Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added support to display protection classes #29

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Added support to display protection classes #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
36415c7
initial
Apr 25, 2017
0bab303
Actual implementation
Apr 25, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# Keychain Dumper

Added feature to display protection classes.

## Usage

All that should be needed to use keychain_dumper is the binary that is checked in to the Keychain-Dumper Git repository. This binary has been signed with a self-signed certificate with a "wildcard" entitlement that should grant keychain_dumper access to all Keychain items that would have been granted had the tool been signed with each individual entitlement. If you either don't trust this binary or are having trouble dumping Keychain items using the below steps, you may can build the tool from source and manually sign the appropriate entitlments into your build of the keychain_dumper binary.
Expand Down
Binary file modified keychain_dumper
View file
Open in desktop
Binary file not shown.
98 changes: 98 additions & 0 deletions main.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,29 @@ void printGenericPassword(NSDictionary *passwordItem) {
printToStdOut(@"Account: %@\n", [passwordItem objectForKey:(id)kSecAttrAccount]);
printToStdOut(@"Entitlement Group: %@\n", [passwordItem objectForKey:(id)kSecAttrAccessGroup]);
printToStdOut(@"Label: %@\n", [passwordItem objectForKey:(id)kSecAttrLabel]);

if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"ck"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAfterFirstUnlock\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"ak"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenUnlocked\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"dk"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAlways\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"aku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenUnlockedThisDeviceOnly\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"cku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"dku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAlwaysThisDeviceOnly\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"akpu"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly\n");
}

printToStdOut(@"Generic Field: %@\n", [[passwordItem objectForKey:(id)kSecAttrGeneric] description]);
NSData* passwordData = [passwordItem objectForKey:(id)kSecValueData];
printToStdOut(@"Keychain Data: %@\n\n", [[NSString alloc] initWithData:passwordData encoding:NSUTF8StringEncoding]);
Expand All @@ -207,6 +230,31 @@ void printInternetPassword(NSDictionary *passwordItem) {
printToStdOut(@"Account: %@\n", [passwordItem objectForKey:(id)kSecAttrAccount]);
printToStdOut(@"Entitlement Group: %@\n", [passwordItem objectForKey:(id)kSecAttrAccessGroup]);
printToStdOut(@"Label: %@\n", [passwordItem objectForKey:(id)kSecAttrLabel]);


if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"ck"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAfterFirstUnlock\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"ak"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenUnlocked\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"dk"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAlways\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"aku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenUnlockedThisDeviceOnly\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"cku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"dku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAlwaysThisDeviceOnly\n");
}
else if ([[passwordItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"akpu"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly\n");
}


NSData* passwordData = [passwordItem objectForKey:(id)kSecValueData];
printToStdOut(@"Keychain Data: %@\n\n", [[NSString alloc] initWithData:passwordData encoding:NSUTF8StringEncoding]);
}
Expand All @@ -223,6 +271,31 @@ void printCertificate(NSDictionary *certificateItem) {
CFRelease(summary);
printToStdOut(@"Entitlement Group: %@\n", [certificateItem objectForKey:(id)kSecAttrAccessGroup]);
printToStdOut(@"Label: %@\n", [certificateItem objectForKey:(id)kSecAttrLabel]);


if ([[certificateItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"ck"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAfterFirstUnlock\n");
}
else if ([[certificateItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"ak"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenUnlocked\n");
}
else if ([[certificateItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"dk"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAlways\n");
}
else if ([[certificateItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"aku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenUnlockedThisDeviceOnly\n");
}
else if ([[certificateItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"cku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly\n");
}
else if ([[certificateItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"dku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAlwaysThisDeviceOnly\n");
}
else if ([[certificateItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"akpu"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly\n");
}


printToStdOut(@"Serial Number: %@\n", [certificateItem objectForKey:(id)kSecAttrSerialNumber]);
printToStdOut(@"Subject Key ID: %@\n", [certificateItem objectForKey:(id)kSecAttrSubjectKeyID]);
printToStdOut(@"Subject Key Hash: %@\n\n", [certificateItem objectForKey:(id)kSecAttrPublicKeyHash]);
Expand All @@ -247,6 +320,31 @@ void printKey(NSDictionary *keyItem) {
printToStdOut(@"---\n");
printToStdOut(@"Entitlement Group: %@\n", [keyItem objectForKey:(id)kSecAttrAccessGroup]);
printToStdOut(@"Label: %@\n", [keyItem objectForKey:(id)kSecAttrLabel]);


if ([[keyItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"ck"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAfterFirstUnlock\n");
}
else if ([[keyItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"ak"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenUnlocked\n");
}
else if ([[keyItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"dk"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAlways\n");
}
else if ([[keyItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"aku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenUnlockedThisDeviceOnly\n");
}
else if ([[keyItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"cku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly\n");
}
else if ([[keyItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"dku"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleAlwaysThisDeviceOnly\n");
}
else if ([[keyItem objectForKey:(id)kSecAttrAccessible] isEqualToString:@"akpu"]) {
printToStdOut(@"Keychain protection class: kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly\n");
}


printToStdOut(@"Application Label: %@\n", [keyItem objectForKey:(id)kSecAttrApplicationLabel]);
printToStdOut(@"Key Class: %@\n", keyClass);
printToStdOut(@"Permanent Key: %@\n", CFBooleanGetValue((CFBooleanRef)[keyItem objectForKey:(id)kSecAttrIsPermanent]) == true ? @"True" : @"False");
Expand Down