+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: APFS encrypted device with T2-Chip (/thread-8944.html)
APFS encrypted device with T2-Chip - matt99 - 02-06-2020
Following to this post, I successfully extracted an apfs-hash with apfs2hashcat and was able to attack it with hashcat (there was no T2-chip installed). Now the question arises how the hash behaves when a T2 chip is installed in the Macbook? Can you still read out the hash like that or what should i watch out for?
Is there anything to be considered when restoring the password or can you attack as usual, for example with wordlists and rules?
RE: APFS encrypted device with T2-Chip - digitalhussar - 02-16-2020
with the new t2 chip the keybag cannot be extracted from the disc image, so no tools can help you get the hash out. This can only be done with hardware
RE: APFS encrypted device with T2-Chip - Zen6 - 01-08-2021
Hi digitalhussar,
can you share your information about extracting the keybag out of a T2 chip?
Are you attacking over the Thunderbolt PCIe lines or over the USB debug port and chackm8/blackbird?
I'm struggling for months on a MacBook Air 2020 and am thankful for any idea.
Thanks