarbaII commented 3 years ago

Can you install either NewTerm or Filza and see if the folder /User (its a shortcut, not a real folder) exists?

If it does, can you take a screenshot of its directory structure?

carterlasalle commented 3 years ago

Can you install either NewTerm or Filza and see if the folder /User (its a shortcut, not a real folder) exists?

If it does, can you take a screenshot of its directory structure?

Yup! @alyxferrari IMG_0002

tarbaII commented 3 years ago

Hmm, that's a little odd that it's saying it doesn't exist then. I'll try hardcoding the actual path (/private/var/mobile) instead of using shortcuts.

carterlasalle commented 3 years ago

Hmm, that's a little odd that it's saying it doesn't exist then. I'll try hardcoding the actual path (/private/var/mobile) instead of using shortcuts.

@alyxferrari how should I do that? Is it saying that the /User/ folder doesn’t exist or the keychain-dumper folder doesn’t exist in the /User/ folder

tarbaII commented 3 years ago

I would have to do it, give me a couple hours and I'll send a build to you

carterlasalle commented 3 years ago

I would have to do it, give me a couple hours and I'll send a build to you

@alyxferrari no worries! No rush at all, I just want to help :)

carterlasalle commented 2 years ago

I would have to do it, give me a couple hours and I'll send a build to you

hey, let me know if you want me to test anything! @alyxxxx

tarbaII commented 2 years ago

Kinda forgot about this lol, I realized it was possible to port it to a native iOS app and started working on that but hit a roadblock. I'll update the Java version as soon as I can

carterlasalle commented 2 years ago

Kinda forgot about this lol, I realized it was possible to port it to a native iOS app and started working on that but hit a roadblock. I'll update the Java version as soon as I can

Hahaha, no worries @alyxxxx !

carterlasalle commented 2 years ago

@alyxxxx lmk if i can test anything.

I am running my pc boot camped to windows from Mac, and i use the checkra1n jailbreak on Mac then go to windows. IDK if that’s the issue

carterlasalle commented 2 years ago

@alyxferrari its been fixed for me for a while :)

carterlasalle commented 1 year ago

@tarbaII There is an issue with keychain dumper url