chowder · November 11, 2025 13:59 · Feb 21, 2023 · Feb 21, 2023
diff --git a/README.md b/README.md
@@ -8,7 +8,7 @@ Forunately, after the registration is complete, the underlying mechanism the app
 
 # Extracting the keys 
 
-1. To extract the keys, a complete registration must first be done with a **rooted** Android device. I used an virtual Android device with [Android Studio's Device Manager](https://developer.android.com/studio/run/managing-avds).
+1. To extract the keys, a complete registration must first be done with a **rooted** Android device. I used a virtual Android device created with [Android Studio's Device Manager](https://developer.android.com/studio/run/managing-avds).
 
 2. Once complete, an SQLite database storing the keys can be found on the device at: 
 

diff --git a/README.md b/README.md
@@ -0,0 +1,30 @@
+# Background
+
+Workplaces may enforce TOTP 2FA to be enabled Office 365 accounts, which require the [Microsoft Authenticator](https://www.microsoft.com/en-us/security/mobile-authenticator-app) app to be installed. 
+
+Regular TOTP applications (such as [Aegis](https://getaegis.app/), [Authy](https://authy.com/), or [LastPass](https://www.lastpass.com/)) cannot be used as Microsoft uses a proprietary scheme called `phonefactor`. Furthermore, the application requires Google Services Framework (GSF) to be installed (likely to provide device notifications), and will refuse to work when it is not present on the device.
+
+Forunately, after the registration is complete, the underlying mechanism the app uses to generate TOTP codes is regular `otpauth`, and its secrets can be exported with a little bit of effort. 
+
+# Extracting the keys 
+
+1. To extract the keys, a complete registration must first be done with a **rooted** Android device. I used an virtual Android device with [Android Studio's Device Manager](https://developer.android.com/studio/run/managing-avds).
+
+2. Once complete, an SQLite database storing the keys can be found on the device at: 
+
+    `/data/data/com.azure.authenticator/databases/PhoneFactor` 
+
+    (accessing the `/data` partition is what requires root) 
+
+3. [ADB](https://developer.android.com/studio/command-line/adb) can then be used to connect to the device/emulator, using its bundled `sqlite3` tool to view the database:
+
+    ```
+    $ adb root  # Ensure we run as the root user 
+    $ adb shell  # Launch a shell as the root user 
+    emu64xa:/ # whoami
+    root 
+    emu64xa:/ # sqlite3 /data/data/com.azure.authenticator/databases/PhoneFactor  # Connect to the database file
+    sqlite> SELECT name, username, oath_secret_key from accounts;
+    GitHub|[email protected]|w0swofa8wl02vqml0pkbzphvp54zyx5x
+    ```
+    The 32-length string in the `oath_secret_key` column can then be imported into any TOTP application.