keybag

Documentation

Overview

This has been run against a keybag from Manifest.plist in an iOS backup. It will probably need work to handle other keybag variants.

/var/db/lockdown plists appear to no longer contain keybags. (And 0x835 was needed to decrypt them anyway.)

Index

• type Key
• type Keybag
  • func Read(data []byte) Keybag
  • func (kb *Keybag) GetClassKey(class uint32) []byte
  • func (kb *Keybag) SetPassword(password string) error

Types

type Key

type Key struct {
	UUID       []byte
	Class      uint32
	Wrap       uint32
	KeyType    uint32
	WrappedKey []byte
	Key        []byte
}

type Keybag

type Keybag struct {
	Version uint32
	Type    uint32

	UUID    []byte
	HMAC    []byte
	Wrap    uint32
	Salt    []byte
	Iter    uint32
	AuxSalt []byte
	AuxIter uint32
	Keys    []*Key
}

func Read

func Read(data []byte) Keybag

func (*Keybag) GetClassKey

func (kb *Keybag) GetClassKey(class uint32) []byte

Get a class key, or nil if not available

func (*Keybag) SetPassword

func (kb *Keybag) SetPassword(password string) error

SetPassword decrypts the keybag, recovering some of the keys.