I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to decrypt this traffic, but I've spent hours trying to find it with no luck. I'm on OSX Mavericks, latest iTunes build. I'd be very grateful if someone could help out.

1 Answer 1


Cracking that tunnel is a non-trivial exercise. The short answer is that key store is located in the file /private/var/keybags/systembag.kb and retrieved with the kernel service called AppleEffaceableStorage under the locker tag \BAG1. This is the architecture:

iPhone data protection architecture

The keys themselves are further encrypted and checksummed using AES and HMAC. It would be a big project for you to decrypt the stream. You would be much better off finding the memory buffer where the kernel process is storing the decrypted stream and just monitoring the buffer. I think the critical process is called keybagd (keybag daemon). There is also a kernel extension called AppleKeyStore which has a subcomponent called MobileKeyBag. One or all of those processes will own a buffer containing the clear text traffic.

  • thank you, i was under the impression that it was as simple as described here support.citrix.com/article/CTX116557
    – asd
    Commented Aug 14, 2014 at 3:16
  • 1
    Its that simple if you have the key. The problem is getting the key out of the Mac key bag. At some point the AppleKeyStore computes the key, so if you could find the computed key in memory, that might work, but it might be hard to find that memory location. So are you going to upvote my answer or what? Commented Aug 14, 2014 at 3:28
  • @TylerDurden Both systembag.kb and AppleEffaceableStorage have nothing to do with SSL. Client-side SSL private keys and certificates are stored in Keychain, and relevant process, if you decide to dump memory, is securityd. Furthermore, "cracking" SSL tunnel on iOS can be as simple as installing additional root certificate. Or it might be not – depending on whether the app is doing certificate pinning. Also, I am under impression that OP asked about iTunes, not iOS.
    – Andrey
    Commented Aug 14, 2014 at 9:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .