unable to identify Apple Notes hash
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
After updating to iOS 17.5.1, Notes cannot be unlocked using FaceID, and the previously correct password is no longer valid. I used DB Browser to view the notestore.sqlite file and extracted the following data. The first entry was created after I updated the system, and the password is 000000.
| Z_PK | ZCRYPTOITERATIONCOUNT | ZCRYPTOSALT | ZCRYPTOWRAPPEDKEY | ZCRYPTOINITIALIZATIONVECTOR | ZCRYPTOVERIFIER | ZCRYPTOTAG |
|---|---|---|---|---|---|---|
| 2 | 20000 | ba22f9cac03eab04ecec940f52c4d32e | NULL | NULL | 510550b86555bd460c61e9bfe8de1adb7dd9d0acaa69eeeb | NULL |
| 278 | 0 | 55789bfd2e0622993734917aa123db0b | 1abe731602eb79a2c58dbe14652e9dfd | d6ffe178d2d102b33b7e798f7ed7db4c | NULL | b09d5a47de763b3fddfc2dc6e4440c21 |
| 281 | 0 | 6ed2d9331a174b6e6b980bc0983356b0 | 146caeb4e8db685ac91e3b0804f70ea4 | ac803a1af9a5e54bf052c8c090a2a5ac | NULL | e99d6f25c012d2ab5e04bd1bf2420674 |
I checked the applenotes2john.py script and found that ZCRYPTOWRAPPEDKEY and ZCRYPTOVERIFIER can be used interchangeably. However, the ZCRYPTOVERIFIER field is empty for the latter two entries, and the ZCRYPTOWRAPPEDKEY is 16 bytes long instead of 24 bytes.
I attempted to use $ASN$*281*0*6ed2d9331a174b6e6b980bc0983356b0*146caeb4e8db685ac91e3b0804f70ea4 as the hash, but it cannot be recognized.
Anyone can help me with this? Many Thanks.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with applenotes2john.py and compare its expected ZCRYPTOVERIFIER and ZCRYPTOWRAPPEDKEY fields with the supplied notestore.sqlite rows. Investigate how the iOS 17.5.1 records differ from the existing format and verify whether the resulting value can be recognized by John the Ripper. Done means establishing a supported hash representation or documenting why these records cannot be handled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, python
- Domain
- cryptography, reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 18/100