微软验证器 iOS OTP 备份导出流程

/var/mobile/Containers/Data/Application/

/var/mobile/Containers/Data/Application/F1412516-75E3-45B4-9F32-234648054C13

// Frida 17/** * 导出 Microsoft Authenticator 中的 TOTP，并生成 otpauth:// URI * * 用法： * frida -U -n ”Authenticator” -l dump.js */”use strict”;function nsDataToString(nsData) { try { return ObjC.classes.NSString.alloc().initWithData_encoding_(nsData, 4).toString(); } catch (_) { return null; }}function main() { if (!ObjC.available) { console.log(”[!] ObjC 不可用”); return; } // 获取 SecItemCopyMatching 函数地址 var SecItemCopyMatching = null; var modules = Process.enumerateModules(); for (var i = 0; i < modules.length; i++) { if (modules[i].name === ”Security”) { var exports = modules[i].enumerateExports(); for (var j = 0; j < exports.length; j++) { if (exports[j].name === ”SecItemCopyMatching”) { SecItemCopyMatching = exports[j].address; break; } } break; } } if (SecItemCopyMatching === null) { console.log(”[!] 找不到 SecItemCopyMatching”); return; } var SecItemCopyMatchingFunc = new NativeFunction( SecItemCopyMatching, ”int”, [”pointer”, ”pointer”] ); var query = ObjC.classes.NSMutableDictionary.alloc().init(); query.setObject_forKey_(ObjC.classes.NSString.stringWithString_(”genp”), ObjC.classes.NSString.stringWithString_(”class”)); query.setObject_forKey_(ObjC.classes.NSString.stringWithString_(”com.microsoft.authenticator”), ObjC.classes.NSString.stringWithString_(”svce”)); query.setObject_forKey_(ObjC.classes.NSNumber.numberWithBool_(true), ObjC.classes.NSString.stringWithString_(”r_Data”)); query.setObject_forKey_(ObjC.classes.NSNumber.numberWithBool_(true), ObjC.classes.NSString.stringWithString_(”r_Attributes”)); query.setObject_forKey_(ObjC.classes.NSString.stringWithString_(”m_LimitAll”), ObjC.classes.NSString.stringWithString_(”m_Limit”)); var resultPtr = Memory.alloc(Process.pointerSize); resultPtr.writePointer(ptr(”0”)); var status = SecItemCopyMatchingFunc(query.handle, resultPtr); if (status !== 0) { console.log(”[!] Keychain 查询失败，OSStatus: ” + status); return; } var arr = ObjC.Object(resultPtr.readPointer()); var count = arr.count(); console.log(””); console.log(”=== Microsoft Authenticator TOTP 导出（” + count + ” 个账户）===”); console.log(””); for (var i = 0; i < count; i++) { var item = arr.objectAtIndex_(i); var acctData = item.objectForKey_(ObjC.classes.NSString.stringWithString_(”acct”)); var secretData = item.objectForKey_(ObjC.classes.NSString.stringWithString_(”v_Data”)); var acctStr = acctData ? nsDataToString(acctData) : null; var secret = secretData ? nsDataToString(secretData) : null; if (!acctStr || !secret || secret.length === 0) continue; var uuid = acctStr.replace(”V1|”, ””); var label = item.objectForKey_(ObjC.classes.NSString.stringWithString_(”labl”)); var labelStr = label ? nsDataToString(label) : null; // 尝试从标签中获取账户信息 var issuer = labelStr || uuid; var name = uuid; var uri = ”otpauth://totp/” + encodeURIComponent(issuer) + ”:” + encodeURIComponent(name) + ”?secret=” + secret + ”&issuer=” + encodeURIComponent(issuer) + ”&algorithm=SHA1&digits=6&period=30”; console.log(uri); } console.log(””); console.log(”=== 导出完成 ===”);}setImmediate(main);

frida -U -n ”Authenticator” -l dump.js

frida-ps -Uai

python3 -m pip install qrcode pillow

#!/usr/bin/env python3”””将 otpauth:// URI 转换为二维码：每个账户一张，并生成一张汇总图。”””import refrom pathlib import Pathfrom urllib.parse import unquoteimport qrcodefrom PIL import Image, ImageDraw, ImageFontLOG_FILE = Path(__file__).parent / ”log.txt”OUTPUT_DIR = Path(__file__).parent / ”otp_qrcodes”def extract_label(uri: str) -> str: match = re.search(r”otpauth://totp/(.+?)\?”, uri) if not match: return ”unknown” return unquote(match.group(1))def make_qr(data: str, box_size: int = 10) -> Image.Image: qr = qrcode.QRCode( error_correction=qrcode.constants.ERROR_CORRECT_M, box_size=box_size, border=2, ) qr.add_data(data) qr.make(fit=True) return qr.make_image(fill_color=”black”, back_color=”white”).convert(”RGB”)def try_load_font(size: int): for name in [ ”/System/Library/Fonts/PingFang.ttc”, ”/System/Library/Fonts/STHeiti Light.ttc”, ”/System/Library/Fonts/Helvetica.ttc”, ]: try: return ImageFont.truetype(name, size) except (OSError, IOError): continue return ImageFont.load_default()def main(): text = LOG_FILE.read_text(encoding=”utf-8”) uris = [ line.strip() for line in text.splitlines() if line.strip().startswith(”otpauth://”) ] if not uris: print(”未找到 otpauth:// URI”) return OUTPUT_DIR.mkdir(exist_ok=True) font = try_load_font(20) cards: list[Image.Image] = [] for i, uri in enumerate(uris): label = extract_label(uri) qr_img = make_qr(uri, box_size=8) qw, qh = qr_img.size card_w = max(qw + 40, 360) card_h = qh + 70 card = Image.new(”RGB”, (card_w, card_h), ”white”) draw = ImageDraw.Draw(card) draw.text((20, 15), label, fill=”black”, font=font) card.paste(qr_img, ((card_w - qw) // 2, 50)) filename = re.sub(r”[^\w\-.]”, ”_”, label) + ”.png” card.save(OUTPUT_DIR / filename) print(f”[{i + 1}/{len(uris)}] {filename}”) cards.append(card)# 生成三列布局的汇总图 cols = 3 rows = (len(cards) + cols - 1) // cols card_width = max(card.width for card in cards) card_height = max(card.height for card in cards) padding = 10 total_width = cols * card_width + (cols + 1) * padding total_height = rows * card_height + (rows + 1) * padding summary = Image.new(”RGB”, (total_width, total_height), ”#f0f0f0”) for index, card in enumerate(cards): row, col = divmod(index, cols) x = padding + col * (card_width + padding) y = padding + row * (card_height + padding) summary.paste(card, (x, y)) summary_path = OUTPUT_DIR / ”ALL_OTP_CODES.png” summary.save(summary_path) print(f”\n汇总图：{summary_path}”) print(”完成！”)if __name__ == ”__main__”: main()

python3 generate_qr.py