Extract a John the Ripper hash from an encrypted Apple disk image (.dmg) with dmg2john. For authorized password recovery only.
dmg2john reads a password-protected Apple disk image and produces a hash for offline recovery. macOS encrypted DMGs come in two generations: the older format and the newer v2 format, both deriving keys with PBKDF2 and protecting the volume key with AES. The tool extracts the key-derivation parameters and wrapped-key data needed to test passwords. It does not mount or decrypt the image.
Input:
encrypted.dmg
Output:
encrypted.dmg:$dmg$<version>*<salt>*<iter>*<...>
Which DMG formats are supported?
Both the legacy encrypted DMG and the newer version 2 format used by modern macOS, distinguished by their headers.
Does dmg2john decrypt the image?
No. It only extracts a hash; a cracker then tests password guesses against it.
Which hashcat mode matches?
Apple DMG images use hashcat modes 6221-6223 depending on parameters.
This tool extracts password hashes from Apple DMG files, assisting in password recovery and security testing.
Supported Tools: