MacOS Accessory Dumping Compatibility

[malmeloo]

Depending on your version of MacOS, you may face issues while trying to dump FindMy accessories from your system. This issue aims to discuss and document these issues.

Fully macless accessory dumping can be discussed in #173.

Version	Works (y/n)	Notes
MacOS 10	Unconfirmed	Use the python3 -m findmy decrypt tool
MacOS 11	Unconfirmed	Use the python3 -m findmy decrypt tool
MacOS 12	Unconfirmed	Use the python3 -m findmy decrypt tool
MacOS 13	Unconfirmed	Use the python3 -m findmy decrypt tool
MacOS 14	✅	Use the python3 -m findmy decrypt tool
MacOS 15	Unconfirmed	Use beaconstorekey-extractor with the plist_to_json.py script
MacOS 26	❌	See #176

Please post in this thread what solution works (or does not work) for you, as well as your version of MacOS.

[parawanderer]

This might be a cross-OS-version solution: #173 (comment)

[parawanderer]

Sidenote/bonus: If your CLI dump utility is still basically a derivative implementation of mine then MacOS 11 works but has a different folder structure. See this: parawanderer/OpenTagViewer#24

On my end because I depended on the folder structure I had to fix it (rename the directory "MasterBeacons" to "OwnedBeacons" before I do my zip). On your end it may be different depending on how the CLI utility here works.

I think for my part I'll probably just wait on the OpenBubbles author's CLI (see above) before looking into anything else when it comes to this problem, because that would be a solution to wipe away this OS version issue entirely.

I would say that if we get a CLI from their end it would also be easier to see how it can be integrated into FindMy.py

[victorhooi]

I'm trying to do this on macOS 12.7.4, and it doesn't seem to be working well for me.

I also tried with beaconstore-extractor - you can see my notes on there here.

Anyway, with FindMy.py, I've cloned the repo, done a uv sync, then tried to run it - I hit some initial issue with relative imports:

victorhooi@Victors-Mac-mini FindMy.py % uv run findmy decrypt
Traceback (most recent call last):
  File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/runpy.py", line 197, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/Users/victorhooi/code/FindMy.py/findmy/__main__.py", line 12, in <module>
    from .plist import list_accessories
ImportError: attempted relative import with no known parent package

Not sure if that's because of the way I'm running it?

Anyway, I changed line 11 in main.py to findmy.plist, and ran it again:

victorhooi@Victors-Mac-mini FindMy.py % uv run findmy decrypt
/Users/victorhooi/code/FindMy.py/.venv/lib/python3.9/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020
  warnings.warn(
Traceback (most recent call last):
  File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/runpy.py", line 197, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/Users/victorhooi/code/FindMy.py/findmy/__main__.py", line 106, in <module>
    main()
  File "/Users/victorhooi/code/FindMy.py/findmy/__main__.py", line 80, in main
    decrypt_all(args.out_dir)
  File "/Users/victorhooi/code/FindMy.py/findmy/__main__.py", line 100, in decrypt_all
    accs = list_accessories()
  File "/Users/victorhooi/code/FindMy.py/findmy/plist.py", line 125, in list_accessories
    plist = decrypt_plist(path, key)
  File "/Users/victorhooi/code/FindMy.py/findmy/plist.py", line 100, in decrypt_plist
    cipher = Cipher(algorithms.AES(key), modes.GCM(nonce, tag))
  File "/Users/victorhooi/code/FindMy.py/.venv/lib/python3.9/site-packages/cryptography/hazmat/primitives/ciphers/algorithms.py", line 40, in __init__
    self.key = _verify_key_size(self, key)
  File "/Users/victorhooi/code/FindMy.py/.venv/lib/python3.9/site-packages/cryptography/hazmat/primitives/_cipheralgorithm.py", line 57, in _verify_key_size
    raise ValueError(
ValueError: Invalid key size (0) for AES.

I can confirm that SIP is disabled, I am signed into the iCloud account, and I do have Developer Certificates added (although it's possibly I don't have the right type?).

[victorhooi]

As an aside, I was able to use the MacOS UI Export Wizard from @parawanderer (Thanks!), to export the tags.

Not sure if that information helps, or if there's some way to figure out why that app works, but the decrypt call is failing here?

I then ran uv run plist_to_json.py input.plist output.json to convert them, and it seems to work with FindMy.py - well, I'm currently trying to call airtag.py against that json - it seems to not be getting new reports yet (possibly that "key alignment" issue mentioned in the docs, but I"ll file a separate report if I still get stuck there).

Curious why the findmy decrypt call didn't work.

[parawanderer]

@victorhooi I'd guess it's this: the extraction tool here is derived from an older version of my tool and my tool has since diverged from this one in a few ways, among those is this fallback logic.

I think long-term we should move away from these versioned-OS-bound solutions and towards this one, which would be runnable on any device: parawanderer/OpenTagViewer#30 (comment)

That's kind of what I am waiting for right now, looking to deprecate my tool. All tools + workarounds that people came up with that are OS-bound broke on the latest release of MacOS (again), so this would be the only proper long-term way to do it.

[malmeloo]

Yes indeed, there are a few edge cases in which the included decrypt script doesn't work. I'm hesitant to put effort into fixing it because I'd rather work on getting rid of this hacky solution altogether.

As for that initial ImportError you were facing: if you run it with the -m flag (uv run -m findmy) it should fix the error. The main script needs to be run as a module for the imports to resolve properly.

[VolkerH]

@victorhooi Had the same problem and also managed to export with the UI Export wizard. However, stuck with the .plist files. Did you ever solve this ?

I then ran uv run plist_to_json.py input.plist output.json to convert them, and it seems to work with FindMy.py - well, I'm currently trying to call airtag.py against that json - it seems to not be getting new reports yet (possibly that "key alignment" issue mentioned in the docs, but I"ll file a separate report if I still get stuck there).

[malmeloo]

@victorhooi Had the same problem and also managed to export with the UI Export wizard. However, stuck with the .plist files. Did you ever solve this ?

I then ran uv run plist_to_json.py input.plist output.json to convert them, and it seems to work with FindMy.py - well, I'm currently trying to call airtag.py against that json - it seems to not be getting new reports yet (possibly that "key alignment" issue mentioned in the docs, but I"ll file a separate report if I still get stuck there).

You can use the plist_to_json.py script to convert your plist files. Or does it not find any reports after converting to json?