/
Decrypt.cpp
1350 lines (1273 loc) · 61.8 KB
/
Decrypt.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* Copyright (C) 2016 The Team Win Recovery Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "Decrypt.h"
#ifdef USE_KEYSTORAGE_4
#include "Ext4CryptPie.h"
#else
#include "Ext4Crypt.h"
#endif
#include <map>
#include <string>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/types.h>
#ifndef HAVE_LIBKEYUTILS
#include "key_control.h"
#else
#include <keyutils.h>
#endif
#ifdef HAVE_SYNTH_PWD_SUPPORT
#include "Weaver1.h"
#include "cutils/properties.h"
#include <openssl/sha.h>
#include <openssl/aes.h>
#include <openssl/evp.h>
#include <openssl/rand.h>
#include <dirent.h>
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <sys/types.h>
#include <fstream>
#include <ext4_utils/ext4_crypt.h>
#ifdef USE_KEYSTORAGE_4
#include <android/security/IKeystoreService.h>
#else
#include <keystore/IKeystoreService.h>
#include <keystore/authorization_set.h>
#endif
#include <binder/IPCThreadState.h>
#include <binder/IServiceManager.h>
#include <keystore/keystore.h>
#include <algorithm>
extern "C" {
#include "crypto_scrypt.h"
}
#else
#include "ext4_crypt.h"
#endif //ifdef HAVE_SYNTH_PWD_SUPPORT
#ifdef HAVE_GATEKEEPER1
#include <android/hardware/gatekeeper/1.0/IGatekeeper.h>
#else
#include <hardware/gatekeeper.h>
#endif
#include "HashPassword.h"
#include <android-base/file.h>
// Store main DE raw ref / policy
extern std::string de_raw_ref;
extern std::map<userid_t, std::string> s_de_key_raw_refs;
extern std::map<userid_t, std::string> s_ce_key_raw_refs;
static bool lookup_ref_key_internal(std::map<userid_t, std::string>& key_map, const char* policy, userid_t* user_id) {
for (std::map<userid_t, std::string>::iterator it=key_map.begin(); it!=key_map.end(); ++it) {
if (strncmp(it->second.c_str(), policy, it->second.size()) == 0) {
*user_id = it->first;
return true;
}
}
return false;
}
extern "C" bool lookup_ref_key(const char* policy, char* policy_type) {
userid_t user_id = 0;
if (strncmp(de_raw_ref.c_str(), policy, de_raw_ref.size()) == 0) {
strcpy(policy_type, "1DK");
return true;
}
if (!lookup_ref_key_internal(s_de_key_raw_refs, policy, &user_id)) {
if (!lookup_ref_key_internal(s_ce_key_raw_refs, policy, &user_id)) {
return false;
} else
sprintf(policy_type, "1CE%d", user_id);
} else
sprintf(policy_type, "1DE%d", user_id);
return true;
}
extern "C" bool lookup_ref_tar(const char* policy_type, char* policy) {
if (strncmp(policy_type, "1", 1) != 0) {
printf("Unexpected version %c\n", policy_type[0]);
return false;
}
const char* ptr = policy_type + 1; // skip past the version number
if (strncmp(ptr, "DK", 2) == 0) {
strncpy(policy, de_raw_ref.data(), de_raw_ref.size());
return true;
}
userid_t user_id = atoi(ptr + 2);
std::string raw_ref;
if (*ptr == 'D') {
if (lookup_key_ref(s_de_key_raw_refs, user_id, &raw_ref)) {
strncpy(policy, raw_ref.data(), raw_ref.size());
} else
return false;
} else if (*ptr == 'C') {
if (lookup_key_ref(s_ce_key_raw_refs, user_id, &raw_ref)) {
strncpy(policy, raw_ref.data(), raw_ref.size());
} else
return false;
} else {
printf("unknown policy type '%s'\n", policy_type);
return false;
}
return true;
}
#ifndef HAVE_GATEKEEPER1
int gatekeeper_device_initialize(gatekeeper_device_t **dev) {
int ret;
const hw_module_t *mod;
ret = hw_get_module_by_class(GATEKEEPER_HARDWARE_MODULE_ID, NULL, &mod);
if (ret!=0) {
printf("failed to get hw module\n");
return ret;
}
ret = gatekeeper_open(mod, dev);
if (ret!=0)
printf("failed to open gatekeeper\n");
return ret;
}
#endif //ifndef HAVE_GATEKEEPER1
bool Decrypt_DE() {
if (!e4crypt_initialize_global_de()) { // this deals with the overarching device encryption
printf("e4crypt_initialize_global_de returned fail\n");
return false;
}
if (!e4crypt_init_user0()) {
printf("e4crypt_init_user0 returned fail\n");
return false;
}
return true;
}
#ifdef HAVE_SYNTH_PWD_SUPPORT
// Crappy functions for debugging, please ignore unless you need to debug
/*void output_hex(const std::string& in) {
const char *buf = in.data();
char hex[in.size() * 2 + 1];
unsigned int index;
for (index = 0; index < in.size(); index++)
sprintf(&hex[2 * index], "%02X", buf[index]);
printf("%s", hex);
}
void output_hex(const char* buf, const int size) {
char hex[size * 2 + 1];
int index;
for (index = 0; index < size; index++)
sprintf(&hex[2 * index], "%02X", buf[index]);
printf("%s", hex);
}
void output_hex(const unsigned char* buf, const int size) {
char hex[size * 2 + 1];
int index;
for (index = 0; index < size; index++)
sprintf(&hex[2 * index], "%02X", buf[index]);
printf("%s", hex);
}
void output_hex(std::vector<uint8_t>* vec) {
char hex[3];
unsigned int index;
for (index = 0; index < vec->size(); index++) {
sprintf(&hex[0], "%02X", vec->at(index));
printf("%s", hex);
}
}*/
/* An alternative is to use:
* sqlite3 /data/system/locksettings.db "SELECT value FROM locksettings WHERE name='sp-handle' AND user=0;"
* but we really don't want to include the 1.1MB libsqlite in TWRP. We scan the spblob folder for the
