From d356489a4aabdfbcab7ac19a59197878a12b9594 Mon Sep 17 00:00:00 2001
From: Maxime Biette <maxime@biette.me>
Date: Mon, 29 May 2017 10:55:36 -0400
Subject: [PATCH 1/2] Add decryption for iOS 10.2 Manifest.DB (fixes #14)

---
 python_scripts/backup_tool.py      | 14 ++++++++--
 python_scripts/backups/backup10.py | 44 ++++++++++++++++++++++++++++--
 python_scripts/keystore/keybag.py  | 39 ++++++++++++++++++++++----
 3 files changed, 88 insertions(+), 9 deletions(-)

diff --git a/python_scripts/backup_tool.py b/python_scripts/backup_tool.py
index 63408ea..a855760 100755
--- a/python_scripts/backup_tool.py
+++ b/python_scripts/backup_tool.py
@@ -7,6 +7,7 @@
 import os
 import sys
 import plistlib
+import struct
 
 showinfo = ["Device Name", "Display Name", "Last Backup Date", "IMEI",
             "Serial Number", "Product Type", "Product Version", "iTunes Version"]
@@ -51,15 +52,24 @@ def extract_backup(backup_path, output_path, password=""):
         print "python keychain_tool.py -d \"%s\" \"%s\"" % (output_path + "/KeychainDomain/keychain-backup.plist", output_path + "/Manifest.plist")
 
     elif os.path.exists(backup_path + "/Manifest.db"):
-        manifset_db = ManifestDB(backup_path)
+        if 'ManifestKey' in manifest:
+            kb = Keybag.createWithBackupManifest(manifest, password, ios102=True)
+        else:
+            kb = Keybag.createWithBackupManifest(manifest, password)
 
-        kb = Keybag.createWithBackupManifest(manifest, password)
         if not kb:
             return
         manifest["password"] = password
         makedirs(output_path)
         plistlib.writePlist(manifest, output_path + "/Manifest.plist")
 
+        manifest_key = None
+        if 'ManifestKey' in manifest:
+            clas = struct.unpack('<L', manifest['ManifestKey'].data[:4])[0]
+            wkey = manifest['ManifestKey'].data[4:]
+            manifest_key = kb.unwrapKeyForClass(clas, wkey)
+
+        manifset_db = ManifestDB(backup_path, key=manifest_key)
         manifset_db.keybag = kb
         manifset_db.extract_backup(output_path)
 
diff --git a/python_scripts/backups/backup10.py b/python_scripts/backups/backup10.py
index 687352a..b9702de 100644
--- a/python_scripts/backups/backup10.py
+++ b/python_scripts/backups/backup10.py
@@ -80,12 +80,20 @@ def is_directory(self):
 
 
 class ManifestDB(object):
-    def __init__ (self, path):
+    def __init__ (self, path, key=None):
         self.files = {}
         self.backup_path = path
         self.keybag = None
 
-        conn = sqlite3.connect(os.path.join(path,'Manifest.db'))
+        mdb_path = os.path.join(path,'Manifest.db')
+
+        #If a key is provided, try to decrypt the DB
+        if key:
+            mdb_path_encrypted = mdb_path
+            mdb_path = os.path.join(path,'Manifest.db-decypted')
+            self.decrypt_manifest_db(mdb_path_encrypted, mdb_path, key)
+
+        conn = sqlite3.connect(mdb_path)
 
         try:
             conn.row_factory = sqlite3.Row
@@ -105,6 +113,38 @@ def __init__ (self, path):
         finally:
             conn.close()
 
+    @staticmethod
+    def decrypt_manifest_db(path_in, path_out, key):
+        """
+        Will decrypt the Manifest.db file using the provided key.
+
+        TODO: merge with method _extract_file
+        """
+        aes = AES.new(key, AES.MODE_CBC, "\x00"*16)
+        
+        f_in = file(path_in, 'rb')
+        f_out = file(path_out, 'wb')
+        
+        while True:
+            data = f_in.read(8192)
+            if not data:
+                break
+
+            data2 = data = aes.decrypt(data)
+            f_out.write(data)
+        
+        f_in.close()
+
+        c = data2[-1]
+        i = ord(c)
+
+        if i < 17 and data2.endswith(c*i):
+            f_out.truncate(f_out.tell() - i)
+
+        else:
+            print "Bad padding, last byte = 0x%x !" % i
+
+        f_out.close()
 
     def extract_backup(self, output_path):
         for mbfile in self.files.itervalues():
diff --git a/python_scripts/keystore/keybag.py b/python_scripts/keystore/keybag.py
index 649d5fa..dca3356 100644
--- a/python_scripts/keystore/keybag.py
+++ b/python_scripts/keystore/keybag.py
@@ -3,6 +3,7 @@
 from crypto.aeswrap import AESUnwrap
 from crypto.aeswrap import AESwrap
 from crypto.curve25519 import curve25519
+from Crypto.Hash import SHA256
 from hashlib import sha256, sha1
 from util.bplist import BPlistReader
 from util.tlv import loopTLVBlocks, tlvToDict
@@ -127,10 +128,10 @@ def createWithDataSignBlob(blob, deviceKey=None):
         return kb
     
     @staticmethod
-    def createWithBackupManifest(manifest, password, deviceKey=None):
+    def createWithBackupManifest(manifest, password, deviceKey=None, ios102=False):
         kb = Keybag(manifest["BackupKeyBag"].data)
         kb.deviceKey = deviceKey
-        if not kb.unlockBackupKeybagWithPasscode(password):
+        if not kb.unlockBackupKeybagWithPasscode(password, ios102=ios102):
             print "Cannot decrypt backup keybag. Wrong password ?"
             return
         return kb
@@ -163,18 +164,46 @@ def parseBinaryBlob(self, data):
         if currentClassKey:
             self.classKeys[currentClassKey["CLAS"] & 0xF] = currentClassKey
 
-    def getPasscodekeyFromPasscode(self, passcode):
+    def getPasscodekeyFromPasscode(self, passcode, ios102=False):
+        """
+        Generate a passcode key from the raw passcode provided using the keybag data.
+
+        Parameters
+        ----------
+        passcode : str
+            The passcode provided to decrypt the keybag
+        ios102 : bool
+            Will trigger the use of the iOS 10.2 method, which added an additional step.
+
+        Returns
+        -------
+        str
+            Passcode key in a binary format.
+
+        """
         if self.type == BACKUP_KEYBAG or self.type == OTA_KEYBAG:
+            if ios102:
+                """ Additional step introduce by iOS 10.2
+
+                Following this post:
+                https://github.com/horrorho/InflatableDonkey/issues/41#issuecomment-261927890
+                """
+                print "Generating the password key for iOS 10.2+. May take a while..."
+                passcode = PBKDF2(passcode,
+                                  self.attrs["DPSL"],
+                                  iterations=self.attrs["DPIC"],
+                                  digestmodule=SHA256
+                           ).read(32)
             return PBKDF2(passcode, self.attrs["SALT"], iterations=self.attrs["ITER"]).read(32)
         else:
             #Warning, need to run derivation on device with this result
             return PBKDF2(passcode, self.attrs["SALT"], iterations=1).read(32)
     
-    def unlockBackupKeybagWithPasscode(self, passcode):
+    def unlockBackupKeybagWithPasscode(self, passcode, ios102=False):
         if self.type != BACKUP_KEYBAG and self.type != OTA_KEYBAG:
             print "unlockBackupKeybagWithPasscode: not a backup keybag"
             return False
-        return self.unlockWithPasscodeKey(self.getPasscodekeyFromPasscode(passcode))
+        return self.unlockWithPasscodeKey(self.getPasscodekeyFromPasscode(passcode, ios102=ios102))
 
     def unlockAlwaysAccessible(self):
         for classkey in self.classKeys.values():

From 2bcfce7345a37c0217eed70ba6428f6adb15735b Mon Sep 17 00:00:00 2001
From: Maxime Biette <biette.maxime@gmail.com>
Date: Mon, 10 Jul 2017 13:48:58 -0400
Subject: [PATCH 2/2] Fix typo in filename

---
 python_scripts/backups/backup10.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python_scripts/backups/backup10.py b/python_scripts/backups/backup10.py
index b9702de..d1cb943 100644
--- a/python_scripts/backups/backup10.py
+++ b/python_scripts/backups/backup10.py
@@ -90,7 +90,7 @@ def __init__ (self, path, key=None):
         #If a key is provided, try to decrypt the DB
         if key:
             mdb_path_encrypted = mdb_path
-            mdb_path = os.path.join(path,'Manifest.db-decypted')
+            mdb_path = os.path.join(path,'Manifest.db-decrypted')
             self.decrypt_manifest_db(mdb_path_encrypted, mdb_path, key)
 
         conn = sqlite3.connect(mdb_path)