Failed fetch key bag about inflatabledonkey

[asifmehmoood]

Thank you!
i have tested and it looks fine now.

Thanks 👍

[horrorho]

Hi. For some reason we can't retrieve the key bag. Either it's not there or we have a coding error. Are you able to restore the backup to a phone at all? Or have you had success with any other iCloud backup recovery tools?

I've tried it with iSkysoft and the files downloaded but there was issues with Data Protection encryption.

[horrorho]

Ok, other software has the same issue so there could be a problem with the backup itself. Without the key bag you cannot decrypt files with Data Protection. I've largely stopped working on this project at present but I will keep a note of this.

[horrorho]

Closing ticket. I've not been able to reproduce the issue.

As stated earlier if other software is also having problems then it's probably an issue with the backup itself.

[asifmehmoood]

Thanks for you quick reply,
i am able to get iCloud backup by an another iCloud recovery tool.

the one more thing is backupProperties is empty that contains plists with some information i.e

SnapshotFactory - -- from() - snapshot: Snapshot{snapshotID=S:23DFE195-E332-481F-B0F6-D70777B0BF48, backupProperties=Optional.empty}

still i can see list of devices with available backups but when i select any backup it throws exception i.e

keyBagClient() - IOException: com.github.horrorho.inflatabledonkey.exception.BadDataException KeyBagFactory, no key bag data
KeyBagManager - --fetchKeyBag() - failed to fetch key bag: K:GvF08s0vSf6gdo+DcTB8vA==
file.FileAssembler - -- write() - written: backups\[email protected]\9782DCFEE6B308AC9A183CA73495D1FCF0F18A4E\20160714\HomeDomain\Library\Preferences\com.apple.mobilenotes.plist status: true

HomeDomain Library/Preferences/com.apple.mobilenotes.plist
file.KeyBlobCurve25519Unwrap - -- doUnwrap() - no public key for protection class: 3
file.FileAssembler - -- decrypt() - failed to unwrap encryption key

[horrorho]

Thank you for the update. I've looked through the relevant code again and it's unclear to me what the issue might be. It's possible that there are alternate key bag protocol/s that I'm unaware of. As of yet I've been unable to replicate this error.

Could you give me the name of the backup solution that you used and also double check that it recovers the offending files in question without corruption, i.e. HomeDomain Library/Preferences/com.apple.mobilenotes.plist. There are some tools that do not report all errors and silently drop files.

Also if you could kindly navigate to:
InflatableDonkey-master/src/main/java/com/github/horrorho/inflatabledonkey/cloud/clients/KeyBagClient.java
Change line 62 from

logger.debug("-- keyBag() - responses: {}", responses);

to

logger.error("-- keyBag() - responses: {}", responses);

Re-compile and run. This will print out as an error the raw server response to our key bag requests. If you could let me know what these look like, a representative sample of one or two should be fine.

Once the above step is complete, we can also look at the raw server snapshot response. For this please follow the instructions here. This mod will dump out the server response and then halt the program. The field "currentKeybagUUID" would be of particular importance.

[asifmehmoood]

Hi,
i can get files without corruption using another iCloud recovery tool. its not crupted.

here is output from KeyBagClient.java i.e

c.g.h.i.cloud.clients.KeyBagClient - -- keyBag() - responses: [record {
etag: "5"
RecordIdentifier {
value {
name: "K:XXXXXXXXXXXXXXXXXX+DcTB8vA=="
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXXXXXX"
type: 7
}
}
}
type {
name: "Keybag"
}
createdBy {
name: "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
type: 7
}
timeStatistics {
creation {
time: 4.80301716061E8
}
modification {
time: 4.80301716061E8
}
}
recordField {
identifier {
name: "keybagData"
}
value {
type: 20
bytesValue: "\003j\343\000\250\026\350\f\302x# many more..."
}
}
recordField {
identifier {
name: "secret"
}
value {
type: 20
bytesValue: "\003j\343\000\333\322\313$\236\313\355b\256\026\373............"
}
}
modifiedBy {
name: "_3ee043b73c91d295fb7191870433ef2b"
type: 7
}
modifiedByDevice: "XXXXXXX's iPad"
protectionInfo {
protectionInfo: "a\202\001\2120\202\001\2060\201\203\002\001\0001~0|0%\002\001\000\004 mnany more ....."
protectionInfoTag: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}
permission: 2
}
clientVersionETagMatch: false
]

and here is output from DeviceClient.java

c.g.horrorho.inflatabledonkey.Main - -- main() - decrypt mode override: AUTO
c.g.h.i.cloud.clients.DeviceClient - -- devices() - responses: [record {
etag: "1e7"
RecordIdentifier {
value {
name: "D:XXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXX"
type: 7
}
}
}
type {
name: "Device"
}
createdBy {
name: "XXXXXXXX"
type: 7
}
timeStatistics {
creation {
time: 4.80302054149E8
}
modification {
time: 4.88177477673E8
}
}
recordField {
identifier {
name: "keybags"
}
value {
type: 13
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "K:XXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXX"
type: 7
}
}
}
}
}
}
}
recordField {
identifier {
name: "pinnedSnapshots"
}
value {
type: 16
}
}
recordField {
identifier {
name: "serialNumber"
}
value {
type: 3
stringValue: "DLXR42LQGHK9"
}
}
recordField {
identifier {
name: "snapshotCommittedDates"
}
value {
type: 10
recordFieldValue {
type: 2
dateValue {
time: 4.87909499734E8
}
}
recordFieldValue {
type: 2
dateValue {
time: 4.88056250646E8
}
}
recordFieldValue {
type: 2
dateValue {
time: 4.88177472586E8
}
}
}
}
recordField {
identifier {
name: "hardwareModel"
}
value {
type: 3
stringValue: "J96AP"
}
}
recordField {
identifier {
name: "deviceName"
}
value {
type: 3
stringValue: "XXXX's iPad"
}
}
recordField {
identifier {
name: "lastGMSnapshot"
}
value {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXX"
type: 7
}
}
}
}
}
}
recordField {
identifier {
name: "marketingName"
}
value {
type: 3
stringValue: "iPad mini 4"
}
}
recordField {
identifier {
name: "snapshots"
}
value {
type: 13
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXX"
type: 7
}
}
}
}
}
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXX"
type: 7
}
}
}
}
}
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXX"
type: 7
}
}
}
}
}
}
}
recordField {
identifier {
name: "deviceColor"
}
value {
type: 3
stringValue: "#3b3b3c"
}
}
recordField {
identifier {
name: "requiresFullBackup"
}
value {
type: 7
signedValue: 0
}
}
recordField {
identifier {
name: "currentKeybagUUID"
}
value {
type: 3
stringValue: "XXXXXX"
}
}
recordField {
identifier {
name: "deviceClass"
}
value {
type: 3
stringValue: "iPad"
}
}
recordField {
identifier {
name: "deviceEnclosureColor"
}
value {
type: 3
stringValue: "#b4b5b9"
}
}
recordField {
identifier {
name: "productType"
}
value {
type: 3
stringValue: "iPad5,1"
}
}
modifiedBy {
name: "XXX"
type: 7
}
modifiedByDevice: "System"
permission: 2
}
clientVersionETagMatch: false
, record {
etag: "20a"
RecordIdentifier {
value {
name: "D:XXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXX"
type: 7
}
}
}
type {
name: "Device"
}
createdBy {
name: "XXXX"
type: 7
}
timeStatistics {
creation {
time: 4.99759801734E8
}
modification {
time: 5.0017538016E8
}
}
recordField {
identifier {
name: "keybags"
}
value {
type: 13
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "K:XXXXXXXXXXX=="
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXX"
type: 7
}
}
}
}
}
}
}
recordField {
identifier {
name: "pinnedSnapshots"
}
value {
type: 16
}
}
recordField {
identifier {
name: "serialNumber"
}
value {
type: 3
stringValue: "x"
}
}
recordField {
identifier {
name: "snapshotCommittedDates"
}
value {
type: 10
recordFieldValue {
type: 2
dateValue {
time: 4.99989274292E8
}
}
recordFieldValue {
type: 2
dateValue {
time: 5.00082405292E8
}
}
recordFieldValue {
type: 2
dateValue {
time: 5.00175378399E8
}
}
}
}
recordField {
identifier {
name: "hardwareModel"
}
value {
type: 3
stringValue: "N66mAP"
}
}
recordField {
identifier {
name: "deviceName"
}
value {
type: 3
stringValue: "iPhone"
}
}
recordField {
identifier {
name: "lastGMSnapshot"
}
value {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXX"
type: 7
}
}
}
}
}
}
recordField {
identifier {
name: "marketingName"
}
value {
type: 3
stringValue: "iPhone 6s Plus"
}
}
recordField {
identifier {
name: "snapshots"
}
value {
type: 13
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXX"
type: 7
}
}
}
}
}
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
}
}
recordField {
identifier {
name: "deviceColor"
}
value {
type: 3
stringValue: "#272728"
}
}
recordField {
identifier {
name: "currentKeybagUUID"
}
value {
type: 3
stringValue: "XXXXXXXXXXX=="
}
}
recordField {
identifier {
name: "deviceClass"
}
value {
type: 3
stringValue: "iPhone"
}
}
recordField {
identifier {
name: "deviceEnclosureColor"
}
value {
type: 3
stringValue: "#b9b7ba"
}
}
recordField {
identifier {
name: "productType"
}
value {
type: 3
stringValue: "iPhone8,2"
}
}
modifiedBy {
name: "XXXXXXXXXXXXXXXX"
type: 7
}
modifiedByDevice: "System"
permission: 2
}
clientVersionETagMatch: false
, record {
etag: "1xs"
RecordIdentifier {
value {
name: "D:XXXXXXXXXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXX"
type: 7
}
}
}
type {
name: "Device"
}
createdBy {
name: "XXXXXXXXXXXXXXXXX"
type: 7
}
timeStatistics {
creation {
time: 4.87905072532E8
}
modification {
time: 4.97449212931E8
}
}
recordField {
identifier {
name: "keybags"
}
value {
type: 13
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "K:AG+XXXXXXXXXXXXXXXXXX++vQ=="
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
}
}
recordField {
identifier {
name: "pinnedSnapshots"
}
value {
type: 16
}
}
recordField {
identifier {
name: "serialNumber"
}
value {
type: 3
stringValue: "x"
}
}
recordField {
identifier {
name: "snapshotCommittedDates"
}
value {
type: 10
recordFieldValue {
type: 2
dateValue {
time: 4.90542003644E8
}
}
recordFieldValue {
type: 2
dateValue {
time: 4.90628588152E8
}
}
recordFieldValue {
type: 2
dateValue {
time: 4.90762543244E8
}
}
}
}
recordField {
identifier {
name: "hardwareModel"
}
value {
type: 3
stringValue: "N61AP"
}
}
recordField {
identifier {
name: "deviceName"
}
value {
type: 3
stringValue: "iPhone"
}
}
recordField {
identifier {
name: "lastGMSnapshot"
}
value {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXX"
type: 7
}
}
}
}
}
}
recordField {
identifier {
name: "marketingName"
}
value {
type: 3
stringValue: "iPhone 6"
}
}
recordField {
identifier {
name: "snapshots"
}
value {
type: 13
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXXXXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
}
}
recordField {
identifier {
name: "deviceColor"
}
value {
type: 3
stringValue: "#3b3b3c"
}
}
recordField {
identifier {
name: "requiresFullBackup"
}
value {
type: 7
signedValue: 0
}
}
recordField {
identifier {
name: "currentKeybagUUID"
}
value {
type: 3
stringValue: "AG+XXXXXXXXXXXXXXXXXXXX++vQ=="
}
}
recordField {
identifier {
name: "deviceClass"
}
value {
type: 3
stringValue: "iPhone"
}
}
recordField {
identifier {
name: "deviceEnclosureColor"
}
value {
type: 3
stringValue: "#b4b5b9"
}
}
recordField {
identifier {
name: "productType"
}
value {
type: 3
stringValue: "iPhone7,2"
}
}
modifiedBy {
name: "XXXXXXXXXXXXXXXXXXXXX"
type: 7
}
modifiedByDevice: "iPhone"
permission: 2
}
clientVersionETagMatch: false
, record {
etag: "1xp"
RecordIdentifier {
value {
name: "D:XXXXXXXXXXXXXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
type: 7
}
}
}
type {
name: "Device"
}
createdBy {
name: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
type: 7
}
timeStatistics {
creation {
time: 4.8030171634E8
}
modification {
time: 4.93368605903E8
}
}
recordField {
identifier {
name: "keybags"
}
value {
type: 13
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "K:XXXXXXXXXXXXXXXXXXXXXX+DcTB8vA=="
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
}
}
recordField {
identifier {
name: "pendingSnapshotBackupType"
}
value {
type: 7
signedValue: 0
}
}
recordField {
identifier {
name: "pinnedSnapshots"
}
value {
type: 16
}
}
recordField {
identifier {
name: "serialNumber"
}
value {
type: 3
stringValue: "x"
}
}
recordField {
identifier {
name: "snapshotCommittedDates"
}
value {
type: 10
recordFieldValue {
type: 2
dateValue {
time: 4.86007519943E8
}
}
recordFieldValue {
type: 2
dateValue {
time: 4.86189134265E8
}
}
recordFieldValue {
type: 2
dateValue {
time: 4.86356627474E8
}
}
}
}
recordField {
identifier {
name: "hardwareModel"
}
value {
type: 3
stringValue: "J98aAP"
}
}
recordField {
identifier {
name: "pendingSnapshotQuotaReserved"
}
value {
type: 7
signedValue: 0
}
}
recordField {
identifier {
name: "deviceName"
}
value {
type: 3
stringValue: "XXXXXXXXXXXXXXX's iPad"
}
}
recordField {
identifier {
name: "lastGMSnapshot"
}
value {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "x"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "_3ee043b73c91d295fb7191870433ef2b"
type: 7
}
}
}
}
}
}
recordField {
identifier {
name: "marketingName"
}
value {
type: 3
stringValue: "iPad Pro"
}
}
recordField {
identifier {
name: "snapshots"
}
value {
type: 13
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
recordFieldValue {
type: 5
referenceValue {
type: 2
recordIdentifier {
value {
name: "S:XXXXXXXXXXXXXXXXXXXXX"
type: 1
}
zoneIdentifier {
value {
name: "mbksync"
type: 6
}
ownerIdentifier {
name: "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
type: 7
}
}
}
}
}
}
}
recordField {
identifier {
name: "deviceColor"
}
value {
type: 3
stringValue: "#e1e4e3"
}
}
recordField {
identifier {
name: "requiresFullBackup"
}
value {
type: 7
signedValue: 0
}
}
recordField {
identifier {
name: "currentKeybagUUID"
}
value {
type: 3
stringValue: "XXXXXXXXXXXXXXXXXXXXXXXX+DcTB8vA=="
}
}
recordField {
identifier {
name: "deviceClass"
}
value {
type: 3
stringValue: "iPad"
}
}
recordField {
identifier {
name: "pendingSnapshotID"
}
value {
type: 3
stringValue: "S:XXXXXXXXXXXXXXXXXXXXXXXXX"
}
}
recordField {
identifier {
name: "deviceEnclosureColor"
}
value {
type: 3
stringValue: "#e1ccb5"
}
}
recordField {
identifier {
name: "productType"
}
value {
type: 3
stringValue: "iPad6,7"
}
}
modifiedBy {
name: "XXXXXXXXXXXXXX"
type: 7
}
modifiedByDevice: "XXXXXXXXXXXXXXXX's iPad"
permission: 2
}
clientVersionETagMatch: false
]

Thanks,

[horrorho]

Thank you! It appears the key bag information is there but we are unable to decrypt it.

recordField {
  identifier {
    name: "keybagData"
    }
  value {
    type: 20
    bytesValue: "\003j\343\000\250\026\350\f\302x# many more..."
    }
  }
  recordField {
    identifier {
    name: "secret"
    }
  value {
    type: 20
    bytesValue: "\003j\343\000\333\322\313$\236\313\355b\256\026\373............"
    }
  }
}

The decryption process is somewhat convoluted and I need additional logging statements to see what is going wrong.

If you would kindly take a fresh copy of InflatableDonkey and replace the following files with their gist counterparts:

InflatableDonkey-master/src/main/java/com/github/horrorho/inflatabledonkey/pcs/zone/PZAssistantLight
https://gist.github.com/horrorho/e54039382bc8cc7c6eadcaafad4ece72

InflatableDonkey-master/src/main/java/com/github/horrorho/inflatabledonkey/data/backup/KeyBagFactory
https://gist.github.com/horrorho/c569381b6b323599d3ac06403c3bb5f9

Recompile and run. I need to see these error statements including the raw data values. Even though in isolation they don't mean much, it would be prudent to email the results to me at [email protected] rather than posting them here. As an additional security measure you can change your iCloud password after generating these.

[asifmehmoood]

Thank you!
Email has sent

[Louti]

I think it's linked to my issue

[horrorho]

Ok! I believe I have found the problem. In short, InflatableDonkey only allows one key per service and drops superfluous keys. This behaviour is problematic as some backups have multiple keys per service, particularly when multiple devices are present.

I'll need to fix and test the offending code which may take a few days.

@asifmehmoood Thank you for the assistance!

@Louti Although possibly related, I suspect it doesn't fully explain issue #41.

[asifmehmoood]

Welcome! and Thanks to get some time form you busy schedule :)
we will wait for the fix.
Thanks again!

[horrorho]

Ok! I've pushed a new build. I've been playing around with it for a couple of days and it's seems to have solved the issue.

[horrorho]

@asifmehmoood Wonderful! Again thank you for your assistance. I'll go ahead and close this ticket.