Fix decryption on Ventura 13.6 for bare-metal M1 instances (#214)

* Update to fallback to regex key parsing

* [pre-commit.ci lite] apply automatic fixes

* Add exceptions

* [pre-commit.ci lite] apply automatic fixes

* Add ignore

* [pre-commit.ci lite] apply automatic fixes

* Move ignore

* Update spacing

* Update plist.py

* Break out login into helper function in parser

---------

Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>
This commit is contained in:
Gabe Koleszar
2026-01-13 10:57:17 -05:00
committed by GitHub
parent 32d0304022
commit 2d96c37eb7

View File

@@ -12,6 +12,7 @@ from __future__ import annotations
import logging import logging
import plistlib import plistlib
import re
import subprocess import subprocess
from pathlib import Path from pathlib import Path
from typing import IO from typing import IO
@@ -26,15 +27,36 @@ logger = logging.getLogger(__name__)
_DEFAULT_SEARCH_PATH = Path.home() / "Library" / "com.apple.icloud.searchpartyd" _DEFAULT_SEARCH_PATH = Path.home() / "Library" / "com.apple.icloud.searchpartyd"
def _parse_beaconstore_key_from_string_output(output: str) -> bytes:
if '"acct"<blob>="BeaconStoreKey"' not in output:
raise ValueError
m = re.search(r'"gena"<blob>=0x([0-9A-Fa-f]+)', output)
if not m:
raise ValueError
return bytes.fromhex(m.group(1))
def _parse_beaconstore_key_from_hex_output(output: str) -> bytes:
if not output:
msg = "Empty output from security -w"
raise ValueError(msg)
return bytes.fromhex(output)
# consider switching to this library https://github.com/microsoft/keyper # consider switching to this library https://github.com/microsoft/keyper
# once they publish a version of it that includes my MR with the changes to make it compatible # once they publish a version of it that includes my MR with the changes to make it compatible
# with keys that are non-utf-8 encoded (like the BeaconStore one) # with keys that are non-utf-8 encoded (like the BeaconStore one)
# if I contribute this, properly escape the label argument here... # if I contribute this, properly escape the label argument here...
def _get_beaconstore_key() -> bytes: def _get_beaconstore_key() -> bytes:
"""Get the decryption key for BeaconStore using the system password prompt window.""" try:
# This thing will pop up 2 Password Input windows... # This thing will pop up 2 Password Input windows...
key_in_hex = subprocess.getoutput("/usr/bin/security find-generic-password -l 'BeaconStore' -w") # noqa: S605 key_in_hex = subprocess.getoutput( # noqa: S605
return bytes.fromhex(key_in_hex) "/usr/bin/security find-generic-password -l 'BeaconStore' -w"
)
return _parse_beaconstore_key_from_hex_output(key_in_hex)
except (ValueError, subprocess.SubprocessError):
output = subprocess.getoutput("/usr/bin/security find-generic-password -l 'BeaconStore'") # noqa: S605
return _parse_beaconstore_key_from_string_output(output)
def _get_accessory_name( def _get_accessory_name(