search

juuso / keychaindump

A proof-of-concept tool for reading OS X keychain passwords
508 stars 129 forks source link

Yosemite finds master and wrapping key, but nothing follows. #8

Open hariedo opened 9 years ago

hariedo commented 9 years ago

When I use this on a login.keychain I get output like the following:

[*] Searching process 15 heap range 0x7fd16a400000-0x7fd16a700000
[*] Searching process 15 heap range 0x7fd16a700000-0x7fd16a800000
[*] Found 9 master key candidates
[*] Trying to decrypt wrapping key in login.keychain
[*] Trying master key candidate: 985065f9da6b476eeaa58c4453c14cdaffef07c225d51028
[+] Found master key: 985065f9da6b476eeaa58c4453c14cadffef07c252d51028
[+] Found wrapping key: 1c340cc0d9f4c4a91526cbcaa02462a131b80abc5d865826

However, nothing else is output. I know this account has a variety of passwords added to the keychain.