{"id":755,"date":"2020-11-16T17:31:47","date_gmt":"2020-11-16T16:31:47","guid":{"rendered":"https:\/\/kolbi.cz\/blog\/?p=755"},"modified":"2020-11-18T08:54:27","modified_gmt":"2020-11-18T07:54:27","slug":"extract-backup-and-restore-google-authenticator-keys-on-ios-migrate-accounts-jailbreak-required","status":"publish","type":"post","link":"https:\/\/kolbi.cz\/blog\/2020\/11\/16\/extract-backup-and-restore-google-authenticator-keys-on-ios-migrate-accounts-jailbreak-required\/","title":{"rendered":"Extract, Backup and Restore Google Authenticator Keys on iOS (Migrate Accounts) – Jailbreak required"},"content":{"rendered":"\n

everyone who changes mobile phones often like me, probably faced the issue that not really all settings are being migrated to a new phone. even using encrypted iTunes backups, some data will be missing on the new device. <\/p>\n\n\n\n

this is the case for the Google Authenticator app for example. i personally keep a backup of the keys, so i just can scan them again when i install the app on a different device, but for one account i forgot to do that and i noticed it only after i installed the new phone.<\/p>\n\n\n\n

i didn’t wipe the old device and still had access to the google authenticator app, but this particular account doesn’t allow self provisioning and i didn’t want to get in contact with the owner, just because i got a new phone.<\/p>\n\n\n\n

for other reasons i recently played with the iOS keychain and i learned, that some items only can be read when having the hardware AES keys. you can read about those over here on theiphonewiki<\/a> or here<\/a>.<\/p>\n\n\n\n

the following articles have some good information about how to decrypt iTunes backups and get the keychain content, but sadly i was not able to get those methods to work with iOS 13.5 and macOS Mojave. i also didn’t find a way to extract the hardware keys on newer iPhones (in my case iPhone X and XS). <\/p>\n\n\n\n

http:\/\/www.securitylearn.net\/tag\/decrypting-iphone-keychain-from-backups-on-windows\/<\/a><\/p>\n\n\n\n

https:\/\/dpron.com\/recovering-google-authenticator-keys-from-ios-backups\/<\/a><\/p>\n\n\n\n

the second article even states, that this method doesn’t work anymore on newer iOS versions, but it reveals how to reconstruct the QR code from the keychain data. <\/p>\n\n\n\n

i remembered some older tools, which were able to dump the keychain on the device itself and i eventually found keychain_dumper <\/a>on github. but this didn’t work on iOS 13.5 and i noticed that this is an issue <\/a>due changes from Apple. in this issue someone mentions also a tool called keychain_editor <\/a>and the newest build is linked there too. with this i finally managed to read the keychain on my iPhone. later i found out that there is even a newer version on the repo (see below).<\/p>\n\n\n\n

this was all i needed to know – now i just had to find the correct entry and do some encoding\/decoding to create the QR code for the Google Authenticator app!<\/p>\n\n\n\n

here is how you can do it yourself:<\/p>\n\n\n\n