did you try to open the itunes backup with an empty password (zero length password) ?
I'm not sure if this is even possible, but I can't imagine that hashcat will tell you that this is the correct password even if it is not.... you could in theory even try to decrypt the file yourself and see if something useful could be recovered (if you are tech safy and/or a developer you could have a look at this to see how the decryption works: https://raw.githubusercontent.com/hashca.../m14700.pm and adapt it with your password/key etc to try to recover the data manually if iTunes doesn't let you test an empty password (anymore))
btw: the "if (defined $wpky_param)" branch in that test module (perl script) means that it tries to decrypt the specified $WPKY (the perl script makes the decision between "generating hashes"/encrypting and "testing cracks"/decryption). also note: that 12008468691120727718 is just 0xa6a6a6a6a6a6a6a6 in hexadecimal, see the optimized OpenCL/CUDA code: https://github.com/hashcat/hashcat/blob/...re.cl#L380).
I'm not sure if this is even possible, but I can't imagine that hashcat will tell you that this is the correct password even if it is not.... you could in theory even try to decrypt the file yourself and see if something useful could be recovered (if you are tech safy and/or a developer you could have a look at this to see how the decryption works: https://raw.githubusercontent.com/hashca.../m14700.pm and adapt it with your password/key etc to try to recover the data manually if iTunes doesn't let you test an empty password (anymore))
btw: the "if (defined $wpky_param)" branch in that test module (perl script) means that it tries to decrypt the specified $WPKY (the perl script makes the decision between "generating hashes"/encrypting and "testing cracks"/decryption). also note: that 12008468691120727718 is just 0xa6a6a6a6a6a6a6a6 in hexadecimal, see the optimized OpenCL/CUDA code: https://github.com/hashcat/hashcat/blob/...re.cl#L380).