MacOS Accessory Dumping Compatibility

[malmeloo]

Depending on your version of MacOS, you may face issues while trying to dump FindMy accessories from your system. This issue aims to discuss and document these issues.

Fully macless accessory dumping can be discussed in #173.

Version	Works (y/n)	Notes
MacOS 10	Unconfirmed	Use the python3 -m findmy decrypt tool
MacOS 11	Unconfirmed	Use the python3 -m findmy decrypt tool
MacOS 12	Unconfirmed	Use the python3 -m findmy decrypt tool
MacOS 13	Unconfirmed	Use the python3 -m findmy decrypt tool
MacOS 14	✅	Use the python3 -m findmy decrypt tool
MacOS 15	Unconfirmed	Use beaconstorekey-extractor with the plist_to_json.py script
MacOS 26	❌	See #176

Please post in this thread what solution works (or does not work) for you, as well as your version of MacOS.

[parawanderer]

This might be a cross-OS-version solution: #173 (comment)

[parawanderer]

Sidenote/bonus: If your CLI dump utility is still basically a derivative implementation of mine then MacOS 11 works but has a different folder structure. See this: parawanderer/OpenTagViewer#24

On my end because I depended on the folder structure I had to fix it (rename the directory "MasterBeacons" to "OwnedBeacons" before I do my zip). On your end it may be different depending on how the CLI utility here works.

I think for my part I'll probably just wait on the OpenBubbles author's CLI (see above) before looking into anything else when it comes to this problem, because that would be a solution to wipe away this OS version issue entirely.

I would say that if we get a CLI from their end it would also be easier to see how it can be integrated into FindMy.py

[victorhooi]

I'm trying to do this on macOS 12.7.4, and it doesn't seem to be working well for me.

I also tried with beaconstore-extractor - you can see my notes on there here.

Anyway, with FindMy.py, I've cloned the repo, done a uv sync, then tried to run it - I hit some initial issue with relative imports:

victorhooi@Victors-Mac-mini FindMy.py % uv run findmy decrypt
Traceback (most recent call last):
  File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/runpy.py", line 197, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/Users/victorhooi/code/FindMy.py/findmy/__main__.py", line 12, in <module>
    from .plist import list_accessories
ImportError: attempted relative import with no known parent package

Not sure if that's because of the way I'm running it?

Anyway, I changed line 11 in main.py to findmy.plist, and ran it again:

victorhooi@Victors-Mac-mini FindMy.py % uv run findmy decrypt
/Users/victorhooi/code/FindMy.py/.venv/lib/python3.9/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020
  warnings.warn(
Traceback (most recent call last):
  File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/runpy.py", line 197, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/Users/victorhooi/code/FindMy.py/findmy/__main__.py", line 106, in <module>
    main()
  File "/Users/victorhooi/code/FindMy.py/findmy/__main__.py", line 80, in main
    decrypt_all(args.out_dir)
  File "/Users/victorhooi/code/FindMy.py/findmy/__main__.py", line 100, in decrypt_all
    accs = list_accessories()
  File "/Users/victorhooi/code/FindMy.py/findmy/plist.py", line 125, in list_accessories
    plist = decrypt_plist(path, key)
  File "/Users/victorhooi/code/FindMy.py/findmy/plist.py", line 100, in decrypt_plist
    cipher = Cipher(algorithms.AES(key), modes.GCM(nonce, tag))
  File "/Users/victorhooi/code/FindMy.py/.venv/lib/python3.9/site-packages/cryptography/hazmat/primitives/ciphers/algorithms.py", line 40, in __init__
    self.key = _verify_key_size(self, key)
  File "/Users/victorhooi/code/FindMy.py/.venv/lib/python3.9/site-packages/cryptography/hazmat/primitives/_cipheralgorithm.py", line 57, in _verify_key_size
    raise ValueError(
ValueError: Invalid key size (0) for AES.

I can confirm that SIP is disabled, I am signed into the iCloud account, and I do have Developer Certificates added (although it's possibly I don't have the right type?).

[victorhooi]

As an aside, I was able to use the MacOS UI Export Wizard from @parawanderer (Thanks!), to export the tags.

Not sure if that information helps, or if there's some way to figure out why that app works, but the decrypt call is failing here?

I then ran uv run plist_to_json.py input.plist output.json to convert them, and it seems to work with FindMy.py - well, I'm currently trying to call airtag.py against that json - it seems to not be getting new reports yet (possibly that "key alignment" issue mentioned in the docs, but I"ll file a separate report if I still get stuck there).

Curious why the findmy decrypt call didn't work.

[parawanderer]

@victorhooi I'd guess it's this: the extraction tool here is derived from an older version of my tool and my tool has since diverged from this one in a few ways, among those is this fallback logic.

I think long-term we should move away from these versioned-OS-bound solutions and towards this one, which would be runnable on any device: parawanderer/OpenTagViewer#30 (comment)

That's kind of what I am waiting for right now, looking to deprecate my tool. All tools + workarounds that people came up with that are OS-bound broke on the latest release of MacOS (again), so this would be the only proper long-term way to do it.

[malmeloo]

Yes indeed, there are a few edge cases in which the included decrypt script doesn't work. I'm hesitant to put effort into fixing it because I'd rather work on getting rid of this hacky solution altogether.

As for that initial ImportError you were facing: if you run it with the -m flag (uv run -m findmy) it should fix the error. The main script needs to be run as a module for the imports to resolve properly.

[VolkerH]

@victorhooi Had the same problem and also managed to export with the UI Export wizard. However, stuck with the .plist files. Did you ever solve this ?

I then ran uv run plist_to_json.py input.plist output.json to convert them, and it seems to work with FindMy.py - well, I'm currently trying to call airtag.py against that json - it seems to not be getting new reports yet (possibly that "key alignment" issue mentioned in the docs, but I"ll file a separate report if I still get stuck there).

[malmeloo]

@victorhooi Had the same problem and also managed to export with the UI Export wizard. However, stuck with the .plist files. Did you ever solve this ?

I then ran uv run plist_to_json.py input.plist output.json to convert them, and it seems to work with FindMy.py - well, I'm currently trying to call airtag.py against that json - it seems to not be getting new reports yet (possibly that "key alignment" issue mentioned in the docs, but I"ll file a separate report if I still get stuck there).

You can use the plist_to_json.py script to convert your plist files. Or does it not find any reports after converting to json?

[smoothscholar]

@malmeloo thanks for your work on this project. Has there been any progress on macos 26? Or will this be a dead end altogether?

[malmeloo]

@smoothscholar check out #173, someone made some huge progress recently :-)

[smoothscholar]

@malmeloo oh wow, that is a great discovery. Looks like it doesn't need macos at all.

Were you able to build it? I'm getting some errors on the dependencies. Maybe same errors that @kammerjaeger saw on that thread?

The EC private key is just a one time pull, right? Would be great to have it integrated into findmy.py, but it's not even necessary if we can just run the tool occasionally as needed and feed the keys in for now.

[malmeloo]

Yes, I was able to compile it, but haven't got it working yet (although i haven't had much time to spend on it either). Other people appear to have had more success. Rust will probably complain when trying to pull some dependencies, but there is an environment variable you can set to make it use the git CLI, which should fix that issue. Other than that you need a few standard build dependencies, but nothing too major.

Yes, you just need to pull the airtag's keys once. After that FindMy.py will be able to 'keep up' with your Apple devices. You should only need to run it when you want to track a new device.

[smoothscholar]

@malmeloo got it to work after a good bit of tinkering. There's also some issues in the code itself that causes multiple airtag plists to be named the same and overwrite each other, but was fixed easily. Let me try to put together what I did, if it helps.