giordanosconti/icloudkitextractorExperimental .NET/WPF forensic toolkit for iCloud auth, CloudKit/MMCS backup download, and Octagon/PCS recovery (ADP, Recovery Key, Lockdown Mode). Research software by Forensis-Lab — highly experimental; Apple private APIs may change overnight.
Public experimental phase — a WPF (.NET 10) app for iCloud sign-in, device backup listing, and download via CloudKit/MMCS.
Research / lab software. Not a finished product: undocumented Apple APIs, account-ban risk, no warranty. Use only with your own Apple ID and at your own risk.
My name is Giordano Sconti. I collaborate with the forensic laboratory Forensis-Lab, and I work as a software researcher as well as a technical consultant (Consulente Tecnico).
This software is released under the MIT license, but it belongs to the Forensis-Lab forensic laboratory.
This project should be considered highly experimental, because Apple’s internal APIs can change overnight.
I am making this project available because it is valuable for forensic work when we must recover—in extreme cases—backups and CloudKit data that are not accessible except through the devices themselves.
Unlike commercial tools I have used, I achieved a stable and complete download of my own personal backups both with ADP enabled and disabled (of course knowing the device Octagon PIN or the Recovery Key when activated).
It also works when protections such as Lockdown Mode are enabled and iCloud.com is turned off.
This project took roughly seven months of research. Without Cursor coding-agent models it would have taken far longer: the only time I had was during work hours when possible, or late at night. I tried to keep a modular code organization—I hope I succeeded.
If you would like to buy me a coffee, I would rather you thank Forensis-Lab or offer some other form of recognition instead.
Anyone who wants to try the software, suggest improvements, or help finish the remaining features is welcome.
You may use paid coding-agent models (please avoid free ones—they are often unreliable for code correctness). What matters is that you always review the generated code and that there is no unauthorized appropriation of third-party code without consent. Pull requests will be reviewed very carefully.
Contact: [email protected]
Every line of code in this project belongs to Forensis-Lab, under my direct grant. Any use or modification must remain attributable to Forensis-Lab.
If you want to try the software before running your own anisette stack, contact me privately to request access to my Anisette Server.
https://giordanosconti.github.io/iCloudKitExtractor/
Recovery Key unlock uses an Octagon endpoint that can dump the full set of encrypted TLKShares. From those shares it is also possible to recover the ones associated with Recovery Key peers (SHA-384 of the public key that signs the Recovery Key). That allows verifying whether a given Recovery Key is among those present and, if it is, recovering the Manatee/PCS KeySet for CloudKit zones—including ADP-protected backups and Keychain.
src/iCloudKitExtractorsrc/PhotosViewer (copied into viewer-payload when IKE builds)AnisetteServer (+ optional bridge projects) for OTP / ADIdocs/dotnet build src/iCloudKitExtractor/iCloudKitExtractor.csproj -c Release
dotnet run --project src/iCloudKitExtractor/iCloudKitExtractor.csproj -c Release
A project site lives under docs/ (index.html + site.css).
main to GitHub.main / folder: /docs.https://giordanosconti.github.io/iCloudKitExtractor/.Preferred path for a coherent iPhone/akd identity: OTP is minted on-device via Frida → AuthKit/akd, then served by AnisetteServer.
pip install frida-tools)python (or set FRIDA_ANISETTE_PYTHON)fetch_anisette.py (Frida attach script). Set its path with FRIDA_ANISETTE_FETCH_PYJailbreak install steps: see Preparing a jailbroken iPhone below (details TBA).
| Variable | Required | Default | Meaning |
|---|---|---|---|
ANISETTE_SERVER_BACKEND | yes | coreadi | Must be frida (aliases: iphone-frida, jb-frida) |
ANISETTE_SERVER_URL / ANISETTE_SERVER_URLS | no | http://127.0.0.1:6969 | URL(s) where AnisetteServer listens |
ANISETTE_SERVER_PORT | no | 6969 | Port if URLs not set |
ICLOUD_AUTH_MODE | recommended | iphone (via config) | Use iphone for full AuthKit iPhone SRP |
FRIDA_ANISETTE_HOST | no | 127.0.0.1:27042 | frida-server host:port (USB often via iproxy 27042 27042) |
FRIDA_ANISETTE_PROCESS | no | akd | Process to attach |
FRIDA_ANISETTE_FETCH_PY | yes* | heuristic path | Absolute path to fetch_anisette.py |
FRIDA_ANISETTE_PYTHON | no | python | Python executable |
FRIDA_ANISETTE_LITE | no | 1 / true | Lite attach mode |
FRIDA_ANISETTE_TIMEOUT | no | 60 | Seconds before aborting a mint |
*Without FRIDA_ANISETTE_FETCH_PY, the app only searches a few legacy sibling paths; set the env var explicitly.
Optional app config file: %AppData%\iCloudKitExtractor\anisette.json (authMode, serverUrl). Env vars override the file.
$env:ANISETTE_SERVER_BACKEND = "frida"
$env:ANISETTE_SERVER_PORT = "6971"
$env:FRIDA_ANISETTE_HOST = "127.0.0.1:27042"
$env:FRIDA_ANISETTE_PROCESS = "akd"
$env:FRIDA_ANISETTE_FETCH_PY = "C:\path\to\fetch_anisette.py"
$env:FRIDA_ANISETTE_PYTHON = "python"
$env:FRIDA_ANISETTE_LITE = "1"
$env:FRIDA_ANISETTE_TIMEOUT = "60"
dotnet run --project src/AnisetteServer/AnisetteServer.csproj -c Release -- --backend frida --port 6971
CLI --backend / --port override the environment.
Smoke test:
curl http://127.0.0.1:6971/health
curl http://127.0.0.1:6971/
Expect JSON with machine data (X-Apple-I-MD-M, X-MMe-Client-Info containing com.apple.akd).
$env:ANISETTE_SERVER_URL = "http://127.0.0.1:6971/"
$env:ICLOUD_AUTH_MODE = "iphone"
dotnet run --project src/iCloudKitExtractor/iCloudKitExtractor.csproj -c Release
Install Frida (frida-server) and OpenSSH from Sileo on the device first.
Assumes a rootless jailbreak (/var/jb/...). Over SSH as root:
ls -l /var/jb/usr/sbin/frida-server
Recreate the LaunchDaemon plist (LF endings, rootless)—no editor needed: