ptoomey3 / Keychain-Dumper

A tool to check which keychain items are available to an attacker once an iOS device has been jailbroken
BSD 3-Clause "New" or "Revised" License
1.35k stars 299 forks source link

Feature: Add CLI args instead of stdin #50

Closed bensh closed 3 years ago

bensh commented 5 years ago

It would be great to be able to script this, but at the moment -s requires user input. Is it possible to change a few of the user args to changes behaviour e.g

-l : list all entitlements (same as -s but don't ask for 'Select Entitlement Group by Number') -g : dump all entitlements for the group from the numbered list above/ entitlement group ID/name

Complete process:

root# keychain_dumper -l
Entitlement Group [0]: 243LU875E5.com.example.Me
Entitlement Group [1]: 37CJY58B6M.org.Foo.Bar
Entitlement Group [2]: 3N5VQ668Y7.com.MyApp

root# keychain_dumper -g 2
[INFO] 5QRQZ3BQNM.com.MyApp selected.

I would attempt to have a go myself, but make doesn't work for me, separate issue raised.

bensh commented 3 years ago

I can now make this to add in some extra functions, however I'm unsure how to build for lower iOS versions? I want to build for 11 upwards.


dyld: Symbol not found: _objc_opt_new
  Referenced from: /tmp/keychain_dumper (which was built for iOS 13.2)
  Expected in: /usr/lib/libobjc.A.dylib
 in /tmp/keychain_dumper
Abort trap: 6

$ xcrun --sdk iphoneos --show-sdk-path
/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS13.2.sdk```
tarbaII commented 3 years ago

Delete any .o files in your project workspace. Download Xcode 9.0 from Apple's website and use the iPhoneOS9.0.sdk SDK to compile it. I think you have to run xcode-select on Xcode 9.0 before it'll compile with iPhoneOS9.0.sdk by default.

bensh commented 3 years ago

I added some features I wanted in a separate fork

https://github.com/bensh/Keychain-Dumper

tarbaII commented 3 years ago

Sorry, you've probably figured it out by now, but Xcode 9.0 is for iOS 11.0 and for some reason I said iPhoneOS9.0.sdk when Xcode 9.0 actually corresponds to iPhoneOS11.0.sdk. Just a brainfart I guess.

tarbaII commented 3 years ago

Also, you can request that your changes be merged into the official Keychain-Dumper repository by creating a pull request.

bensh commented 3 years ago

Yeah no problem, all worked out with some Googling. Thanks for the initial tip.