{"action":"created","issue":{"url":"https://api.github.com/repos/juuso/keychaindump/issues/9","repository_url":"https://api.github.com/repos/juuso/keychaindump","labels_url":"https://api.github.com/repos/juuso/keychaindump/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/juuso/keychaindump/issues/9/comments","events_url":"https://api.github.com/repos/juuso/keychaindump/issues/9/events","html_url":"https://github.com/juuso/keychaindump/issues/9","id":109645972,"number":9,"title":"Doesn't work on OSX El Capitan?","user":{"login":"sheharyarn","id":2355108,"avatar_url":"https://avatars.githubusercontent.com/u/2355108?v=3","gravatar_id":"","url":"https://api.github.com/users/sheharyarn","html_url":"https://github.com/sheharyarn","followers_url":"https://api.github.com/users/sheharyarn/followers","following_url":"https://api.github.com/users/sheharyarn/following{/other_user}","gists_url":"https://api.github.com/users/sheharyarn/gists{/gist_id}","starred_url":"https://api.github.com/users/sheharyarn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sheharyarn/subscriptions","organizations_url":"https://api.github.com/users/sheharyarn/orgs","repos_url":"https://api.github.com/users/sheharyarn/repos","events_url":"https://api.github.com/users/sheharyarn/events{/privacy}","received_events_url":"https://api.github.com/users/sheharyarn/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2015-10-03T21:06:58Z","updated_at":"2016-09-12T14:17:04Z","closed_at":null,"body":"I love `keychaindump`, I love it so so much. I've used it on Mavericks and Yosemite without any issues, but it's not working on my new macbook running OS X El Capitan. Has something changed in the new update or is it something else?\r\n\r\nI get this:\r\n\r\n```\r\n$ sudo ./keychaindump\r\n[*] Searching process 83 heap range 0x7fc891c00000-0x7fc892000000\r\n[-] Requested 4194304 bytes, got 112 bytes\r\n[-] Error (268435459) reading task memory @ 0x7fc891c00000\r\n[*] Searching process 83 heap range 0x7fc893800000-0x7fc893a00000\r\n[-] Requested 2097152 bytes, got 112 bytes\r\n[-] Error (268435459) reading task memory @ 0x7fc893800000\r\n[*] Searching process 83 heap range 0x7fc893a00000-0x7fc893b00000\r\n[-] Requested 1048576 bytes, got 112 bytes\r\n[-] Error (268435459) reading task memory @ 0x7fc893a00000\r\n[*] Searching process 83 heap range 0x7fc893b00000-0x7fc893c00000\r\n[-] Requested 1048576 bytes, got 112 bytes\r\n[-] Error (268435459) reading task memory @ 0x7fc893b00000\r\n[*] Found 0 master key candidates\r\n```"},"comment":{"url":"https://api.github.com/repos/juuso/keychaindump/issues/comments/246361364","html_url":"https://github.com/juuso/keychaindump/issues/9#issuecomment-246361364","issue_url":"https://api.github.com/repos/juuso/keychaindump/issues/9","id":246361364,"user":{"login":"Motti-Shneor","id":2647915,"avatar_url":"https://avatars.githubusercontent.com/u/2647915?v=3","gravatar_id":"","url":"https://api.github.com/users/Motti-Shneor","html_url":"https://github.com/Motti-Shneor","followers_url":"https://api.github.com/users/Motti-Shneor/followers","following_url":"https://api.github.com/users/Motti-Shneor/following{/other_user}","gists_url":"https://api.github.com/users/Motti-Shneor/gists{/gist_id}","starred_url":"https://api.github.com/users/Motti-Shneor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Motti-Shneor/subscriptions","organizations_url":"https://api.github.com/users/Motti-Shneor/orgs","repos_url":"https://api.github.com/users/Motti-Shneor/repos","events_url":"https://api.github.com/users/Motti-Shneor/events{/privacy}","received_events_url":"https://api.github.com/users/Motti-Shneor/received_events","type":"User","site_admin":false},"created_at":"2016-09-12T14:17:04Z","updated_at":"2016-09-12T14:17:04Z","body":"Actually, I was not that interested in deciphering  the key-chain brute-force, because my task is legit — I described it in the discussion part of your original essay (not in the repository).\n\nTo make things short - \n\nI need my daemon (running by launchd as root) to connect to our server on clients enterprise machines. Sometimes I need to go through HTTP proxy (hate them, but still, I need to support).\n\nReading HTTP proxy settings is easy - there’s nice CFNetwork API. I was happy to find the proxy settings are system-wide. However - when the proxy needs to be authenticated (when you type in a user/password pair in the proxy settings panel) then CFNetwork won’t read them for you - they’re on the user’s login key-chain (stored and encrypted per user) which is a little strange, but OK.\n\nNow I have two problems, and lots of wonders…\n\n1. My daemon, when using normal KeyChain APIs - won’t see the user’s keychains, and will find nothing\n\t(And I wonder: \nHow do all those system daemons, running as root or other users manage to connect to the internet so nicely? \nHow do they retrieve the proxy credentials?)\n\n2. Even when I run my code from the active user (whose login keychain contains the credentials) I still see that dialog of Allow/Deny/Always Allow my program access to the keychain. \n\t(And I wonder: \nWhy Safari, Mail, and all the other Apple apps never show such dialog?\nHow do they get silent access to the keychain? Maybe they don’t?\nWhen I press “Always Allow” Where is this “Trust” stored and how? \nCan I create such trust at installation time, before my daemon starts to run? How?\n\n\nI know these are many questions, but I really need to do this, and I KNOW for a fact that NSURLSession (higher level networking API) does all this for you - only it doesn’t support general-purpose proprietary format messages - only HTTP messages. Unluckily our server is not HTTP. \n\nAny clue or idea, or direction I could go?\n\n\nMotti Shneor\ne-mail: motti.shneor@gmail.com\nphone: +972-8-9267730\nmobile: +972-54-3136621\n\n— \nWindows is not a virus! A virus is small and efficient.\n— Jonathan Leffler, Informix\n\n\n\n\n\n\n\n\n\n> On 12 בספט׳ 2016, at 11:07 לפ׳, Juuso Salonen <notifications@github.com> wrote:\n> \n> Yep, SIP/rootless prevents spying on securityd. As far as I know, only Apple has the right entitlements to bypass the restriction, and they don't hand them out to outsiders.\n> \n> I think turning off SIP is the only reasonable way to resurrect keychaindump. Please correct me if I'm wrong!\n> \n> —\n> You are receiving this because you commented.\n> Reply to this email directly, view it on GitHub <https://github.com/juuso/keychaindump/issues/9#issuecomment-246276730>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AChnayvjoAuqT5Qi2UNz7VBUkg3QBD3qks5qpQg0gaJpZM4GIfI2>.\n> \n\n"}}
{"actor":{"display_login":"Motti-Shneor"}}