#!/usr/bin/env python2

# keychain2john processes input Mac OS X keychain files into a format suitable
# for use with JtR.
#
# This software is Copyright (c) 2014, Dhiru Kholia <dhiru [at] openwall.com>
# and (c) 2004 Matt Johnston <matt @ ucc asn au>,
#
# This code may be freely used and modified for any purpose.
#
# For "inner working details", see keychain2john.c file
#
# Output Format: filename:$keychain$*salt*iv*ciphertext

import sys
import struct
import os
from binascii import hexlify

SALTLEN = 20
IVLEN = 8
CTLEN = 48

magic = b"\xfa\xde\x07\x11"


def process_file(filename):

    f = open(filename, "rb")

    f.seek(-4, 2)

    while True:
        f.seek(-8, 1)
        data = f.read(4)
        if len(data) < 4:
            msg = "%s : Couldn't find db key. Is it a keychain file?\n"
            sys.stderr.write(msg % filename)
            sys.exit(1)

        if data == magic:
            break

    pos = f.tell() - 4

    # ciphertext offset
    f.seek(pos + 8, 0)
    cipheroff = struct.unpack(">I", f.read(4))[0]

    # salt
    f.seek(pos + 44, 0)
    salt = f.read(SALTLEN)
    if len(salt) != SALTLEN:
        sys.stderr.write("Something went wrong - fread(salt) error\n")
        sys.exit(1)

    # IV
    f.seek(pos + 64, 0)
    iv = f.read(IVLEN)
    if len(iv) != IVLEN:
        sys.stderr.write("Something went wrong - fread(iv) error\n")
        sys.exit(1)

    # ciphertext
    f.seek(pos + cipheroff, 0)
    ct = f.read(CTLEN)
    if len(ct) != CTLEN:
        sys.stderr.write("Something went wrong - fread(ct) error\n")
        sys.exit(1)

    # output
    sys.stdout.write("%s:$keychain$*" % os.path.basename(filename))
    sys.stdout.write(hexlify(salt).decode("ascii"))
    sys.stdout.write("*")
    sys.stdout.write(hexlify(iv).decode("ascii"))
    sys.stdout.write("*")
    sys.stdout.write(hexlify(ct).decode("ascii"))
    sys.stdout.write("\n")

    f.close()


if __name__ == "__main__":
    if len(sys.argv) < 2:
        sys.stdout.write("Usage: keychain2john [keychain files]\n")
        sys.exit(-1)

    for i in range(1, len(sys.argv)):
        process_file(sys.argv[i])
