search

n0fate / chainbreaker

Mac OS X Keychain Forensic Tool
GNU General Public License v2.0
816 stars 157 forks source link

getAppleshareRecord using the wrong class (struct) to parse #2

Closed ryandeivert closed 8 years ago

ryandeivert commented 8 years ago

Lines 551 & 553 of chainbreaker.py (getAppleshareRecord function) utilize the '_INTERNET_PW_HEADER' class for parsing the Apple Share records instead of the appropriate '_APPLE_SHARE_HEADER' class.

I noticed that the the _INTERNET_PW_HEADER class has no field 'Volume' and the getAppleshareRecord function attempts to use this in 'RecordMeta.Volume', while the _APPLE_SHARE_HEADER class does in fact have that field. I believe it's probably a simple oversight from copy/pasting but could be wrong...

If you'd like, I can make the small changes and perform a pull request to merge them in. Just let me know!

n0fate commented 8 years ago

I fixed some code reflecting your message. I can't have a testing phase for it because I know the Apple Share Record was no more used. ;p

You can check the r11

If you find new issue, please let me know. Thank you for your bug reporting ;-)

ryandeivert commented 8 years ago

I don't have any way to test either, but thank you for the quick fix!