* password data file (*.pwd) and get the handle from the filename instead. This is a replacement for
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/LockSettingsService.java#2017
* We never use this data as an actual long. We always use it as a string. */
bool Find_Handle(const std::string& spblob_path, std::string& handle_str) {
DIR* dir = opendir(spblob_path.c_str());
if (!dir) {
printf("Error opening '%s'\n", spblob_path.c_str());
return false;
}
struct dirent* de = 0;
while ((de = readdir(dir)) != 0) {
if (strcmp(de->d_name, ".") == 0 || strcmp(de->d_name, "..") == 0)
continue;
size_t len = strlen(de->d_name);
if (len <= 4)
continue;
char* p = de->d_name;
p += len - 4;
if (strncmp(p, ".pwd", 4) == 0) {
handle_str = de->d_name;
handle_str = handle_str.substr(0, len - 4);
//*handle = strtoull(handle_str.c_str(), 0 , 16);
closedir(dir);
return true;
}
}
closedir(dir);
return false;
}
/* This is the structure of the data in the password data (*.pwd) file which the structure can be found
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#187 */
struct password_data_struct {
int password_type;
unsigned char scryptN;
unsigned char scryptR;
unsigned char scryptP;
int salt_len;
void* salt;
int handle_len;
void* password_handle;
};
/* C++ replacement for
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#764 */
bool Get_Password_Data(const std::string& spblob_path, const std::string& handle_str, password_data_struct *pwd) {
std::string pwd_file = spblob_path + handle_str + ".pwd";
std::string pwd_data;
if (!android::base::ReadFileToString(pwd_file, &pwd_data)) {
printf("Failed to read '%s'\n", pwd_file.c_str());
return false;
}
//output_hex(pwd_data.data(), pwd_data.size());printf("\n");
const int* intptr = (const int*)pwd_data.data();
pwd->password_type = *intptr;
endianswap(&pwd->password_type);
//printf("password type %i\n", pwd->password_type); // 2 was PIN, 1 for pattern, 2 also for password, -1 for default password
const unsigned char* byteptr = (const unsigned char*)pwd_data.data() + sizeof(int);
pwd->scryptN = *byteptr;
byteptr++;
pwd->scryptR = *byteptr;
byteptr++;
pwd->scryptP = *byteptr;
byteptr++;
intptr = (const int*)byteptr;
pwd->salt_len = *intptr;
endianswap(&pwd->salt_len);
if (pwd->salt_len != 0) {
pwd->salt = malloc(pwd->salt_len);
if (!pwd->salt) {
printf("Get_Password_Data malloc salt\n");
return false;
}
memcpy(pwd->salt, intptr + 1, pwd->salt_len);
intptr++;
byteptr = (const unsigned char*)intptr;
byteptr += pwd->salt_len;
} else {
printf("Get_Password_Data salt_len is 0\n");
return false;
}
intptr = (const int*)byteptr;
pwd->handle_len = *intptr;
endianswap(&pwd->handle_len);
if (pwd->handle_len != 0) {
pwd->password_handle = malloc(pwd->handle_len);
if (!pwd->password_handle) {
printf("Get_Password_Data malloc password_handle\n");
return false;
}
memcpy(pwd->password_handle, intptr + 1, pwd->handle_len);
} else {
printf("Get_Password_Data handle_len is 0\n");
// Not an error if using weaver
}
return true;
}
/* C++ replacement for
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#765
* called here
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#1050 */
bool Get_Password_Token(const password_data_struct *pwd, const std::string& Password, unsigned char* password_token) {
if (!password_token) {
printf("password_token is null\n");
return false;
}
unsigned int N = 1 << pwd->scryptN;
unsigned int r = 1 << pwd->scryptR;
unsigned int p = 1 << pwd->scryptP;
//printf("N %i r %i p %i\n", N, r, p);
int ret = crypto_scrypt(reinterpret_cast<const uint8_t*>(Password.data()), Password.size(),
reinterpret_cast<const uint8_t*>(pwd->salt), pwd->salt_len,
N, r, p,
password_token, 32);
if (ret != 0) {
printf("scrypt error\n");
return false;
}
return true;
}
// Data structure for the *.weaver file, see Get_Weaver_Data below
struct weaver_data_struct {
unsigned char version;
int slot;
};
/* C++ replacement for
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#501
* called here
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#768 */
bool Get_Weaver_Data(const std::string& spblob_path, const std::string& handle_str, weaver_data_struct *wd) {
std::string weaver_file = spblob_path + handle_str + ".weaver";
std::string weaver_data;
if (!android::base::ReadFileToString(weaver_file, &weaver_data)) {
printf("Failed to read '%s'\n", weaver_file.c_str());
return false;
}
//output_hex(weaver_data.data(), weaver_data.size());printf("\n");
const unsigned char* byteptr = (const unsigned char*)weaver_data.data();
wd->version = *byteptr;
//printf("weaver version %i\n", wd->version);
const int* intptr = (const int*)weaver_data.data() + sizeof(unsigned char);
wd->slot = *intptr;
//endianswap(&wd->slot); not needed
//printf("weaver slot %i\n", wd->slot);
return true;
}
namespace android {
// On Android 8.0 for some reason init can't seem to completely stop keystore
// so we have to kill it too if it doesn't die on its own.
