Corrupt Encrypted Sparseimage, PrivateFrameworks and Kernel Panics

Question

Hi Maclovers,
After a kernel panic my encrypted sparseimage with valuable data won't mount:
# hdiutil attach sec3.bak.sparseimage
hdiutil: attach failed - Defektes Image // german for 'corrupt image'
Attaching the following string:
0000b90: 2c45 0000 0000 0000 0000 0000 0000 0000 ,E..............
0000ba0: 0000 0001 6364 7361 656e 6372 ....cdsaencr
gives:
diskimages-helper(11183) malloc: * vm_allocate(size=3190173696) failed (error code=3)
diskimages-helper(11183) malloc: * error: can't allocate region
diskimages-helper(11183) malloc: * set a breakpoint in szone_error to debug
hdiutil: attach failed - Speicher kann nicht zugewiesen werden // german for 'memory not allocable'
Okay, no problem I thought, Mac OS X builds on Open Source Software, so I can decrypt the sparseimage by hand (with perl) and rescue the needed data with a hexeditor.
But, the DiskImages Framework (/System/Library/PrivateFrameworks/DiskImages.framework/DiskImages) is not Open Source
From poking around with gdb and strings I learned that hdiutil uses sha,sha1,sha256,sha512 and md5. But I was unable to figure out
- how the password is expanded for the 128 bit aes key (plain md5/sha0,1,256,512 won't work)
- in which mode aes runs (ecb/cbc/ofb)
Do you know it and can you give me a hint?
Btw: from gdb:
openssl related
0x9194711c aes128_cbccipher
0x9196cd9a aes128_cfb128cipher
0x9196cddf aes128_ecbcipher
0x9196ce39 aes128_ofbcipher
calling from here?
0x97e6ba5e CEncryptedEncoding::encodePasswordHeader(Security::CssmData const&, Security::CssmData const&, CEncryptedEncoding::PasswordHeader&)
0x97e6bd72 CEncryptedEncoding::generateKeyBlob(Security::CssmAutoData&)
0x97e6bece CEncryptedEncoding::parseKeyBlob(Security::CssmData const&)
more functions
0x91946660 AESset_encryptkey
0x91946a5b AESset_decryptkey
0x9194715c AEScbcencrypt
0x919473df AES_encrypt
0x91947880 AES_decrypt
0x9194dd91 AEScfb128encrypt
0x9194de42 AEScfbr_encryptblock
0x9194df86 AEScfb1encrypt
0x9194e046 AEScfb8encrypt
0x9194e095 AESctr128encrypt
0x9194e20b AESecbencrypt
0x9194e232 AES_options
0x9194e242 AESofb128encrypt
Here's some debug info:
si hdiutil attach -debug sec3.bak.sparseimage calling DIHLDiskImageAttach with
<CFDictionary 0x3161a0 [0xa08011c0]>{type = mutable, count = 7, capacity = 8, pairs = (
2 : <CFString 0x42898 [0xa08011c0]>{contents = "debug"} = <CFBoolean 0xa080188c [0xa08011c0]>{value = true}
3 : <CFString 0x428d8 [0xa08011c0]>{contents = "drive-options"} = <CFDictionary 0x3160e0 [0xa08011c0]>{type = mutable, count = 0, capacity = 4, pairs = (
5 : <CFString 0x42888 [0xa08011c0]>{contents = "verbose"} = <CFBoolean 0xa0801884 [0xa08011c0]>{value = false}
6 : <CFString 0x42658 [0xa08011c0]>{contents = "agent"} = <CFString 0x42648 [0xa08011c0]>{contents = "hdiutil"}
7 : <CFString 0x428b8 [0xa08011c0]>{contents = "main-url"} = <CFURL 0x316390 [0xa08011c0]>{type = 0, string = sec3.bak.sparseimage,
base = <CFURL 0x3163f0 [0xa08011c0]>{type = 0, string = /Users/felix/Desktop/si/, base = (null)}}
8 : <CFString 0x428c8 [0xa08011c0]>{contents = "image-options"} = <CFDictionary 0x316110 [0xa08011c0]>{type = mutable, count = 0, capacity = 4, pairs = (
10 : <CFString 0x428a8 [0xa08011c0]>{contents = "quiet"} = <CFBoolean 0xa0801884 [0xa08011c0]>{value = false}
2006-06-13 10:44:39.197 hdiutil[11290] using helper tool at "/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-he lper".
2006-06-13 10:44:39.232 hdiutil[11290] connectToFramework
2006-06-13 10:44:39.233 hdiutil[11290] connectToFramework: about to ask proxy to perform operation
status proc called: initialize
2006-06-13 10:44:39.254 diskimages-helper[11291] _imageOptions: {"enable-keychain" = 1; }
2006-06-13 10:44:39.254 diskimages-helper[11291] _driveOptions: {autodiskmount = 1; "unmount-timeout" = 0; }
2006-06-13 10:44:39.254 diskimages-helper[11291] DIHelperAttach: initializing framework
DILoadDriver: checking for disk image driver...DILoadDriver: DI_kextExists() returned 0x00000000 (0)...DIIsInitialized: returning NO2006-06-13 10:44:39.266 diskimages-helper[11291] DIHelperAttach: resolving disk image
DIIsInitialized: returning YESDIIsInitialized: returning YESDIBackingStoreNewWithCFURL: entry with
<CFURL 0x3208c0 [0xa08011c0]>{type = 15, string = file://localhost/Users/felix/Desktop/si/sec3.bak.sparseimage, base = (null)}
<CFDictionary 0x30c1b0 [0xa08011c0]>{type = mutable, count = 2, capacity = 4, pairs = (
0 : <CFString 0x406c0 [0xa08011c0]>{contents = "enable-keychain"} = <CFBoolean 0xa080188c [0xa08011c0]>{value = true}
1 : <CFString 0x407b0 [0xa08011c0]>{contents = "image-path"} = <CFString 0x30c2e0 [0xa08011c0]>{contents = "/Users/felix/Desktop/si/sec3.bak.sparseimage"}
DIBackingStoreInstantiatorProbe: entry
<CFURL 0x3208c0 [0xa08011c0]>{type = 15, string = file://localhost/Users/felix/Desktop/si/sec3.bak.sparseimage, base = (null)}
<CFDictionary 0x30c1b0 [0xa08011c0]>{type = mutable, count = 2, capacity = 4, pairs = (
0 : <CFString 0x406c0 [0xa08011c0]>{contents = "enable-keychain"} = <CFBoolean 0xa080188c [0xa08011c0]>{value = true}
1 : <CFString 0x407b0 [0xa08011c0]>{contents = "image-path"} = <CFString 0x30c2e0 [0xa08011c0]>{contents = "/Users/felix/Desktop/si/sec3.bak.sparseimage"}
DIBackingStoreInstantiatorProbe: probing interface 0 CBSDBackingStore
CBSDBackingStore::newProbe score 100 for file://localhost/Users/felix/Desktop/si/sec3.bak.sparseimage
DIBackingStoreInstantiatorProbe: probing interface 1 CRAMBackingStore
CRAMBackingStore::probe: scheme "file": not ram: or ramdisk: scheme.
CRAMBackingStore::probe: score -1000 for file://localhost/Users/felix/Desktop/si/sec3.bak.sparseimage
DIBackingStoreInstantiatorProbe: probing interface 2 CCarbonBackingStore
CCarbonBackingStore::newProbe: setting initial rval to +100
CCarbonBackingStore::newProbe score 100 for file://localhost/Users/felix/Desktop/si/sec3.bak.sparseimage
DIBackingStoreInstantiatorProbe: probing interface 3 CDevBackingStore
CDevBackingStore::newProbe: not /dev/disk or /dev/rdisk (/Users/felix/Desktop/si/sec3.bak.sparseimage).CDevBackingStore::newProbe score -1000 for
DIBackingStoreInstantiatorProbe: probing interface 4 CCURLBackingStore
CCURLBackingStore::probe: scheme is
file
CCURLBackingStore::probe: not recognized URL scheme.
CCURLBackingStore::probe: score -1000 for file://localhost/Users/felix/Desktop/si/sec3.bak.sparseimage
DIBackingStoreInstantiatorProbe: probing interface 5 CVectoredBackingStore
CVectoredBackingStore::newProbe not "vectored" scheme.
CVectoredBackingStore::newProbe score -1000 for file://localhost/Users/felix/Desktop/si/sec3.bak.sparseimage
DIBackingStoreNewWithCFURL: CBSDBackingStore
DIBackingStoreNewWithCFURL: instantiator returned 0
DIBackingStoreNewWithCFURL: returning 0x00000000
DIResolveURLToBackingStore: processing level 1 encodings.
DIFileEncodingNewWithBackingStore: entry for encoding level 1
DIFileEncodingInstantiatorProbe: entry for level 1
<CFDictionary 0x30c1b0 [0xa08011c0]>{type = mutable, count = 2, capacity = 4, pairs = (
0 : <CFString 0x406c0 [0xa08011c0]>{contents = "enable-keychain"} = <CFBoolean 0xa080188c [0xa08011c0]>{value = true}
1 : <CFString 0x407b0 [0xa08011c0]>{contents = "image-path"} = <CFString 0x30c2e0 [0xa08011c0]>{contents = "/Users/felix/Desktop/si/sec3.bak.sparseimage"}
DIFileEncodingInstantiatorProbe: probing level 1 interface 0 CMacBinaryEncoding
CBSDBackingStore::openDataFork: about to open /Users/felix/Desktop/si/sec3.bak.sparseimage
CBSDBackingStore::closeDataFork: about to close 500000000: 4e9d dbc8 b429 00eb e882 36a3 d561 9fbd | N....)....6..a.. |
00000010: ed78 e737 a8bd 55cc f2f3 ad7a 42cd 7379 | .x.7..U....zB.sy |
00000020: 0499 4256 7ae3 df72 f032 664d c214 074c | ..BVz..r.2fM...L |
00000030: 1b84 2b0a b849 18c0 c65a dfd9 0ae8 c6dd | ..+..I...Z...... |
00000040: b6db 15ee 39ce db43 f3cf 7a33 8628 d8b3 | ....9..C..z3.(.. |
00000050: fefa 725e 148d ecda e728 3889 bcb2 bb27 | ..r^.....(8....' |
00000060: 3d78 2e88 652f 8e27 71eb a44a 98ca 3148 | =x..e/.'q..J..1H |
00000070: 0780 a593 0e20 6f81 c2a7 f17d 1d87 5b48 | ..... o....}..[H |
diskimages-helper: fileNameLength $0000009D
diskimages-helper: resourceForkLength $DAE72838
diskimages-helper: dataForkLength $5E148DEC
diskimages-helper: commentLength $00008865
diskimages-helper: MacBinary III signature ?'q? (0x8E2771EB)
diskimages-helper: header CRC $00001D87
diskimages-helper: minimum decoder version $0000007D
diskimages-helper: encoder version $000000F1
no MacBinary III signature - checking for MacBinary I or IIDIFileEncodingInstantiatorProbe: probing level 1 interface 1 CAppleSingleEncoding
CBSDBackingStore::openDataFork: about to open /Users/felix/Desktop/si/sec3.bak.sparseimage
00000000: c8db 9d4e eb00 29b4 e882 36a3 d561 9fbd | ...N..)...6..a.. |
00000010: ed78 e737 a8bd 55cc f3f2 ad7a 42cd 7379 | .x.7..U....zB.sy |
00000020: 0499 4256 7ae3 .... .... .... .... .... | ..BVz........... |
CBSDBackingStore::closeDataFork: about to close 5CAppleSingleEncoding::isAppleSingleFile loadAppleSingleHeader failed with error 22
DIFileEncodingInstantiatorProbe: probing level 1 interface 2 CEncryptedEncoding
CBSDBackingStore::openDataFork: about to open /Users/felix/Desktop/si/sec3.bak.sparseimage
CBSDBackingStore::closeDataFork: about to close 5DIFileEncodingNewWithBackingStore: probe fails to find appropriate CFileEncoding class.
DIFileEncodingNewWithBackingStore: returning 0x0000006A
DIResolveURLToBackingStore: level 1 encoding match failed. 106.
(continuing)
DIResolveURLToBackingStore: processing level 2 encodings.
DIFileEncodingNewWithBackingStore: entry for encoding level 2
DIFileEncodingInstantiatorProbe: entry for level 2
<CFDictionary 0x30c1b0 [0xa08011c0]>{type = mutable, count = 2, capacity = 4, pairs = (
0 : <CFString 0x406c0 [0xa08011c0]>{contents = "enable-keychain"} = <CFBoolean 0xa080188c [0xa08011c0]>{value = true}
1 : <CFString 0x407b0 [0xa08011c0]>{contents = "image-path"} = <CFString 0x30c2e0 [0xa08011c0]>{contents = "/Users/felix/Desktop/si/sec3.bak.sparseimage"}
DIFileEncodingInstantiatorProbe: probing level 2 interface 0 CUDIFEncoding
CBSDBackingStore::openDataFork: about to open /Users/felix/Desktop/si/sec3.bak.sparseimage
CBSDBackingStore::closeDataFork: about to close 5CUDIFEncoding::newProbe: failing because backing store is not UDIF file
DIFileEncodingNewWithBackingStore: probe fails to find appropriate CFileEncoding class.
DIFileEncodingNewWithBackingStore: returning 0x0000006A
DIResolveURLToBackingStore: level 2 encoding match failed. 106.
(continuing)
DIResolveURLToBackingStore: processing level 3 encodings.
DIFileEncodingNewWithBackingStore: entry for encoding level 3
DIFileEncodingInstantiatorProbe: entry for level 3
<CFDictionary 0x30c1b0 [0xa08011c0]>{type = mutable, count = 2, capacity = 4, pairs = (
0 : <CFString 0x406c0 [0xa08011c0]>{contents = "enable-keychain"} = <CFBoolean 0xa080188c [0xa08011c0]>{value = true}
1 : <CFString 0x407b0 [0xa08011c0]>{contents = "image-path"} = <CFString 0x30c2e0 [0xa08011c0]>{contents = "/Users/felix/Desktop/si/sec3.bak.sparseimage"}
DIFileEncodingInstantiatorProbe: probing level 3 interface 0 CSegmentedNDIFEncoding
checkTypeCreator: /
checkTypeCreator: returning , score 0
CSegmentedNDIFEncoding::isSegmentedNDIFFile checkTypeCreator failed
DIFileEncodingInstantiatorProbe: probing level 3 interface 1 CSegmentedUDIFEncoding
CSegmentedUDIFEncoding::isSegmentedUDIFFile backing store is not of type CUDIFEncoding
DIFileEncodingInstantiatorProbe: probing level 3 interface 2 CSegmentedUDIFRawEncoding
DIFileEncodingNewWithBackingStore: probe fails to find appropriate CFileEncoding class.
DIFileEncodingNewWithBackingStore: returning 0x0000006A
DIResolveURLToBackingStore: level 3 encoding match failed. 106.
(continuing)
DIIsInitialized: returning YESDIDiskImageNewWithBackingStore: entry with
<CFDictionary 0x30c1b0 [0xa08011c0]>{type = mutable, count = 2, capacity = 4, pairs = (
0 : <CFString 0x406c0 [0xa08011c0]>{contents = "enable-keychain"} = <CFBoolean 0xa080188c [0xa08011c0]>{value = true}
1 : <CFString 0x407b0 [0xa08011c0]>{contents = "image-path"} = <CFString 0x30c2e0 [0xa08011c0]>{contents = "/Users/felix/Desktop/si/sec3.bak.sparseimage"}
DIDiskImageInstantiatorProbe: entry
<CFDictionary 0x30c1b0 [0xa08011c0]>{type = mutable, count = 2, capacity = 4, pairs = (
0 : <CFString 0x406c0 [0xa08011c0]>{contents = "enable-keychain"} = <CFBoolean 0xa080188c [0xa08011c0]>{value = true}
1 : <CFString 0x407b0 [0xa08011c0]>{contents = "image-path"} = <CFString 0x30c2e0 [0xa08011c0]>{contents = "/Users/felix/Desktop/si/sec3.bak.sparseimage"}
DIDiskImageInstantiatorProbe: probing interface 0 CDARTDiskImage
DIDiskImageInstantiatorProbe: probing interface 1 CDiskCopy42DiskImage
DIDiskImageInstantiatorProbe: probing interface 2 CNDIFDiskImage
checkTypeCreator: /
checkTypeCreator: returning , score 0
CNDIFDiskImage::checkExtension: sparseimage
CNDIFDiskImage::newProbe: checkExtension gives score -1000.
DIDiskImageInstantiatorProbe: probing interface 3 CUDIFDiskImage
CUDIFDiskImage::checkBackingStoreType: backing store is wrong type
DIDiskImageInstantiatorProbe: probing interface 5 CRawDiskImage
checkBackingStoreType returned score 0 type
checkTypeCreator returned score 0 type
CRawDiskImage::checkExtension: sparseimage
checkExtension returned score -1000 type
CRawDiskImage::newWithBackingStore: setBackingStore() failed. 106
CRawDiskImage: checkBackingStoreLength score: -100
DIDiskImageInstantiatorProbe: probing interface 6 CShadowedDiskImage
DIDiskImageInstantiatorProbe: probing interface 7 CSparseDiskImage
CSparseDiskImage::checkExtension: sparseimage
DIDiskImageInstantiatorProbe: probing interface 8 CCFPlugInDiskImage
DIDiskImageInstantiatorProbe: probing interface 9 CWrappedDiskImage
DIBackingStore::inUse: this->_fUniqueID
<CFArray 0x320590 [0xa08011c0]>{type = immutable, count = 1, values = (
0 : <CFString 0x320dc0 [0xa08011c0]>{contents = "d234881026:i316148"}
DI_kextCreateDiskImageIdentifierArray: exiting
<CFArray 0x31fd00 [0xa08011c0]>{type = mutable-small, count = 1, values = (
0 : <CFDictionary 0x321100 [0xa08011c0]>{type = fixed-mutable, count = 1, capacity = 1, pairs = (
3 : <CFString 0x321000 [0xa08011c0]>{contents = "writeable-components"} = <CFArray 0x320fe0 [0xa08011c0]>{type = fixed-mutable, count = 1, capacity = 1, values = (
0 : <CFString 0x321080 [0xa08011c0]>{contents = "d234881026:i1808676"}
DIBackingStore::inUse: checking against image dictionary array
<CFArray 0x3210f0 [0xa08011c0]>{type = immutable, count = 1, values = (
0 : <CFDictionary 0x321100 [0xa08011c0]>{type = fixed-mutable, count = 1, capacity = 1, pairs = (
3 : <CFString 0x321000 [0xa08011c0]>{contents = "writeable-components"} = <CFArray 0x320fe0 [0xa08011c0]>{type = fixed-mutable, count = 1, capacity = 1, values = (
0 : <CFString 0x321080 [0xa08011c0]>{contents = "d234881026:i1808676"}
DIBackingStore::inUse: checking our list looking for who's naughty and nice
DIBackingStore::inUse: checking image 0000
CBSDBackingStore::openDataFork: about to open /Users/felix/Desktop/si/sec3.bak.sparseimage
syncPhysicalAndLogicalForkLengths: returning 0 (cached logEOF: 1540853760, physEOF: 1540853760)
CBSDBackingStore::closeDataFork: about to close 5CSparseFile::~CSparseFile: WARNING flushing header and index nodes failed. Invalid argument
syncPhysicalAndLogicalForkLengths: entry (cached logEOF: 1540853760, physEOF: 1540853760)
: returning 0 (new cached logEOF: 1540853760, physEOF: 1540853760)
DIDiskImageNewWithBackingStore: returning 0x00000067
DIResolveBackingStoreToDiskImage: unable to resolve to any disk image class. 103.
DIResolveURLToDiskImage: resolving disk image format failed. 103.
status proc called: attach
error code: 103
status proc called: cleanup
2006-06-13 10:44:39.684 diskimages-helper[11291] DIHelperAttach performOperation: returning 103
2006-06-13 10:44:39.684 diskimages-helper[11291] DIHelper perform_operation: returning {payload = {}; "result-code" = 103; }
2006-06-13 10:44:39.684 hdiutil[11290] connectToFramework: proxy has finished operation
2006-06-13 10:44:39.685 hdiutil[11290] results are: {payload = {}; "result-code" = 103; }
2006-06-13 10:44:39.685 hdiutil[11290] _threadResultsError is 103
2006-06-13 10:44:39.685 hdiutil[11290] connectToFramework: terminating proxy
2006-06-13 10:44:39.686 diskimages-helper[11291] terminateHelper
DIHLDiskImageAttach() returned 103
<CFDictionary 0x3245a0 [0xa08011c0]>{type = immutable, count = 0, capacity = 0, pairs = (
hdiutil: attach failed - Defektes Image
si 2006-06-13 10:44:39.786 diskimages-helper[11291] -DIHelperAgentMaster terminateUIAgentConnection
2006-06-13 10:44:39.786 diskimages-helper[11291] -exitIfPossible:0 (_drivesServed 0)
2006-06-13 10:44:39.787 diskimages-helper[11291] -exitWatchThread: trying to get exit lock
2006-06-13 10:44:39.787 diskimages-helper[11291] -exitWatchThread: got exit lock
2006-06-13 10:44:39.787 diskimages-helper[11291] -exitWatchCompleted:0
2006-06-13 10:44:40.788 diskimages-helper[11291] suicide:<NSCFTimer: 0x3217d0>
cheers, felix
MBP 15" Mac OS X (10.4.6)

Answer 1

The key expansion does not work with a substring of the upper hash functions. Create a sparseimage with the password asdf and try the following script:
#!/opt/local/bin/perl
use Crypt::GCrypt;
my $tmp;
my $i;
my $subkey;
# asdf
%pw = (
ph => (pack "H*", "61736466000000000000000000000000"),
pl => (pack "H*", "00000000000000000000000061736466"),
md5 => (pack "H*", "912ec803b2ce49e4a541068d495ab570"),
sha1 => (pack "H*", "3da541559918a808c2402bba5012f6c60b27661c"),
sha => (pack "H*", "71f2cbe0db64c15e9e385525ad5ef854c494898f"),
sha256 => (pack "H*", "f0e4c2f76c58916ec258f246851bea091d14d4247a2fc3e18694461b1816e13b"),
sha512 => (pack "H*", "401b09eab3c013d4ca54922bb802bec8fd5318192b0a75f201d8b3727429080fb337591abd3e44 453b954555b7a0812e1081c39b740293f765eae731f5a65ed1"),
open (INFILE, "< $ARGV[0]") or die "Could not open $filename for reading: $!";
read(INFILE,$tmp,128);
close INFILE;
foreach my $key (keys %pw) {
for($i=16;$i <= length $pw{$key};$i++) {
$subkey = substr($pw{$key},$i-16,16);
#print "------using $key with $pw{$key} and substr $subkey-------";
$cipher = Crypt::GCrypt->new(
type => 'cipher',
algorithm => 'aes',
mode => 'ecb'
$cipher->start('decrypting');
$cipher->setkey($subkey);
print $cipher->decrypt($tmp);
}