dmg: support AES-encrypted v2 key blobs by kholia · Pull Request #6029 · openwall/john

kholia · 2026-08-13T08:02:44Z

Recent macOS releases can wrap v2 DMG key blobs with AES-192-CBC (CSSM_ALGID_AES) instead of 3DES. Teach both extractors to recognize this parameter set and emit a compact $dmg$3 hash, while rejecting unknown blob encryption combinations.

Add CPU and OpenCL verification by decrypting the final key-blob block and checking the CKIE marker and PKCS#7 padding. Include a known-password test vector and retain existing v1/v2 behavior.

Fixes #6028

Copilot

Pull request overview

Adds support for modern macOS DMG v2 key blobs that are wrapped with AES-192-CBC (CSSM_ALGID_AES) by introducing a new compact $dmg$3 hash representation, updating both C and Python extractors to emit it (and reject unsupported parameter sets), and extending both CPU and OpenCL crackers with a verification step that decrypts the final key-blob block and checks for the CKIE marker plus PKCS#7 padding.

Changes:

Add $dmg$3 parsing and verification to both CPU (dmg_fmt) and OpenCL (opencl_dmg) formats.
Update dmg2john (C and Python) to detect AES-wrapped v2 key blobs, emit $dmg$3, and reject unknown blob-encryption combinations.
Add a known-password $dmg$3 test vector to prevent regressions.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/opencl_dmg_fmt_plug.c	Extends OpenCL DMG format to accept headerver=3 and run a new `dmg_final_v3` kernel; expands stored encrypted keyblob and carries key-bits.
src/dmg2john.c	Detects AES-192-CBC-wrapped v2 blobs, emits `$dmg$3`, and errors out for unsupported blob-encryption parameter sets.
src/dmg_fmt_plug.c	Adds `$dmg$3` parsing and CPU-side verification by decrypting the last keyblob block and checking `CKIE` + PKCS#7 padding.
src/dmg_common_plug.c	Adds a `$dmg$3` test vector using the known password `d3fc0n`.
run/opencl/dmg_kernel.cl	Adds OpenCL `check_v3hash()` and a new `dmg_final_v3` kernel implementing the same last-block verification logic.
run/dmg2john.py	Updates v2 header unpacking, detects AES-wrapped blobs, emits `$dmg$3`, and rejects unsupported blob-encryption parameter sets.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

kholia · 2026-09-30T05:27:58Z

The CI jobs are running into following 'prompt stalls':

kholia · 2026-09-30T05:37:32Z

Patch to fix the apt prompt stalls problem:

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 05d9ca0ba..0a1c7bba5 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -97,16 +97,16 @@ jobs:
   arm:
     machine:
       image: ubuntu-2204:current
-      environment:
-        DEBIAN_FRONTEND: "noninteractive"
     resource_class: arm.medium
+    environment:
+      DEBIAN_FRONTEND: "noninteractive"
     steps:
       - checkout
       - run:
           name: Preparing
           command: |
             uname -a
-            sudo apt update && sudo apt install -y zlib1g-dev libgmp-dev libpcap-dev libbz2-dev
+            sudo DEBIAN_FRONTEND=noninteractive apt update && sudo DEBIAN_FRONTEND=noninteractive apt install -y zlib1g-dev libgmp-dev libpcap-dev libbz2-dev

This change has been added to this PR to let the CI testing pass.

solardiz

I think we can merge this early - we need to get working CI for merging other PRs. My review feedback may be addressed separately. But it'd be good to move the added test vector to the end before we merge.

kholia · 2026-09-30T09:15:12Z

@solardiz I will open a new small PR to fix the CI pipeline(s) now and then we can work on this bigger PR later.

Copilot

🟡 Changes recommended

Both extractors can emit zero-iteration hashes that the shared validator refuses to load.

2 open findings

3 resolved since last review

check_v3hash() also relies on the literal value 9 from check_pkcs_pad(...), which is a non-obvious…
The v3 verifier compares check_pkcs_pad(...) to the literal value 9, but the meaning of 9 isn’t…
The new test vector is labeled as a “Version 2 header”, but it’s exercising the new $dmg$3 hash…

🧠 Review effort: Balanced

Recent macOS releases can wrap v2 DMG key blobs with AES-192-CBC (CSSM_ALGID_AES) instead of 3DES. Teach both extractors to recognize this parameter set and emit a compact $dmg$3 hash, while rejecting unknown blob encryption combinations. Add CPU and OpenCL verification by decrypting the final key-blob block and checking the CKIE marker and PKCS#7 padding. Include a known-password test vector and retain existing v1/v2 behavior.

