How would one extract a non-exportable private key in Mac OS X 10.12.4?


1 Answer 1


Plenty of tools for this, I'll leave this here: https://github.com/n0fate/chainbreaker but Elcomsoft and other folks sell pretty versions ostensibly for law enforcement purposes.

The non-exportable flag for most keychains is typically a simple UI limitation not an actual security feature. Which means it needs to be stored/extracted into memory at some point. This is one behavior we can take advantage of.

It's a known limitation of most implementations of keychains/certstores etc. This is changing as operating systems begin to take advantage of TPMs for hardware backing of keychains. (For example, you cannot do this on ChromeOS: https://www.chromium.org/developers/design-documents/tpm-usage)

  • Thanks for your answer, slightly off topic, which tool do you recommend to extract the memory image (and format)? Apr 19, 2017 at 16:57
  • github.com/volatilityfoundation/volatility has recently updated with symbols to support 10.12.4 you'll need to get the latest but it should work.
    – Ori
    Apr 19, 2017 at 17:23
  • Thank you, there are several options in this framework. Could you please let me know the commands that I'd need to run to acquire the memory dump for volafox? Apr 19, 2017 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .