VMK not encrypted with AES-CCM #4
Comments
|
Is the windows vista info correct ? Which authentication method did you chose to encrypt your device? What's the size of your image? |
|
The windows vista bit IS correct, and it finished with `Error while extracting data: No signature found! Error while parsing input device image` The size of the image is 130GB. I dd'ed it from the partition into an IMG file (4096 block size). Im not sure of the auth method, because I bitlocked this many years ago, but I remember that it had a TPM key with it, so that the password by itself cant unlock it, only the recovery key can. |
|
I'm not sure if this helps or not, but using bdeinfo on the img file shows that it was encrypted using AES-CBC 128-bit with Diffuser. Im thinking that this may be different to AES-CCM |
|
Probably metadata in your encrypted image are organized in a different way wrt tests I've done until now. May I ask you to send to me the first 256Kb of your image? |
|
Sure, I can do that. I'm a bit unsure of how to copy that though, people are saying I can use dd, or dd and truncate, and some other potential solutions. I don't have enough space for a second image so can I dd only a portion of it? |
|
I have potentially found a way to do it. I used cat command and piped through to head, with Since you specified 256Kb, in kilobits, that is 32 kilobytes. Furthermore, how should I attach this? Should I just attach this as a file to the issue? |
|
I'm sorry, I meant 256 KB. Yes you can attach the file here |
|
I have redone the command with "head -c 256000" instead, and attached the file Github only supports certain files, so I have chosen txt, but obviously as you know, its not a text format, its simply the first 256KB of the bitlocked image |
|
I edited this comment, thus I'm tagging you @hammi1 Looking at the output, in this first signature there are some interesting info about the encryption of your device. You can try with something like: would copy from byte 23964908 ( i.e. 0x16DACEC ) to byte 24227052 from its input to its output, and discard the rest (source https://stackoverflow.com/questions/218912/linux-command-like-cat-to-read-a-specified-quantity-of-characters ) |
|
Hi, sorry for the delay in replying. I didn't notice there was an update until today. I have attached the image.txt file again, retrieved from the command you put out (amending Thanks again for looking into this. |
|
@hammi1 unfortunately the |
|
Hi @e-ago , I'm having the same issue as described above, while doing a build review on a laptop with what also seems to be a TPM encrypted partition. It's running Windows 7 Enterprise N. I can send whatever data you need, just send me the dd command you require. Here's the output I have so far: |
|
Based on the above I took a guess and did the following: |
|
@ejtaal I found the signature -FVE-FS- in your file and it seems that AES-CCM signature flag is at a different offset. Later I'll push some changes to the hash_extractor according to this new offset. In the meantime, you could try to attack this recovery password hash: I can confirm there is a TPM part at a certain point. This is the complete output: |
…rding to issue #4. The extractor code needs to be reworked
|
I think I have the same problem
|
|
Sorry for that, I did not wait enought. I finaly had the hash ;). |
|
@remitavenot could you paste the complete output? |
|
`# ./bitcracker_hash -i /dev/sda2 ---------> BitCracker Hash Extractor <--------- Signature found at 0x00000003 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Signature found at 0x22fd2f000 VMK entry found at 0x22fd2f123 Error while parsing input device image` |
|
I'm not sure what's going wrong. If I run the latest code against the dd extracted file it extracts the hash just like in your post. Should the hash extractor not seek to the proper locations just like our dd command? From monitoring the extractor only read about 250MB of the drive in an hour before it quit, while the hash from the dd file came from an area about 9GB into the device. I probably only have tomorrow left to check this laptop before having to hand it back. |
|
Hi, sorry again for the late reply. I am using Linux (cannot use HexFiend), not sure how to use the other hex editors to find the -FVE-FS- signature. Do I need to attach any segments of the image or just the address of whats needed? |
|
Update: I ran the bitcracker_hash file again since when I last ran it, and I have different (perhaps more promising) results here. This version of bitcracker found some aes-ccm encrypted VMKs, perhaps a hash can come from this? I wasnt able to leave it running for long, but as long as I left it, it was just producing those VMK messages until I cancelled. Is it worth running overnight to see if a recovery hash can be produced? |
|
I've made a copy of the first 30GB of the bitlocker partition to check any code update against if you like. Running bitcracker_hash on the laptop itself a second time today again doesn't yield the hash and gives the same error as I posted above after about an hour of running. |
|
@e-ago I have found the -FVE-FS- signature using a hex editor at the same offset you said, 0x16dad000 (i think), so how much do I need to send you, and how do I send the relevant info? Do I use the same method of Thanks a lot EDIT: I seem to have found a recovery key hash by running hashextractor on the first 1gb of the image by cat'ing it to another image and running it on that instead. |
|
I've just pushed an updated version of the hash extractor. @ejtaal Try this new extractor. It would be great if you could send to me this 30GB image so I can do some test by myself: with my (smaller) encrypted images it works perfectly thus there should be some problem related to the size (it worked correctly with the sample you sent me) or to the structure of your BDE volume. As you may notice in your output, the extractor loops on the same address EDIT: @ejtaal wuold you be able to provide and image encrypted as yours (TPM + Recovery password with Windows 7 Enterprise N) but with a known recovery password? @hammi1 Try this new extractor; if it doesn't work I need a sample (about 256KB) of your image starting from |
|
Hi again e-ago, Not going onto this issue (and don't want to open another one) but I'm just commenting to ask if the recovery hash is still valid for recovery key protected drives using TPM? On the readme it says TPM isn't supported, but from my knowledge the recovery key is the single common factor across all Bitlocker encrypted drives, so would the hash still be able to be cracked by the likes of JtR? Many thanks. |
|
Hi, i've got a problem with bitlocker which use TPM (Windows 8 i suppose), the error message say "Error: VMK not encrypted with AES-CCM". I've got the password but due to TPM issue doesn't unlock the drive. There are some chance to retrive the 48-digit key for unlock it? |
Hello,
I am trying to find the hash for a disk volume I made, it says however,
`Signature found at 0x00000003
Version: 8
Invalid version, looking for a signature with valid version...
Signature found at 0x16dad000
Version: 1 (Windows Vista)
VMK entry found at 0x16dad177
VMK encrypted with Recovery Password found at 0x16dad198
Searching AES-CCM from 0x16dad198
Salt: 5b2eb594d822bcd2e20cf10a0e1da4c5
Error: VMK not encrypted with AES-CCM (0,8)
Searching AES-CCM from 0x16dad198
Salt: 05000100008b543179bccb0129000000
Error: VMK not encrypted with AES-CCM (74,ffffff90)
`
It has hung for the moment, I will wait for anything else to happen.
Is there any way to still retrieve the hash for the disk?
The text was updated successfully, but these errors were encountered: