encrypted_volume_support.cpp

Go to the documentation of this file.

#include "encrypted_volume_support.hpp"
#include "i18n.hpp"
 
#include <array>
#include <set>
#include <sstream>
#include <string>
#include <vector>
 
namespace {
uint16_t be16(const unsigned char* p) {
    return (static_cast<uint16_t>(p[0]) << 8) | static_cast<uint16_t>(p[1]);
}
 
uint16_t le16(const unsigned char* p) {
    return static_cast<uint16_t>(p[0]) | (static_cast<uint16_t>(p[1]) << 8);
}
 
uint32_t le32(const unsigned char* p) {
    return static_cast<uint32_t>(p[0]) |
           (static_cast<uint32_t>(p[1]) << 8) |
           (static_cast<uint32_t>(p[2]) << 16) |
           (static_cast<uint32_t>(p[3]) << 24);
}
 
uint64_t le64(const unsigned char* p) {
    return static_cast<uint64_t>(p[0]) |
           (static_cast<uint64_t>(p[1]) << 8) |
           (static_cast<uint64_t>(p[2]) << 16) |
           (static_cast<uint64_t>(p[3]) << 24) |
           (static_cast<uint64_t>(p[4]) << 32) |
           (static_cast<uint64_t>(p[5]) << 40) |
           (static_cast<uint64_t>(p[6]) << 48) |
           (static_cast<uint64_t>(p[7]) << 56);
}
 
bool read_bytes(DiskReader& reader, uint64_t offset, void* buffer, size_t len) {
    return reader.read_at(offset, buffer, len);
}
 
ScanResult luks_probe(DiskReader& reader, uint64_t offset) {
    std::array<unsigned char, 4096> hdr{};
    if (!read_bytes(reader, offset, hdr.data(), hdr.size())) return {};
    if (!(hdr[0] == 'L' && hdr[1] == 'U' && hdr[2] == 'K' && hdr[3] == 'S' && hdr[4] == 0xBA && hdr[5] == 0xBE)) {
        return {};
    }
 
    const uint16_t version = be16(hdr.data() + 6);
    std::ostringstream detail;
    uint64_t payload_offset = 0;
    if (version == 1) {
        const uint32_t payload_sectors = le32(hdr.data() + 104);
        payload_offset = static_cast<uint64_t>(payload_sectors) * 512ull;
        detail << "LUKS1, payload offset: " << payload_offset << " bytes";
    } else if (version == 2) {
        // We intentionally avoid a full JSON parser here; this is enough to identify container geometry safely.
        const uint64_t hdr_size = le64(hdr.data() + 8);
        payload_offset = hdr_size >= 4096 ? hdr_size * 2ull : (16ull * 1024 * 1024);
        detail << "LUKS2, metadata area: " << hdr_size << " bytes, estimated payload offset: " << payload_offset << " bytes";
    } else {
        detail << "LUKS version " << version;
    }
    detail << ", encrypted container detected (data recovery requires passphrase/key material or an already unlocked mapper device)";
 
    return {ResultKind::FilesystemVolume,
            offset,
            reader.size() > offset ? (reader.size() - offset) : 0,
            version == 2 ? "LUKS2 container" : "LUKS1 container",
            "Encrypted volume probe",
            detail.str(),
            0.98};
}
 
ScanResult bitlocker_probe(DiskReader& reader, uint64_t offset) {
    std::array<unsigned char, 512> sector{};
    if (!read_bytes(reader, offset, sector.data(), sector.size())) return {};
 
    const std::string oem(reinterpret_cast<const char*>(sector.data() + 3), 8);
    const std::string fve(reinterpret_cast<const char*>(sector.data() + 0x03), 11);
    const bool has_fvefs = oem == "-FVE-FS-" || fve.find("FVE-FS") != std::string::npos;
    if (!has_fvefs) return {};
 
    std::ostringstream detail;
    detail << "BitLocker/FVE metadata detected";
    const uint16_t bps = le16(sector.data() + 11);
    const uint8_t spc = sector[13];
    if (bps != 0 && spc != 0) {
        detail << ", bytes/sector: " << bps << ", sectors/cluster: " << static_cast<unsigned>(spc);
    }
    detail << ", encrypted container detected (data recovery requires recovery key/password or an already unlocked device)";
 
    return {ResultKind::FilesystemVolume,
            offset,
            reader.size() > offset ? (reader.size() - offset) : 0,
            "BitLocker volume",
            "Encrypted volume probe",
            detail.str(),
            0.97};
}
}
 
std::vector<ScanResult> EncryptedVolumeSupport::probe(DiskReader& reader,
                                                      const std::vector<ScanResult>& seed_results,
                                                      std::vector<std::string>& logs) {
    std::vector<ScanResult> out;
    std::set<uint64_t> seen_offsets;
    logs.push_back(trs("Encrypted volume probes: analysis started."));
 
    for (const auto& seed : seed_results) {
        const bool interesting_seed =
            seed.kind == ResultKind::Partition ||
            seed.kind == ResultKind::LostPartitionCandidate ||
            seed.kind == ResultKind::FilesystemCandidate ||
            seed.kind == ResultKind::FilesystemVolume ||
            seed.kind == ResultKind::NtfsVolume;
        if (!interesting_seed || seen_offsets.count(seed.offset_bytes) != 0) continue;
        seen_offsets.insert(seed.offset_bytes);
 
        if (auto r = luks_probe(reader, seed.offset_bytes); !r.type.empty()) out.push_back(r);
        if (auto r = bitlocker_probe(reader, seed.offset_bytes); !r.type.empty()) out.push_back(r);
    }
 
    // Also probe the whole source offset 0 for raw encrypted-device headers.
    if (seen_offsets.insert(0).second) {
        if (auto r = luks_probe(reader, 0); !r.type.empty()) out.push_back(r);
        if (auto r = bitlocker_probe(reader, 0); !r.type.empty()) out.push_back(r);
    }
 
    logs.push_back(trs("Encrypted volume probes: analysis completed."));
    return out;
}
 
bool EncryptedVolumeSupport::collect_detected_containers(const ScanReport& report,
                                                         std::vector<EncryptedContainerInfo>& out) {
    out.clear();
    for (const auto& r : report.results) {
        EncryptedContainerInfo info;
        if (r.type == "LUKS1 container") info.scheme = "LUKS1";
        else if (r.type == "LUKS2 container") info.scheme = "LUKS2";
        else if (r.type == "BitLocker volume") info.scheme = "BitLocker";
        else continue;
        info.offset_bytes = r.offset_bytes;
        info.size_bytes = r.size_bytes;
        info.detail = r.detail;
        // Best-effort payload offset extraction from detail string.
        const std::string needle = "payload offset: ";
        const auto pos = r.detail.find(needle);
        if (pos != std::string::npos) {
            const auto start = pos + needle.size();
            const auto end = r.detail.find(' ', start);
            try {
                info.payload_offset_bytes = std::stoull(r.detail.substr(start, end - start));
            } catch (...) {
                info.payload_offset_bytes = 0;
            }
        }
        out.push_back(info);
    }
    return !out.empty();
}