static void kill_keystore() {
DIR* dir = opendir("/proc");
if (dir) {
struct dirent* de = 0;
while ((de = readdir(dir)) != 0) {
if (strcmp(de->d_name, ".") == 0 || strcmp(de->d_name, "..") == 0)
continue;
int pid = -1;
int ret = sscanf(de->d_name, "%d", &pid);
if (ret == 1) {
char cmdpath[PATH_MAX];
sprintf(cmdpath, "/proc/%d/cmdline", pid);
FILE* file = fopen(cmdpath, "r");
size_t task_size = PATH_MAX;
char task[PATH_MAX];
char* p = task;
if (getline(&p, &task_size, file) > 0) {
if (strstr(task, "keystore") != 0) {
printf("keystore pid %d found, sending kill.\n", pid);
kill(pid, SIGINT);
usleep(5000);
kill(pid, SIGKILL);
}
}
fclose(file);
}
}
closedir(dir);
}
}
// The keystore holds a file open on /data so we have to stop / kill it
// if we want to be able to unmount /data for things like formatting.
static void stop_keystore() {
printf("Stopping keystore...\n");
property_set("ctl.stop", "keystore");
usleep(5000);
kill_keystore();
}
/* These next 2 functions try to get the keystore service 50 times because
* the keystore is not always ready when TWRP boots */
sp<IBinder> getKeystoreBinder() {
sp<IServiceManager> sm = defaultServiceManager();
return sm->getService(String16("android.security.keystore"));
}
sp<IBinder> getKeystoreBinderRetry() {
printf("Starting keystore...\n");
property_set("ctl.start", "keystore");
int retry_count = 50;
sp<IBinder> binder = getKeystoreBinder();
while (binder == NULL && retry_count) {
printf("Waiting for keystore service... %i\n", retry_count--);
sleep(1);
binder = getKeystoreBinder();
}
return binder;
}
namespace keystore {
#define SYNTHETIC_PASSWORD_VERSION_V1 1
#define SYNTHETIC_PASSWORD_VERSION_V2 2
#define SYNTHETIC_PASSWORD_VERSION_V3 3
#define SYNTHETIC_PASSWORD_PASSWORD_BASED 0
#define SYNTHETIC_PASSWORD_KEY_PREFIX "USRSKEY_synthetic_password_"
#define USR_PRIVATE_KEY_PREFIX "USRPKEY_synthetic_password_"
static std::string mKey_Prefix;
/* The keystore alias subid is sometimes the same as the handle, but not always.
* In the case of handle 0c5303fd2010fe29, the alias subid used c5303fd2010fe29
* without the leading 0. We could try to parse the data from a previous
* keystore request, but I think this is an easier solution because there
* is little to no documentation on the format of data we get back from
* the keystore in this instance. We also want to copy everything to a temp
* folder so that any key upgrades that might take place do not actually
* upgrade the keys on the data partition. We rename all 1000 uid files to 0
* to pass the keystore permission checks. */
bool Find_Keystore_Alias_SubID_And_Prep_Files(const userid_t user_id, std::string& keystoreid, const std::string& handle_str) {
char path_c[PATH_MAX];
sprintf(path_c, "/data/misc/keystore/user_%d", user_id);
char user_dir[PATH_MAX];
sprintf(user_dir, "user_%d", user_id);
std::string source_path = "/data/misc/keystore/";
source_path += user_dir;
std::string handle_sub = handle_str;
while (handle_sub.substr(0,1) == "0") {
std::string temp = handle_sub.substr(1);
handle_sub = temp;
}
mKey_Prefix = "";
mkdir("/tmp/misc", 0755);
mkdir("/tmp/misc/keystore", 0755);
std::string destination_path = "/tmp/misc/keystore/";
destination_path += user_dir;
if (mkdir(destination_path.c_str(), 0755) && errno != EEXIST) {
printf("failed to mkdir '%s' %s\n", destination_path.c_str(), strerror(errno));
return false;
}
destination_path += "/";
DIR* dir = opendir(source_path.c_str());
if (!dir) {
printf("Error opening '%s'\n", source_path.c_str());
return false;
}
source_path += "/";
struct dirent* de = 0;
size_t prefix_len = strlen(SYNTHETIC_PASSWORD_KEY_PREFIX);
bool found_subid = false;
bool has_pkey = false; // PKEY has priority over SKEY
while ((de = readdir(dir)) != 0) {
if (strcmp(de->d_name, ".") == 0 || strcmp(de->d_name, "..") == 0)
continue;
if (!found_subid) {
size_t len = strlen(de->d_name);
if (len <= prefix_len)
continue;
if (strstr(de->d_name, SYNTHETIC_PASSWORD_KEY_PREFIX) && !has_pkey)
mKey_Prefix = SYNTHETIC_PASSWORD_KEY_PREFIX;
else if (strstr(de->d_name, USR_PRIVATE_KEY_PREFIX)) {
mKey_Prefix = USR_PRIVATE_KEY_PREFIX;
