hefronmedia / vilefault

Automatically exported from code.google.com/p/vilefault
0 stars 0 forks source link

Attempts to use -k and -m together fail #7

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
An attempt to use -k with an aes key and a sha1hmac work like so (proper
aeskey and hmacsha1key set):

./vfdecrypt -v -i/tmp/vf-test.dmg -o/tmp/fv-test-decrypt.dmg
-ka122bdc09a32ecb2019d9d4b514909bb28e93d81d5380b3650e9267c2a5676e392fbba15
v1 header detected.
aeskey:
a1 22 bd c0 9a 32 ec b2
01 9d 9d 4b 51 49 09 bb

hmacsha1key:
28 e9 3d 81 d5 38 0b 36
50 e9 26 7c 2a 56 76 e3
92 fb ba 15

640 chunks written

I thought this may be related to a space after -m and -k and removing them
set the key and hmac improperly:

./vfdecrypt -v -i/tmp/vf-test.dmg -o/tmp/fv-test-decrypt.dmg
-ka122bdc09a32ecb2019d9d4b514909bb -m28e93d81d5380b3650e9267c2a5676e392fbba15
v1 header detected.
aeskey:
53 80 b3 65 0e 92 67 c2
a5 67 6e 39 2f bb a1 05

hmacsha1key:
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
28 e9 3d 81

640 chunks written

However, neither the aeskey nor the sha1hmac are correctly set.

Original issue reported on code.google.com by ioer...@gmail.com on 24 Jan 2008 at 8:02

GoogleCodeExporter commented 9 years ago

Original comment by ioer...@gmail.com on 24 Jan 2008 at 9:43

GoogleCodeExporter commented 9 years ago
Hrm. It appears we have an off by 32 at the heart of this problem!

-       strncpy(hmacsha1_key_str+(2*16), optarg, sizeof(hmacsha1_key_str));
+       strncpy(hmacsha1_key_str, optarg, sizeof(hmacsha1_key_str));

After fixing this, I can now do this properly:
./vfdecrypt -v -i/tmp/vf-test.dmg -o/tmp/fv-test-decrypt.dmg
-ka122bdc09a32ecb2019d9d4b514909bb -m28e93d81d5380b3650e9267c2a5676e392fbba15
v1 header detected.
aeskey:
a1 22 bd c0 9a 32 ec b2
01 9d 9d 4b 51 49 09 bb

hmacsha1key:
28 e9 3d 81 d5 38 0b 36
50 e9 26 7c 2a 56 76 e3
92 fb ba 15

640 chunks written
$ strings /tmp/fv-test-decrypt.dmg
?Apple
Apple_partition_map
disk image
Apple_HFS
noog
Apple_Free
10.0
This is a test text file. If you can read this, you have broken
filevault.
-Bill
Bud1
.fwi0blob
icnv
.fwswlong
.fwvhshor
tIlocblob
DSDB
10.0

Original comment by ioer...@gmail.com on 24 Jan 2008 at 11:43

GoogleCodeExporter commented 9 years ago

Original comment by ioer...@gmail.com on 24 Jan 2008 at 11:43