search

ethers-io / EthersWallet-ios

Ethereum Wallet and Dapp Browser for iOS.
https://itunes.apple.com/us/app/ethers-wallet/id1186052971?mt=8
MIT License
303 stars 85 forks source link

Can I recover JSON from keychain-2.db? #25

Closed thomas-ho closed 6 years ago

thomas-ho commented 6 years ago

my certificate expiration, I have to jailbreak iPhone 6p with IOS 10.3.3, use keychain_dumper decrypt my keychain db, but I cannot find the JSON data, can I recover it? my keychain data blow(this account with no ether,but another have): Generic Password

Service: 0x09961dB63814f61b6ab50c81C0d6B4176695d091_ENCRYPTED_KEY Account: 0x09961dB63814f61b6ab50c81C0d6B4176695d091 Entitlement Group: L2S5E9QH3S.XXX.XXX.Wallet Label: (null) Generic Field: <30783039 39363164 42363338 31346636 31623661 62353063 38314330 64364234 31373636 39356430 39315f45 4e435259 50544544 5f4b4559> Keychain Data: 0x04c73ec49fe03119e7272a97fab3af1b655c6071daebee3b02a9285ed75051ff54d366c771d688e48462e5bfb2a7344ec05f28e7727ecb752c8206bf4757672e94d3c2969a412decdd37ab8b40f12176ca466289245c7a18274c3d7fa449082e6fd89472741f28d8f01b797419089590b0

ricmoo commented 6 years ago

Sorry it took so long to reply, it’s been a crazy busy day.

When you created your wallet with Ethers Wallet, you would have been required to write down your Backup Phrase. If you use that you will get back your unencrypted wallet private key.

If you don’t have that handy, the data in the keychain will be the encrypted JSON wallet. Ethers Wallet also encodes your backup phrase in that JSON wallet, so with your password you can derive the backup phrase. We have command line tools to assist in that recovery as well.

The keychain data you provided looks similar to the key used to keep an encrypted copy of your key in the iPhone Secure Enclave, so it is not as important, since that is only used to save you the time of entering your password during transaction and message signing.

Do you see other keys in your Keychain? They should have the string “ethers” in them and will represent your JSON wallet (as a password item, since there isn’t an opaque data type for the keychain).

Do not include any additional information in this thread, the above info is fairly inoculous, but please contact us directly at support@ethers.io for further assistance.

Thanks. :)

thomas-ho commented 6 years ago

thanks god, finally, Solved:) by add extra kSecAttrSynchronizable for keychain_dumper. So I see the string "ethers" and my wallet JSON!

ricmoo commented 6 years ago

Oh! Perfect!

Yes, The Keychain API uses that (bool) key during it's matching. I should post some documentation how to extract the keyfile data, as well as how the Keychain is used in general.

Anyways, glad you found it.

Thanks!