has_pkey = true;
} else
continue;
if (strstr(de->d_name, handle_sub.c_str())) {
keystoreid = handle_sub;
printf("keystoreid matched handle_sub: '%s'\n", keystoreid.c_str());
found_subid = true;
} else {
std::string file = de->d_name;
std::size_t found = file.find_last_of("_");
if (found != std::string::npos) {
keystoreid = file.substr(found + 1);
printf("possible keystoreid: '%s'\n", keystoreid.c_str());
//found_subid = true; // we'll keep going in hopes that we find a pkey or a match to the handle_sub
}
}
}
std::string src = source_path;
src += de->d_name;
std::ifstream srcif(src.c_str(), std::ios::binary);
std::string dst = destination_path;
dst += de->d_name;
std::size_t source_uid = dst.find("1000");
if (source_uid != std::string::npos)
dst.replace(source_uid, 4, "0");
std::ofstream dstof(dst.c_str(), std::ios::binary);
printf("copying '%s' to '%s'\n", src.c_str(), dst.c_str());
dstof << srcif.rdbuf();
srcif.close();
dstof.close();
}
closedir(dir);
if (!found_subid && !mKey_Prefix.empty() && !keystoreid.empty())
found_subid = true;
return found_subid;
}
/* C++ replacement for function of the same name
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#867
* returning an empty string indicates an error */
std::string unwrapSyntheticPasswordBlob(const std::string& spblob_path, const std::string& handle_str, const userid_t user_id, const void* application_id, const size_t application_id_size, uint32_t auth_token_len) {
std::string disk_decryption_secret_key = "";
std::string keystore_alias_subid;
if (!Find_Keystore_Alias_SubID_And_Prep_Files(user_id, keystore_alias_subid, handle_str)) {
printf("failed to scan keystore alias subid and prep keystore files\n");
return disk_decryption_secret_key;
}
// First get the keystore service
sp<IBinder> binder = getKeystoreBinderRetry();
#ifdef USE_KEYSTORAGE_4
sp<security::IKeystoreService> service = interface_cast<security::IKeystoreService>(binder);
#else
sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
#endif
if (service == NULL) {
printf("error: could not connect to keystore service\n");
return disk_decryption_secret_key;
}
if (auth_token_len > 0) {
printf("Starting keystore_auth service...\n");
property_set("ctl.start", "keystore_auth");
}
// Read the data from the .spblob file per: https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#869
std::string spblob_file = spblob_path + handle_str + ".spblob";
std::string spblob_data;
if (!android::base::ReadFileToString(spblob_file, &spblob_data)) {
printf("Failed to read '%s'\n", spblob_file.c_str());
return disk_decryption_secret_key;
}
unsigned char* byteptr = (unsigned char*)spblob_data.data();
if (*byteptr != SYNTHETIC_PASSWORD_VERSION_V2 && *byteptr != SYNTHETIC_PASSWORD_VERSION_V1
&& *byteptr != SYNTHETIC_PASSWORD_VERSION_V3) {
printf("Unsupported synthetic password version %i\n", *byteptr);
return disk_decryption_secret_key;
}
const unsigned char* synthetic_password_version = byteptr;
byteptr++;
if (*byteptr != SYNTHETIC_PASSWORD_PASSWORD_BASED) {
printf("spblob data is not SYNTHETIC_PASSWORD_PASSWORD_BASED\n");
return disk_decryption_secret_key;
}
byteptr++; // Now we're pointing to the blob data itself
if (*synthetic_password_version == SYNTHETIC_PASSWORD_VERSION_V1) {
printf("spblob v1\n");
/* We're now going to handle decryptSPBlob: https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#115
* Called from https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#879
* This small function ends up being quite a headache. The call to get data from the keystore basically is not needed in TWRP at this time.
* The keystore data seems to be the serialized data from an entire class in Java. Specifically I think it represents:
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java
* or perhaps
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java
* but the only things we "need" from this keystore are a user ID and the keyAlias which ends up being USRSKEY_synthetic_password_{handle_str}
* the latter of which we already have. We may need to figure out how to get the user ID if we ever support decrypting mulitple users.
* There are 2 calls to a Java decrypt funcion that is overloaded. These 2 calls go in completely different directions despite the seemingly
* similar use of decrypt() and decrypt parameters. To figure out where things were going, I added logging to:
* https://android.googlesource.com/platform/libcore/+/android-8.0.0_r23/ojluni/src/main/java/javax/crypto/Cipher.java#2575
* Logger.global.severe("Cipher tryCombinations " + prov.getName() + " - " + prov.getInfo());
* To make logging work in libcore, import java.util.logging.Logger; and either set a better logging level or modify the framework to log everything
* regardless of logging level. This will give you some strings that you can grep for and find the actual crypto provider in use. In our case there were
* 2 different providers in use. The first stage to get the intermediate key used:
* https://android.googlesource.com/platform/external/conscrypt/+/android-8.0.0_r23/common/src/main/java/org/conscrypt/OpenSSLProvider.java
* which is a pretty straight-forward OpenSSL implementation of AES/GCM/NoPadding. */
// First we personalize as seen https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#102
void* personalized_application_id = PersonalizedHashBinary(PERSONALISATION_APPLICATION_ID, (const char*)application_id, application_id_size);
if (!personalized_application_id) {
printf("malloc personalized_application_id\n");
return disk_decryption_secret_key;
}
//printf("personalized application id: "); output_hex((unsigned char*)personalized_application_id, SHA512_DIGEST_LENGTH); printf("\n");
// Now we'll decrypt using openssl AES/GCM/NoPadding
OpenSSL_add_all_ciphers();
int actual_size=0, final_size=0;
EVP_CIPHER_CTX *d_ctx = EVP_CIPHER_CTX_new();
const unsigned char* iv = (const unsigned char*)byteptr; // The IV is the first 12 bytes of the spblob
//printf("iv: "); output_hex((const unsigned char*)iv, 12); printf("\n");
const unsigned char* cipher_text = (const unsigned char*)byteptr + 12; // The cipher text comes immediately after the IV
//printf("cipher_text: "); output_hex((const unsigned char*)cipher_text, spblob_data.size() - 2 - 12); printf("\n");
const unsigned char* key = (const unsigned char*)personalized_application_id; // The key is the now personalized copy of the application ID
//printf("key: "); output_hex((const unsigned char*)key, 32); printf("\n");
EVP_DecryptInit(d_ctx, EVP_aes_256_gcm(), key, iv);
std::vector<unsigned char> intermediate_key;
intermediate_key.resize(spblob_data.size() - 2 - 12, '\0');
EVP_DecryptUpdate(d_ctx, &intermediate_key[0], &actual_size, cipher_text, spblob_data.size() - 2 - 12);
unsigned char tag[AES_BLOCK_SIZE];
EVP_CIPHER_CTX_ctrl(d_ctx, EVP_CTRL_GCM_SET_TAG, 16, tag);
EVP_DecryptFinal_ex(d_ctx, &intermediate_key[actual_size], &final_size);
EVP_CIPHER_CTX_free(d_ctx);
free(personalized_application_id);
//printf("spblob_data size: %lu actual_size %i, final_size: %i\n", spblob_data.size(), actual_size, final_size);
intermediate_key.resize(actual_size + final_size - 16, '\0');// not sure why we have to trim the size by 16 as I don't see where this is done in Java side
//printf("intermediate key: "); output_hex((const unsigned char*)intermediate_key.data(), intermediate_key.size()); printf("\n");
// When using secdis (aka not weaver) you must supply an auth token to the keystore prior to the begin operation
if (auth_token_len > 0) {
/*::keystore::KeyStoreServiceReturnCode auth_result = service->addAuthToken(auth_token, auth_token_len);
if (!auth_result.isOk()) {
// The keystore checks the uid of the calling process and will return a permission denied on this operation for user 0
printf("keystore error adding auth token\n");
return disk_decryption_secret_key;
}*/
// The keystore refuses to allow the root user to supply auth tokens, so we write the auth token to a file earlier and
// run a separate service that runs user the system user to add the auth token. We wait for the auth token file to be
// deleted by the keymaster_auth service and check for a /auth_error file in case of errors. We quit after after a while if
// the /auth_token file never gets deleted.
int auth_wait_count = 20;
while (access("/auth_token", F_OK) == 0 && auth_wait_count-- > 0)
usleep(5000);
if (auth_wait_count == 0 || access("/auth_error", F_OK) == 0) {
printf("error during keymaster_auth service\n");
/* If you are getting this error, make sure that you have the keymaster_auth service defined in your init scripts, preferrably in init.recovery.{ro.hardware}.rc
* service keystore_auth /sbin/keystore_auth
* disabled
* oneshot
* user system
* group root
* seclabel u:r:recovery:s0
*
* And check dmesg for error codes regarding this service if needed. */
return disk_decryption_secret_key;
}
}
int32_t ret;
/* We only need a keyAlias which is USRSKEY_synthetic_password_b6f71045af7bd042 which we find and a uid which is -1 or 1000, I forget which
* as the key data will be read again by the begin function later via the keystore.
* The data is in a hidl_vec format which consists of a type and a value. */
/*::keystore::hidl_vec<uint8_t> data;
std::string keystoreid = SYNTHETIC_PASSWORD_KEY_PREFIX;
keystoreid += handle_str;
ret = service->get(String16(keystoreid.c_str()), user_id, &data);
if (ret < 0) {
printf("Could not connect to keystore service %i\n", ret);
return disk_decryption_secret_key;
} else if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*//*) {
printf("keystore error: (%d)\n", /*responses[ret],*//* ret);
return disk_decryption_secret_key;
} else {
printf("keystore returned: "); output_hex(&data[0], data.size()); printf("\n");
}*/
// Now we'll break up the intermediate key into the IV (first 12 bytes) and the cipher text (the rest of it).
std::vector<unsigned char> nonce = intermediate_key;
nonce.resize(12);
intermediate_key.erase (intermediate_key.begin(),intermediate_key.begin()+12);
//printf("nonce: "); output_hex((const unsigned char*)nonce.data(), nonce.size()); printf("\n");
//printf("cipher text: "); output_hex((const unsigned char*)intermediate_key.data(), intermediate_key.size()); printf("\n");
/* Now we will begin the second decrypt call found in
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#122
* This time we will use https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java
* and https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java
* First we set some algorithm parameters as seen in two places:
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#297
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#216 */
size_t maclen = 128;
::keystore::AuthorizationSetBuilder begin_params;
begin_params.Authorization(::keystore::TAG_ALGORITHM, ::keystore::Algorithm::AES);
begin_params.Authorization(::keystore::TAG_BLOCK_MODE, ::keystore::BlockMode::GCM);
begin_params.Padding(::keystore::PaddingMode::NONE);
begin_params.Authorization(::keystore::TAG_NONCE, nonce);
begin_params.Authorization(::keystore::TAG_MAC_LENGTH, maclen);
//keymasterArgs.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES);
//keymasterArgs.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, mKeymasterBlockMode);
//keymasterArgs.addEnum(KeymasterDefs.KM_TAG_PADDING, mKeymasterPadding);
//keymasterArgs.addUnsignedInt(KeymasterDefs.KM_TAG_MAC_LENGTH, mTagLengthBits);
::keystore::hidl_vec<uint8_t> entropy; // No entropy is needed for decrypt
entropy.resize(0);
std::string keystore_alias = mKey_Prefix;
keystore_alias += keystore_alias_subid;
String16 keystore_alias16(keystore_alias.c_str());
#ifdef USE_KEYSTORAGE_4
android::hardware::keymaster::V4_0::KeyPurpose purpose = android::hardware::keymaster::V4_0::KeyPurpose::DECRYPT;
security::keymaster::OperationResult begin_result;
security::keymaster::OperationResult update_result;
security::keymaster::OperationResult finish_result;
::android::security::keymaster::KeymasterArguments empty_params;
// These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63
service->begin(binder, keystore_alias16, (int32_t)purpose, true, android::security::keymaster::KeymasterArguments(begin_params.hidl_data()), entropy, -1, &begin_result);
#else
::keystore::KeyPurpose purpose = ::keystore::KeyPurpose::DECRYPT;
OperationResult begin_result;
OperationResult update_result;
OperationResult finish_result;
::keystore::hidl_vec<::keystore::KeyParameter> empty_params;
empty_params.resize(0);
// These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63
service->begin(binder, keystore_alias16, purpose, true, begin_params.hidl_data(), entropy, -1, &begin_result);
#endif
ret = begin_result.resultCode;
if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
printf("keystore begin error: (%d)\n", /*responses[ret],*/ ret);
return disk_decryption_secret_key;
} else {
//printf("keystore begin operation successful\n");
}
// The cipher.doFinal call triggers an update to the keystore followed by a finish https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#64
// See also https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/KeyStoreCryptoOperationChunkedStreamer.java#208
service->update(begin_result.token, empty_params, intermediate_key, &update_result);
ret = update_result.resultCode;
if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
printf("keystore update error: (%d)\n", /*responses[ret],*/ ret);
return disk_decryption_secret_key;
} else {
//printf("keystore update operation successful\n");
//printf("keystore update returned: "); output_hex(&update_result.data[0], update_result.data.size()); printf("\n"); // this ends up being the synthetic password
}
// We must use the data in update_data.data before we call finish below or the data will be gone
// The payload data from the keystore update is further personalized at https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#153
// We now have the disk decryption key!
disk_decryption_secret_key = PersonalizedHash(PERSONALIZATION_FBE_KEY, (const char*)&update_result.data[0], update_result.data.size());
//printf("disk_decryption_secret_key: '%s'\n", disk_decryption_secret_key.c_str());
::keystore::hidl_vec<uint8_t> signature;
service->finish(begin_result.token, empty_params, signature, entropy, &finish_result);
ret = finish_result.resultCode;
if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
printf("keystore finish error: (%d)\n", /*responses[ret],*/ ret);
return disk_decryption_secret_key;
} else {
//printf("keystore finish operation successful\n");
}
stop_keystore();
return disk_decryption_secret_key;
} else if (*synthetic_password_version == SYNTHETIC_PASSWORD_VERSION_V2
|| *synthetic_password_version == SYNTHETIC_PASSWORD_VERSION_V3) {
printf("spblob v2 / v3\n");
/* Version 2 / 3 of the spblob is basically the same as version 1, but the order of getting the intermediate key and disk decryption key have been flip-flopped
* as seen in https://android.googlesource.com/platform/frameworks/base/+/5025791ac6d1538224e19189397de8d71dcb1a12
*/
/* First decrypt call found in
* https://android.googlesource.com/platform/frameworks/base/+/android-8.1.0_r18/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#135
* We will use https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java
* and https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java
* First we set some algorithm parameters as seen in two places:
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#297
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#216 */
// When using secdis (aka not weaver) you must supply an auth token to the keystore prior to the begin operation
if (auth_token_len > 0) {
/*::keystore::KeyStoreServiceReturnCode auth_result = service->addAuthToken(auth_token, auth_token_len);
if (!auth_result.isOk()) {
// The keystore checks the uid of the calling process and will return a permission denied on this operation for user 0
printf("keystore error adding auth token\n");
return disk_decryption_secret_key;
}*/
// The keystore refuses to allow the root user to supply auth tokens, so we write the auth token to a file earlier and
// run a separate service that runs user the system user to add the auth token. We wait for the auth token file to be
// deleted by the keymaster_auth service and check for a /auth_error file in case of errors. We quit after after a while if
// the /auth_token file never gets deleted.
int auth_wait_count = 20;
while (access("/auth_token", F_OK) == 0 && auth_wait_count-- > 0)
usleep(5000);
if (auth_wait_count == 0 || access("/auth_error", F_OK) == 0) {
printf("error during keymaster_auth service\n");
/* If you are getting this error, make sure that you have the keymaster_auth service defined in your init scripts, preferrably in init.recovery.{ro.hardware}.rc
* service keystore_auth /sbin/keystore_auth
* disabled
* oneshot
* user system
* group root
* seclabel u:r:recovery:s0
*
* And check dmesg for error codes regarding this service if needed. */
return disk_decryption_secret_key;
}
}
int32_t ret;
size_t maclen = 128;
unsigned char* iv = (unsigned char*)byteptr; // The IV is the first 12 bytes of the spblob
::keystore::hidl_vec<uint8_t> iv_hidlvec;
iv_hidlvec.setToExternal((unsigned char*)byteptr, 12);
//printf("iv: "); output_hex((const unsigned char*)iv, 12); printf("\n");
unsigned char* cipher_text = (unsigned char*)byteptr + 12; // The cipher text comes immediately after the IV
::keystore::hidl_vec<uint8_t> cipher_text_hidlvec;
cipher_text_hidlvec.setToExternal(cipher_text, spblob_data.size() - 14 /* 1 each for version and SYNTHETIC_PASSWORD_PASSWORD_BASED and 12 for the iv */);
::keystore::AuthorizationSetBuilder begin_params;
begin_params.Authorization(::keystore::TAG_ALGORITHM, ::keystore::Algorithm::AES);
begin_params.Authorization(::keystore::TAG_BLOCK_MODE, ::keystore::BlockMode::GCM);
begin_params.Padding(::keystore::PaddingMode::NONE);
begin_params.Authorization(::keystore::TAG_NONCE, iv_hidlvec);
begin_params.Authorization(::keystore::TAG_MAC_LENGTH, maclen);
::keystore::hidl_vec<uint8_t> entropy; // No entropy is needed for decrypt
entropy.resize(0);
std::string keystore_alias = mKey_Prefix;
keystore_alias += keystore_alias_subid;
String16 keystore_alias16(keystore_alias.c_str());
#ifdef USE_KEYSTORAGE_4
android::hardware::keymaster::V4_0::KeyPurpose purpose = android::hardware::keymaster::V4_0::KeyPurpose::DECRYPT;
security::keymaster::OperationResult begin_result;
security::keymaster::OperationResult update_result;
security::keymaster::OperationResult finish_result;
::android::security::keymaster::KeymasterArguments empty_params;
// These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63
service->begin(binder, keystore_alias16, (int32_t)purpose, true, android::security::keymaster::KeymasterArguments(begin_params.hidl_data()), entropy, -1, &begin_result);
#else
::keystore::KeyPurpose purpose = ::keystore::KeyPurpose::DECRYPT;
OperationResult begin_result;
OperationResult update_result;
OperationResult finish_result;
::keystore::hidl_vec<::keystore::KeyParameter> empty_params;
empty_params.resize(0);
// These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63
service->begin(binder, keystore_alias16, purpose, true, begin_params.hidl_data(), entropy, -1, &begin_result);
#endif
ret = begin_result.resultCode;
if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
printf("keystore begin error: (%d)\n", /*responses[ret],*/ ret);
return disk_decryption_secret_key;
} /*else {
printf("keystore begin operation successful\n");
}*/
// The cipher.doFinal call triggers an update to the keystore followed by a finish https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#64
// See also https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/KeyStoreCryptoOperationChunkedStreamer.java#208
service->update(begin_result.token, empty_params, cipher_text_hidlvec, &update_result);
ret = update_result.resultCode;
if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
printf("keystore update error: (%d)\n", /*responses[ret],*/ ret);
return disk_decryption_secret_key;
} /*else {
printf("keystore update operation successful\n");
printf("keystore update returned: "); output_hex(&update_result.data[0], update_result.data.size()); printf("\n"); // this ends up being the synthetic password
}*/
//printf("keystore resulting data: "); output_hex((unsigned char*)&update_result.data[0], update_result.data.size()); printf("\n");
// We must copy the data in update_data.data before we call finish below or the data will be gone
size_t keystore_result_size = update_result.data.size();
unsigned char* keystore_result = (unsigned char*)malloc(keystore_result_size);
if (!keystore_result) {
printf("malloc on keystore_result\n");
return disk_decryption_secret_key;
}
memcpy(keystore_result, &update_result.data[0], update_result.data.size());
//printf("keystore_result data: "); output_hex(keystore_result, keystore_result_size); printf("\n");
::keystore::hidl_vec<uint8_t> signature;
service->finish(begin_result.token, empty_params, signature, entropy, &finish_result);
ret = finish_result.resultCode;
if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
printf("keystore finish error: (%d)\n", /*responses[ret],*/ ret);
free(keystore_result);
return disk_decryption_secret_key;
} /*else {
printf("keystore finish operation successful\n");
}*/
stop_keystore();
/* Now we do the second decrypt call as seen in:
* https://android.googlesource.com/platform/frameworks/base/+/android-8.1.0_r18/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#136
*/
const unsigned char* intermediate_iv = keystore_result;
//printf("intermediate_iv: "); output_hex((const unsigned char*)intermediate_iv, 12); printf("\n");
const unsigned char* intermediate_cipher_text = (const unsigned char*)keystore_result + 12; // The cipher text comes immediately after the IV
int cipher_size = keystore_result_size - 12;
//printf("intermediate_cipher_text: "); output_hex((const unsigned char*)intermediate_cipher_text, cipher_size); printf("\n");
// First we personalize as seen https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#102
void* personalized_application_id = PersonalizedHashBinary(PERSONALISATION_APPLICATION_ID, (const char*)application_id, application_id_size);
if (!personalized_application_id) {
printf("malloc personalized_application_id\n");
free(keystore_result);
return disk_decryption_secret_key;
}
//printf("personalized application id: "); output_hex((unsigned char*)personalized_application_id, SHA512_DIGEST_LENGTH); printf("\n");
// Now we'll decrypt using openssl AES/GCM/NoPadding
OpenSSL_add_all_ciphers();
int actual_size=0, final_size=0;
EVP_CIPHER_CTX *d_ctx = EVP_CIPHER_CTX_new();
const unsigned char* key = (const unsigned char*)personalized_application_id; // The key is the now personalized copy of the application ID
//printf("key: "); output_hex((const unsigned char*)key, 32); printf("\n");
EVP_DecryptInit(d_ctx, EVP_aes_256_gcm(), key, intermediate_iv);
unsigned char* secret_key = (unsigned char*)malloc(cipher_size);
EVP_DecryptUpdate(d_ctx, secret_key, &actual_size, intermediate_cipher_text, cipher_size);
unsigned char tag[AES_BLOCK_SIZE];
EVP_CIPHER_CTX_ctrl(d_ctx, EVP_CTRL_GCM_SET_TAG, 16, tag);
EVP_DecryptFinal_ex(d_ctx, secret_key + actual_size, &final_size);
EVP_CIPHER_CTX_free(d_ctx);
free(personalized_application_id);
free(keystore_result);
int secret_key_real_size = actual_size - 16;
//printf("secret key: "); output_hex((const unsigned char*)secret_key, secret_key_real_size); printf("\n");
// The payload data from the keystore update is further personalized at https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#153
// We now have the disk decryption key!
if (*synthetic_password_version == SYNTHETIC_PASSWORD_VERSION_V3) {
// V3 uses SP800 instead of SHA512
disk_decryption_secret_key = PersonalizedHashSP800(PERSONALIZATION_FBE_KEY, PERSONALISATION_CONTEXT, (const char*)secret_key, secret_key_real_size);
} else {
disk_decryption_secret_key = PersonalizedHash(PERSONALIZATION_FBE_KEY, (const char*)secret_key, secret_key_real_size);
}
//printf("disk_decryption_secret_key: '%s'\n", disk_decryption_secret_key.c_str());
free(secret_key);
return disk_decryption_secret_key;
}
return disk_decryption_secret_key;
}
}}
#define PASSWORD_TOKEN_SIZE 32
/* C++ replacement for
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#992
* called here
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#813 */
bool Get_Secdis(const std::string& spblob_path, const std::string& handle_str, std::string& secdis_data) {
std::string secdis_file = spblob_path + handle_str + ".secdis";
if (!android::base::ReadFileToString(secdis_file, &secdis_data)) {
printf("Failed to read '%s'\n", secdis_file.c_str());
return false;
}
//output_hex(secdis_data.data(), secdis_data.size());printf("\n");
return true;
}
// C++ replacement for https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#1033
userid_t fakeUid(const userid_t uid) {
return 100000 + uid;
}
bool Is_Weaver(const std::string& spblob_path, const std::string& handle_str) {
std::string weaver_file = spblob_path + handle_str + ".weaver";
struct stat st;
if (stat(weaver_file.c_str(), &st) == 0)
return true;
return false;
}
bool Free_Return(bool retval, void* weaver_key, password_data_struct* pwd) {
if (weaver_key)
free(weaver_key);
if (pwd->salt)
free(pwd->salt);
if (pwd->password_handle)
free(pwd->password_handle);
return retval;
}
/* Decrypt_User_Synth_Pass is the TWRP C++ equivalent to spBasedDoVerifyCredential
* https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/LockSettingsService.java#1998 */
bool Decrypt_User_Synth_Pass(const userid_t user_id, const std::string& Password) {
bool retval = false;
void* weaver_key = NULL;
password_data_struct pwd;
pwd.salt = NULL;
pwd.salt_len = 0;
pwd.password_handle = NULL;
pwd.handle_len = 0;
char application_id[PASSWORD_TOKEN_SIZE + SHA512_DIGEST_LENGTH];
uint32_t auth_token_len = 0;
std::string secret; // this will be the disk decryption key that is sent to vold
std::string token = "!"; // there is no token used for this kind of decrypt, key escrow is handled by weaver
int flags = FLAG_STORAGE_DE;
if (user_id == 0)
flags = FLAG_STORAGE_DE;
else
flags = FLAG_STORAGE_CE;
char spblob_path_char[PATH_MAX];