Itunes Backup

[joswr1ght]

Try running it without Device #2

That helps a bit, thanks, but still some bugs. Looks like the issue is primarily with mode 14800. Mode 14700 (iOS 9-style backups) works well:

Code:

$ cat itunes-9.txt $itunes_backup$*9*06dc04bca4eeea2fbc1bc7356fa758243bead479673640a668db285c8f48c402cc435539d935509e*10000*37d2bd7caefbb24a9729e41a3257ef06188dc01e** $ cat mylist password1 password2 test123 badpassword $ ~/Hack/hashcat/hashcat -m 14700 -d3 --weak-hash-threshold 0 itunes-9.txt mylist hashcat (v3.30-55-g32e285f) starting... OpenCL Platform #1: Apple ========================= * Device #1: Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz, skipped * Device #2: Iris Pro, skipped * Device #3: GeForce GT 750M, 512/2048 MB allocatable, 2MCU Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 ... $itunes_backup$*9*06dc04bca4eeea2fbc1bc7356fa758243bead479673640a668db285c8f48c402cc435539d935509e*10000*37d2bd7caefbb24a9729e41a3257ef06188dc01e**:test123 Session..........: hashcat Status...........: Cracked Hash.Type........: iTunes Backup < 10.0 Hash.Target......: $itunes_backup$*9*06dc04bca4eeea2fbc1bc7356fa758243bead479673640a668db285c8f48c402cc435539d935509e*10000*37d2bd7caefbb24a9729e41a3257ef06188dc01e** Time.Started.....: Fri Jan 27 16:15:13 2017 (1 sec) Time.Estimated...: Fri Jan 27 16:15:14 2017 (0 secs) Input.Base.......: File (mylist) Input.Queue......: 1/1 (100.00%) Speed.Dev.#3.....:        0 H/s (0.56ms) Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts Progress.........: 4/4 (100.00%) Rejected.........: 0/4 (0.00%) Restore.Point....: 0/4 (0.00%) Candidates.#3....: password1 -> badpassword Started: Fri Jan 27 16:15:12 2017 Stopped: Fri Jan 27 16:15:14 2017

Mode 14700's benchmark feature also works OK:

Code:

$ ~/Hack/hashcat/hashcat -m 14700 -d3 -b hashcat (v3.30-55-g32e285f) starting in benchmark mode... OpenCL Platform #1: Apple ========================= * Device #1: Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz, skipped * Device #2: Iris Pro, skipped * Device #3: GeForce GT 750M, 512/2048 MB allocatable, 2MCU Hashtype: iTunes Backup < 10.0 Speed.Dev.#3.....:     2521 H/s (80.81ms) Started: Fri Jan 27 16:22:36 2017 Stopped: Fri Jan 27 16:22:44 2017

With iOS 10 however, it takes 4.5 minutes to crack the password:

Code:

$ ~/Hack/hashcat/hashcat -m 14800 -d3 --weak-hash-threshold 0 itunes-10.txt mylist hashcat (v3.30-55-g32e285f) starting... OpenCL Platform #1: Apple ========================= * Device #1: Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz, skipped * Device #2: Iris Pro, skipped * Device #3: GeForce GT 750M, 512/2048 MB allocatable, 2MCU Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 Applicable Optimizers: * Zero-Byte * Single-Hash * Single-Salt * Slow-Hash-SIMD Watchdog: Temperature abort trigger disabled Watchdog: Temperature retain trigger disabled Cache-hit dictionary stats mylist: 40 bytes, 4 words, 4 keyspace The wordlist or mask you are using is too small. Therefore, hashcat is unable to utilize the full parallelization power of your device(s). The cracking speed will drop. Workaround: https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_to_create_more_work_for_full_speed INFO: approaching final keyspace, workload adjusted $itunes_backup$*10*deff6d646eb1fa2b6741efee8b70eda84341a838cef2bb10e582669759d7e33c399a0ba2a52cb9ec*10000*f09cfa82cc1695657cb2c347ee127c2523795fda*10000000*66f159e15f3ddbbdd4057f8babef7ad4472fac10:test123 Session..........: hashcat Status...........: Cracked Hash.Type........: iTunes Backup >= 10.0 Hash.Target......: $itunes_backup$*10*deff6d646eb1fa2b6741efee8b70eda84341a838cef2bb10e582669759d7e33c399a0ba2a52cb9ec*10000*f09cfa82cc1695657cb2c347ee127c2523795fda*10000000*66f159e15f3ddbbdd4057f8babef7ad4472fac10 Time.Started.....: Fri Jan 27 16:17:15 2017 (4 mins, 28 secs) Time.Estimated...: Fri Jan 27 16:21:43 2017 (0 secs) Input.Base.......: File (mylist) Input.Queue......: 1/1 (100.00%) Speed.Dev.#3.....:        0 H/s (6.42ms) Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts Progress.........: 4/4 (100.00%) Rejected.........: 0/4 (0.00%) Restore.Point....: 0/4 (0.00%) Candidates.#3....: password1 -> badpassword Started: Fri Jan 27 16:17:14 2017 Stopped: Fri Jan 27 16:21:44 2017

And the benchmark feature shows 0 H/s:

Code:

$ ~/Hack/hashcat/hashcat -m 14800 -d3 -b | grep Speed Speed.Dev.#3.....:        0 H/s (60.15ms)

I think most of us are primarily interested in iOS 10 support. Any thoughts on these issues?

Thanks!

-Josh