hashcat Forum
-m 18300 APFS - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: -m 18300 APFS (/thread-8338.html)

-m 18300 APFS - Karamba - 05-01-2019

As you could read in this post I explained a walk-through for extracting the FileVault hash.
I also explained that this method wasn't working anymore since macOS 10.14 (Mojave).
The tool from JtR (apfs2john, a fork of apfs-fuse) was for the same reason not working anymore.

It appeared that Apple used a 4096 byte sectors in the partition table. (Read this issue on GitHub for more details)

Finally, apfs-fuse got updated and it got forked.
You'll find a working "APFS-hash-extractor" (named apfs2hashcat) on this Github: https://github.com/Banaanhangwagen/apfs2hashcat

The readme explains also the reason of multiple extracted hashes.

Happy cracking!

RE: -m 18300 APFS - epixoip - 05-02-2019

Very cool, good job