Breaking the iCloud Keychain Artifacts

n0fate has released a new tool – it’s called iChainbreaker. As you can see, this Python script can be used for analyzing iCloud Keychain.

Here is how to use it:

usage: iChainbreaker.py [-h] -p PATH -k KEY [-x EXPORTFILE]

Tool for iCloud Keychain Analysis by @n0fate

optional arguments:

-h, –help show this help message and exit

-p PATH, –path PATH iCloud Keychain Path(~/Library/Keychains/[UUID]/)

-k KEY, –key KEY User Password

-x EXPORTFILE, –exportfile EXPORTFILE

Write a decrypted contents to SQLite file (optional)

You can download the script here.