Ruby script for brute-forcing Apple encrypted volumes

unlock.rb

#!/usr/bin/env ruby
require 'pry'
require 'set'

# disk UUID
# find with `diskutil corestorage list`
UUID = "1D1D6CEB-4613-472C-AE71-BD50651D44D1"

SUFFIXES  = [ '', '!!', '123' ]
JOINS     = [ '', ',', ', ' ]
FIRST     = [ nil, 'something something' ]
LAST      = [ nil, 'else else' ]

def unlock(passphrase)
  unlock_cmd = "diskutil corestorage unlockVolume #{UUID} -stdinpassphrase"

  _in, _out = IO.pipe
  pid = spawn(unlock_cmd, :in => _in, :out => '/dev/null', :err => '/dev/null')
  _in.close
  _out.puts passphrase
  _out.close

  Process.waitpid2(pid)[-1].exitstatus
end

def suffixed(phrase, &block)
  SUFFIXES.each { |suffix| yield "#{phrase}#{suffix}" }
end

def joined(first, last, &block)
  if [first, last].any? &:nil?
    yield "#{first}#{last}" unless [first, last].all? &:nil?
  else
    JOINS.each { |join| yield [first, last].join(join) }
  end
end

def transform_stream(&block)
  FIRST.each { |first| LAST.each { |last|
    joined(first, last) { |phrase| suffixed(phrase, &block) }
  } }
end

# brute-force it!!
transform_stream do |phrase|
  status = unlock phrase
  puts "#{status}: #{phrase}"
  exit 0 if status.to_s =~ /0/
end

exit 1