前提條件：ios設(shè)備越獄，已安裝ssh工具
1.Mac終端命令連接到設(shè)備上 ssh root@192.168.1.100（你的設(shè)備ip）

 mac-mini:~ ice$ ssh root@192.168.50.125
 root@192.168.50.125's password: 
 Icede-4s:~ root#

2.賦予Keychain數(shù)據(jù)庫可讀權(quán)限

 Icede-4s:~ root# cd /private/var/Keychains/
Icede-4s:/private/var/Keychains root# ls
TrustStore.sqlite3             keychain-2.db      ocspcache.sqlite3-shm
accountStatus.plist            keychain-2.db-shm  ocspcache.sqlite3-wal
  caissuercache.sqlite3          keychain-2.db-wal
  caissuercache.sqlite3-journal  ocspcache.sqlite3
 Icede-4s:/private/var/Keychains root# chmod +r keychain-2.db

3.下載 Keychain-Dumper
4.上傳keychain_dumper可執(zhí)行文件到ios設(shè)備 /bin 目錄下
（1）Ctrl+D 退出iOS設(shè)備 SSH連接
（2）上傳keychain_dumper可執(zhí)行文件

 mac-mini:~ ice$ scp /Users/ice/Downloads/Keychain-Dumper-master/keychain_dumper root@192.168.50.125:/bin
   root@192.168.50.125's password: 
    keychain_dumper        100%  207KB 206.6KB/s   00:00

5.查看keychain_dumper是否有可執(zhí)行權(quán)限到iOS設(shè)備的/bin目錄下

Icede-4s:~ root# ls -l /bin/keychain_dumper
 -rwxr-xr-x 1 root wheel 211584 Aug 18 10:12 /bin/keychain_dumper

6.沒有則為其添加執(zhí)行權(quán)限

  Icede-4s:~ root# chmod +x /bin/keychain_dumper

7.解密keychain信息

   Icede-4s:~ root# /bin/keychain_dumper

8.將keychain生成文件

  iPhone:~ root# cd /private/var/Keychains
  iPhone:/private/var/Keychains root# /bin/keychain_dumper > keychain-export.txt
  iPhone:/private/var/Keychains root# 

如圖所示：

WechatIMG95.jpeg

9、導(dǎo)出txt文件，并查看

    scp root@192.168.2.39:/private/var/Keychains/keychain-export.txt /Users/young/Desktop/qwe 

屏幕快照 2017-08-18 上午10.48.29.png

轉(zhuǎn)自：http://www.itdecent.cn/p/33a3a5cb0a67