Help with iTunes back up decrypt iOS 9

[sc710]

**new to hashcat**

hello so I've been trying to retrieve a iPhone backup that contains some stuff I lost after misplacing a externalHD.
I have tried everything I can think of/just about every suggestion I can find for through forums that are specific to  Hashcat on MacOS. (don't know if Mac and linux vary as much as Mac and windows)

 I am able to successfully install / run hash cat but I keep getting the error "signature unmatched, no hashes loaded"
I have tried one suggestion I saw in another forum  saying hashes containing "$" need to be in single quotes ( No luck.) I've tried saving the hashes into a different text file, different type of file, and even where said file is located and still am having no luck. 
I was wondering if someone could possibly tell me what I'm doing wrong, or if there is some sort of error, Hashcat version issue or some sort of bug that is preventing me from succefully retrieving my password.
I also get the notification device 2; this devices local memory is too small (don't know if that is relevant to the situation  but I am trying to provide as much detail as I can without copying and pasting all of what is in my current shell. 
 
will provide further details if needed. 

**note the hash was not obtained through Philsmd/itunes_backup2hashcat. I found a webservice that took my manifest.plist and gave me the hash**[url=https://github.com/philsmd/itunes_backup2hashcat][/url]


any help would be much appreciated. thank you in advance

[Banaanhangwagen]

What was your exact command?
Your hash needs to be in the exact same format is found here https://hashcat.net/wiki/doku.php?id=example_hashes.
In order to avoid messing around with single or double quotes, consider copy-pasting the hash in a txt file, and using that file as input.

[sc710]

Ok

What was your exact command?
Your hash needs to be in the exact same format is found here https://hashcat.net/wiki/doku.php?id=example_hashes.
In order to avoid messing around with single or double quotes, consider copy-pasting the hash in a txt file, and using that file as input.

I’ve tried using the commands found and no this forum using the 14800 (which if I’m not mistaken is for ios 10 and lower. 
I’ve also tried various other codes I’ve found through other searches on google. I’ve tried putting the hashes into their own text file. Hashcat gives me an error that says  no hashes found. I’ve tried dragging the hash into terminal. I will try again once I am gone and I will take screenshots of the various commands I’ve tried .   Ive gone though the hashcat forums and I’ve tried following along with a YouTube video and am still having 0 luck. I have the hash in the correct format, I double checked the link you provided and am sure i have the hash that starts with a dollar sign followed by tunes 9 and so on.  Sorry for the vague description but I can’t remember all the commands off hand and am not near my computer . I have tried using hash cat to scan a plain txt file that contains the hash obtained from the plist. I also saw somewhere at one point that sometimes it will overlook a file that has fewer than five ashes in it which I corrected and still had no luck. Like I said I am new to using cash cat so I was literally trying basically anything I could find that could possibly point me in the right direction and still nothing. Hence the reason why I’ve tried so many various random things.  I can provide you with a hash if you would like to see the form out of the hash that I have for yourself.. 
I obtained it from a web service that lets you upload the playlist and then gives you back the hash in the output box.


I also used this with no luck > hashcat64 -m 14700 -a 3 . after trying all and having my Mac shut down I'm having trouble finding the exact list of each thing I had tried.

[sc710]

I've tried this input and still have nothing. if someone could please help explain to me what I'm doing wrong it'd be much appreciated.

./hashcat -m 14800 -a 3 -w 3 /Users/MYUSERNAME/hashcat/hashes.txt rockyou.txt -o output.txt


still am receiving the same "no hashes loaded" response. I've tried importing them into a text file, I've tried inputting them in manually into quotes (which is what I saw sighted somewhere else and am still coming up with nothing..

[Banaanhangwagen]

Again, your hash needs to be formatted as found for -m 14800 in https://hashcat.net/wiki/doku.php?id=example_hashes

Are you working on Windows? Make sure you use hashcat.exe and that you point correctly (pathname!) to your hash.txt.

Finally, you are using in your command -a3 (mask attack) and rockyou.txt (wordlist attack). Please pick one of the two.

[sc710]

I am trying to decrypt a iOS 9 back up. sorry I had 14800 (10 or greater) when I meant 14700.( 9 and below) if I am reading that wrong please correct me .

I just followed a step by step tutorial and still am receiving the same no hashes loaded response.

the input I that I built by following the video is ./hashcat -d 1 -m 14700 manifest9.txt -a 3 ?d?d?d?d?

and received ./hashcat -d 1 -m 14700 manifest9.txt -a 3 ?d?d?d?d?
hashcat (v6.2.2-114-g72d7048b7) starting

* Device #2: This device's local mem size is too small.

OpenCL API (OpenCL 1.2 (May 7 2020 00:10:14)) - Platform #1 [Apple]
====================================================================
* Device #1: Intel(R) Core(TM)2 Duo CPU P8600 @ 2.40GHz, 4032/4096 MB (1024 MB allocatable), 2MCU
* Device #2: GeForce 320M, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hash 'manifest9.txt': Separator unmatched
No hashes loaded.

Started: Thu Jul 15 03:25:36 2021
Stopped: Thu Jul 15 03:25:37 2021



as a response

after trying this input through hashcat, It still says no hashes loaded. I followed every step exactly just to get the same error.
it also says devices memory too low. (device 2)

sorry for the vague descritption and trial and error commands, but I am really frustrated, and after following a step by step procedure I still received the same response..
after following everything step by step I don't see why I would receive a no hashes loaded response unless there was some sort of issue..

please help me understand.

this is the tutorial I followed.

https://m.youtube.com/watch?v=MMySnPzsPYU

[Banaanhangwagen]

There is something wrong with the format of your hash.
Please use this script to correctly extract that hash: https://github.com/philsmd/itunes_backup2hashcat

[sc710]

now I got it running with the correct hash and its just looping saying its running it stdin mode but it isn't gaining any progress

[sc710]

Finished running and it says there are no password candidates received an STDIN mode . Followed by aborting .

[sc710]

Success.
Thank you for the little bit of direction you provided. ultimately you reiterating simple things I should of read up on and gained a thorough understanding before trying helped me get where I needed to be.
Just goes to show just about anyone can learn to use hashcat efficiently.