Skip to content

Instantly share code, notes, and snippets.

Created March 3, 2017 17:58
What would you like to do?
extract & parse the BackupKeyBag from an iTunes Backup
#!/usr/bin/env python
# extracts and parse BackupKeyBag
# 2017.02.04 darell tan
from plist import *
import struct
import sys
from binascii import hexlify
from collections import OrderedDict
from cStringIO import StringIO
from StringIO import StringIO
def getKeybagFile(manifest_file):
Retrieves the BackupKeyBag embedded within the Manifest.plist.
with open(manifest_file, 'rb') as f:
data =
pl = Structure.from_bin(data) if data.startswith('bplist') \
else Structure.from_xml(data)
assert 'Version' in pl
return StringIO(pl['BackupKeyBag'].get_value())
class Keybag:
def __init__(self, f):
self.hdr = OrderedDict()
self.keys = []
self.f = f if hasattr(f, 'read') else open(f, 'rb')
def _parse(self):
keys = []
currKey = OrderedDict()
while True:
hdr =
if hdr == '':
typ, sz = struct.unpack('>4sI', hdr)
data =
if sz == 4:
data, = struct.unpack('>I', data)
# UUID usually first item of each entry
if typ == 'UUID':
if 'UUID' in currKey:
self.hdr = currKey
currKey = OrderedDict()
currKey[typ] = data
if currKey:
self.keys = keys
def dump(self):
for k, v in self.hdr.iteritems():
print k, v
print '-' * 10
def decode(typ, val):
if typ == 'UUID':
v = hexlify(val)
return '%s...%s' % (v[:6], v[-4:])
elif not isinstance(val, (int, long)):
return hexlify(val)
return repr(val)
for key in self.keys:
print ', '.join('%s: %s' % (k, decode(k, v)) \
for k, v in key.iteritems())
def __repr__(self):
return repr(self.keys)
def main():
stream = getKeybagFile(sys.argv[1])
k = Keybag(stream)
if __name__ == '__main__':
Copy link

Vxer-Lee commented Feb 9, 2018

#include <stdio.h> int main(int argc,char *argv[]) { int argc = 0; return 0; }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment