frida_ios_keychain_dump
Dump accessible Keychain items (passwords, credentials) from a target iOS/macOS process by hooking SecItemCopyMatching to retrieve service, account, access group, and data.
Instructions
[iOS/macOS] Dump accessible Keychain items from a target process.
Hooks SecItemCopyMatching and queries for generic and internet passwords accessible to the process. Returns service, account, access group, and data (UTF-8 or hex) for each item.
target: process name or pid (string).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes |