search

dmayer / idb

idb is a tool to simplify some common tasks for iOS pentesting and research
MIT License
942 stars 156 forks source link

Dumping keychain error #16

Closed nmonkee closed 10 years ago

nmonkee commented 10 years ago

When connected to a Jailbroken iOS 7 iDevice, after starting an app, if the option to dump keychain is chosen, the following error is received:


[INFO] 2014-01-27 15:04:54 :: gidb ::  Dumping keychain...
[INFO] 2014-01-27 15:04:54 :: gidb ::  Downloading dumped keychain...
Error downloading file.
[INFO] 2014-01-27 15:04:54 :: gidb ::  Parsing keychain plist file..
/Users/nmonkee/tools/ios/idb/gui/key_chain_widget.rb:64:in `populate_table': undefined method `each' for nil:NilClass (NoMethodError)
    from /Users/nmonkee/tools/ios/idb/gui/key_chain_widget.rb:48:in `block in initialize'
    from /Library/Ruby/Gems/2.0.0/gems/qtbindings-4.8.3.0/lib/Qt/qtruby4.rb:2427:in `call'
    from /Library/Ruby/Gems/2.0.0/gems/qtbindings-4.8.3.0/lib/Qt/qtruby4.rb:2427:in `invoke'
    from /Library/Ruby/Gems/2.0.0/gems/qtbindings-4.8.3.0/lib/Qt/qtruby4.rb:469:in `qt_metacall'
    from /Library/Ruby/Gems/2.0.0/gems/qtbindings-4.8.3.0/lib/Qt/qtruby4.rb:469:in `method_missing'
    from /Library/Ruby/Gems/2.0.0/gems/qtbindings-4.8.3.0/lib/Qt/qtruby4.rb:469:in `exec'
    from gidb.rb:244:in `
'
dmayer commented 10 years ago

Hi,

Thanks for the report. Just to double-check, when you connect to the device, is there a check mark next to "keychain_dump" ?

If so, can you manually SSH into the device and run ./keychain_dump in the /var/root/ folder?

Thanks, Daniel

nmonkee commented 10 years ago 

..
[INFO] 2014-01-28 10:40:23 :: gidb ::  keychaindump found at /var/root/keychain_dump.
..

Running:


root# /var/root/keychain_dump 
IOConnectCallMethod returned e00002e2
decrypt_data_ios5 : AppleKeyStore_keyUnwrap = e00002e2
IOConnectCallMethod returned e00002e2
decrypt_data_ios5 : AppleKeyStore_keyUnwrap = e00002e2
IOConnectCallMethod returned e00002e2
decrypt_data_ios5 : AppleKeyStore_keyUnwrap = e00002e2
IOConnectCallMethod returned e00002e2
decrypt_data_ios5 : AppleKeyStore_keyUnwrap = e00002e2
IOConnectCallMethod returned e00002e2
decrypt_data_ios5 : AppleKeyStore_keyUnwrap = e00002e2
IOConnectCallMethod returned e00002e2
decrypt_data_ios5 : AppleKeyStore_keyUnwrap = e00002e2
IOConnectCallMethod returned e00002e2
decrypt_data_ios5 : AppleKeyStore_keyUnwrap = e00002e2
Writing 20 passwords to genp.plist
Writing 0 internet passwords to inet.plist
Writing 4 certificates to cert.plist
Writing 8 keys to keys.plist

dmayer commented 10 years ago

The tmp folder for this was simply not being created. Other functions did that for me so I didn't notice. Good catch, thanks! Should work now!

nmonkee commented 10 years ago

confirmed working after latest pull.

shanks114 commented 7 years ago

Hey dmayer Am facing some kind of issue while Downloading Info.plist can you please help me out here

IPHONE details as follows -IOS 10.0.2 -model 5S

[DEBUG] 2017-06-18 05:06:52 :: idb :: Executing blocking SSH command: /bin/su mobile -c /usr/bin/uicache [] Retrieving list of applications... [DEBUG] 2017-06-18 05:07:22 :: idb :: App Dir: /private/var/containers/Bundle/Application/127FA06B-3A8C-4811-A853-B3FB625ADC1C [DEBUG] 2017-06-18 05:07:22 :: idb :: Executing blocking SSH command: ls /private/var/containers/Bundle/Application/127FA06B-3A8C-4811-A853-B3FB625ADC1C/app/Info.plist [INFO] 2017-06-18 05:07:22 :: idb :: Info.plist found at /private/var/containers/Bundle/Application/127FA06B-3A8C-4811-A853-B3FB625ADC1C/ServerAuditor.app/Info.plist [INFO] 2017-06-18 05:07:22 :: idb :: Parsing plist file.. [ERROR] 2017-06-18 05:07:22 :: idb :: Error downloading file. /usr/local/rvm/gems/ruby-2.1.10/gems/plist4r-1.2.2/lib/plist4r/plist.rb:294:in open': No filename specified (RuntimeError) from /usr/local/rvm/gems/ruby-2.1.10/gems/plist4r-1.2.2/lib/plist4r.rb:34:inopen' from /root/git/idb/lib/lib/ios8_last_launch_services_map_wrapper.rb:7:in initialize' from /root/git/idb/lib/lib/app.rb:29:innew' from /root/git/idb/lib/lib/app.rb:29:in initialize' from /root/git/idb/lib/gui/app_list_dialog.rb:74:innew' from /root/git/idb/lib/gui/app_list_dialog.rb:74:in block in refresh_app_list' from /root/git/idb/lib/gui/app_list_dialog.rb:73:ineach' from /root/git/idb/lib/gui/app_list_dialog.rb:73:in refresh_app_list' from /root/git/idb/lib/gui/app_list_dialog.rb:31:ininitialize' from /root/git/idb/lib/gui/global_app_details_group_box.rb:43:in new' from /root/git/idb/lib/gui/global_app_details_group_box.rb:43:inblock in initialize' from /usr/local/rvm/gems/ruby-2.1.10/gems/qtbindings-4.8.6.3/lib/Qt/qtruby4.rb:2470:in call' from /usr/local/rvm/gems/ruby-2.1.10/gems/qtbindings-4.8.6.3/lib/Qt/qtruby4.rb:2470:ininvoke' from /usr/local/rvm/gems/ruby-2.1.10/gems/qtbindings-4.8.6.3/lib/Qt/qtruby4.rb:479:in qt_metacall' from /usr/local/rvm/gems/ruby-2.1.10/gems/qtbindings-4.8.6.3/lib/Qt/qtruby4.rb:479:inmethod_missing' from /usr/local/rvm/gems/ruby-2.1.10/gems/qtbindings-4.8.6.3/lib/Qt/qtruby4.rb:479:in exec' from /root/git/idb/lib/idb.rb:278:inrun' from /root/git/idb/bin/idb:4:in <top (required)>' from /usr/local/rvm/gems/ruby-2.1.10/bin/idb:23:inload' from /usr/local/rvm/gems/ruby-2.1.10/bin/idb:23:in <main>' from /usr/local/rvm/gems/ruby-2.1.10/bin/ruby_executable_hooks:15:ineval' from /usr/local/rvm/gems/ruby-2.1.10/bin/ruby_executable_hooks:15:in `

'