dissect.apfs.objects.keybag

Module Contents

Classes

Keybag	APFS Keybag.
ContainerKeybag	APFS Container Keybag.
VolumeKeybag	APFS Volume Keybag.
MediaKeybag	APFS Media Keybag.
KEKBlob
KEK
VEKBlob
VEK

Functions

aes_unwrap

AES key unwrapping algorithm (RFC3394).

Attributes

HAS_PYSTANDALONE
HAS_CRYPTO

dissect.apfs.objects.keybag.HAS_PYSTANDALONE = True

dissect.apfs.objects.keybag.HAS_CRYPTO = True

class dissect.apfs.objects.keybag.Keybag(*args, **kwargs)

Bases: dissect.apfs.objects.base.Object

APFS Keybag.

__struct__

object: dissect.apfs.c_apfs.c_apfs.media_keybag

entries

property type: dissect.apfs.c_apfs.c_apfs.OBJECT_TYPE

The object’s type.

class dissect.apfs.objects.keybag.ContainerKeybag(*args, **kwargs)

Bases: Keybag

APFS Container Keybag.

__type__

volume_keybag(uuid: bytes) → VolumeKeybag | None

The volume keybag for the given volume UUID, if present.

Parameters:

uuid – The volume UUID.

vek(uuid: bytes) → VEK | None

The volume encryption key (VEK) for the given volume UUID, if present.

Parameters:

uuid – The volume UUID.

class dissect.apfs.objects.keybag.VolumeKeybag(*args, **kwargs)

Bases: Keybag

APFS Volume Keybag.

__type__

password_hint(uuid: bytes) → str | None

The password hint for the volume, if present.

Parameters:

uuid – The volume UUID.

keks() → collections.abc.Iterator[KEK]

Iterator over the KEKs in the volume keybag.

class dissect.apfs.objects.keybag.MediaKeybag(*args, **kwargs)

Bases: Keybag

APFS Media Keybag.

__type__

class dissect.apfs.objects.keybag.KEKBlob

Bases: asn1crypto.core.Sequence

class dissect.apfs.objects.keybag.KEK

Bases: asn1crypto.core.Sequence

__repr__() → str

property uuid: uuid.UUID

The KEK’s UUID.

property flags: int

The KEK’s flags.

verify() → bool

Verify the KEK’s HMAC.

unwrap(password: str) → bytes

Unwrap the KEK using the given password.

class dissect.apfs.objects.keybag.VEKBlob

Bases: asn1crypto.core.Sequence

class dissect.apfs.objects.keybag.VEK

Bases: asn1crypto.core.Sequence

__repr__() → str

property uuid: uuid.UUID

The VEK’s UUID.

property flags: int

The VEK’s flags.

verify() → bool

Verify the VEK’s HMAC.

unwrap(key: bytes) → bytes

Unwrap the KEK using the given key.

dissect.apfs.objects.keybag.aes_unwrap(kek: bytes, wrapped: bytes, iv: int = 12008468691120727718) → bytes

AES key unwrapping algorithm (RFC3394).

Derived from https://github.com/kurtbrose/aes_keywrap/blob/master/aes_keywrap.py