Modern macOS wraps the v2 disk-image key blob with AES-192-CBC (CSSM_ALGID_AES) instead of 3DES, which no existing hashcat mode handles (issue hashcat#3774). Verification derives a 24-byte KEK via PBKDF2-HMAC-SHA1, CBC-decrypts the final key-blob block and checks for the "CKIE" marker followed by PKCS#7 padding. aes192_decrypt returns little-endian output words here, so the marker and padding are matched in that byte order only. The identity digest is MD5 of the whole key blob, computed identically by the decoder and reported by the comp kernel, so distinct blobs that share a salt and a leading ciphertext block are not aliased in dedup/potfile. - src/modules/module_38300.c: parse $dmg$3; validate declared salt length, AES-192 key bits and blob length; fixed 20-byte salt bounds; reuse the PBKDF2-HMAC-SHA1 init/loop from mode 24410; 64-byte esalt key blob. - OpenCL/m38300-pure.cl: AES-192 key-blob unwrap + CKIE/PKCS#7 check in comp. - tools/test_modules/m38300.py: edge coverage; the oracle re-derives the KEK and only reuses a blob that matches the candidate. Hashes are produced by dmg2john from John the Ripper PR #6029 (openwall/john#6029).

Modern macOS wraps the v2 disk-image key blob with AES-192-CBC (CSSM_ALGID_AES) instead of 3DES, which no existing hashcat mode handles (issue #3774). Verification derives a 24-byte KEK via PBKDF2-HMAC-SHA1, CBC-decrypts the final key-blob block and checks for the "CKIE" marker followed by PKCS#7 padding. aes192_decrypt returns little-endian output words here, so the marker and padding are matched in that byte order only. The identity digest is MD5 of the whole key blob, computed identically by the decoder and reported by the comp kernel, so distinct blobs that share a salt and a leading ciphertext block are not aliased in dedup/potfile. - src/modules/module_38300.c: parse $dmg$3; validate declared salt length, AES-192 key bits and blob length; fixed 20-byte salt bounds; reuse the PBKDF2-HMAC-SHA1 init/loop from mode 24410; 64-byte esalt key blob. - OpenCL/m38300-pure.cl: AES-192 key-blob unwrap + CKIE/PKCS#7 check in comp. - tools/test_modules/m38300.py: edge coverage; the oracle re-derives the KEK and only reuses a blob that matches the candidate. Hashes are produced by dmg2john from John the Ripper PR #6029 (openwall/john#6029).

kholia self-assigned this Aug 13, 2026

kholia mentioned this pull request Aug 13, 2026

dmg2john extracts uncrackable hashes from current DMG files #6028

Open

kholia assigned magnumripper and unassigned magnumripper Aug 13, 2026

kholia requested review from magnumripper and a lite review from Copilot August 13, 2026 08:05

Copilot started reviewing on behalf of kholia August 13, 2026 08:06

View session

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Comment thread src/dmg_common_plug.c Outdated

Comment thread src/dmg_fmt_plug.c

Comment thread run/opencl/dmg_kernel.cl

openwall temporarily blocked GraceWaddell Sep 21, 2026

openwall deleted a comment from GraceWaddell Sep 21, 2026

kholia requested a review from solardiz September 26, 2026 11:40

kholia force-pushed the better-dmg-support branch 2 times, most recently from 463222b to 9b25e02 Compare September 30, 2026 05:35

solardiz approved these changes Sep 30, 2026

View reviewed changes

Comment thread src/dmg_common_plug.c Outdated

Comment thread src/dmg_fmt_plug.c Outdated

kholia mentioned this pull request Sep 30, 2026

CI: fix DEBIAN_FRONTEND for arm apt-install step #6044

Merged

kholia force-pushed the better-dmg-support branch from 9b25e02 to cdb68a1 Compare September 30, 2026 10:04

kholia requested a balanced review from Copilot October 10, 2026 09:14

Copilot started reviewing on behalf of kholia October 10, 2026 09:15

View session

Copilot AI reviewed Oct 10, 2026

View reviewed changes

Comment thread run/dmg2john.py Outdated

Comment thread src/dmg2john.c

kholia force-pushed the better-dmg-support branch from cdb68a1 to 542d7d9 Compare October 10, 2026 09:19

kholia force-pushed the better-dmg-support branch from 542d7d9 to b0cf3b7 Compare October 10, 2026 09:22

skippdot mentioned this pull request Oct 11, 2026

Add Apple DMG (encrcdsa v2, AES-192 key blob) hash-mode 38300 (#3774) hashcat/hashcat#4963

Merged

Navigation Menu

Repository navigation

dmg: support AES-encrypted v2 key blobs - #6029

dmg: support AES-encrypted v2 key blobs#6029
kholia wants to merge 1 commit into
openwall:bleeding-jumbofrom
kholia:better-dmg-support

kholia commented Aug 13, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kholia commented Sep 30, 2026

Uh oh!

kholia commented Sep 30, 2026

Uh oh!

solardiz left a comment

Uh oh!

Uh oh!

Uh oh!

kholia commented Sep 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

kholia commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kholia commented Sep 30, 2026

Uh oh!

kholia commented Sep 30, 2026

Uh oh!

solardiz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kholia commented Sep 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kholia commented Aug 13, 2026 •

edited

Loading