macmade/FileVaultCracker

No progress

Closed this issue · 12 comments

Hello,
I tested your app, but no luck so far. (I run the latest OS X)
When clicking on "mount filevault volume" the process begins, but nothing happens: no advancement and pwd/sec stays 0. Changing wordlist or changing some options/threads does not change anything.

When clicking on "stop" the app will not quit, but stays forever in the status "quitting".

I need to go back to this version (commit10) in order to have a "working" app. This means, the app does its work but does not find the pwd wich was in the wordlist due to AKS error

B

Thanks for the report... The commit you are mentioning is a non-functional one.
The cracker was incomplete yet.

Can you try to reboot your computer, and try with only one thread?
AKS is sometimes a PITA...

I tried what you suggested. It didn't resolve the issue.

bikr commented

I am getting the 0% no progress

Target Disk Mode to the target Running this from High Sierra.
Tried 1 thread. Same. Never goes past 0% .

Can you try with a debugger attached?

bikr commented

So it's been a while since I've dabbled in XCode. I can't seem to get any feedback in the console. Can you share how I can debug and provide what you need?

Here is a video of what I see when running (note this happens both with my word list and the default:
https://youtu.be/gX9eXEJ8xGc

Hey @macmade - I'm having the same issue as @bikr, this is what I saw in debugger:

objc[1856]: Class FIFinderSyncExtensionHost is implemented in both /System/Library/PrivateFrameworks/FinderKit.framework/Versions/A/FinderKit (0x7fff8fc3ec90) and /System/Library/PrivateFrameworks/FileProvider.framework/OverrideBundles/FinderSyncCollaborationFileProviderOverride.bundle/Contents/MacOS/FinderSyncCollaborationFileProviderOverride (0x10cb7ecd8). One of the two will be used. Which one is undefined.
2018-10-16 20:21:04.063353-0400 FileVaultCracker[1856:23963] MessageTracer: load_domain_whitelist_search_tree:73: Search tree file's format version number (0) is not supported
2018-10-16 20:21:04.063396-0400 FileVaultCracker[1856:23963] MessageTracer: Falling back to default whitelist
2018-10-16 20:21:04.478320-0400 FileVaultCracker[1856:24289] errors encountered while discovering extensions: Error Domain=PlugInKit Code=13 "query cancelled" UserInfo={NSLocalizedDescription=query cancelled}

Would be willing to pay you for your efforts to assist in debugging 🍺 🍺 👍

Please provide a full stacktrace for all threads.

I can’t help you otherwise since I can’t reproduce the issue.

Sure thing. The above errors happen when selecting a wordlist, not when the program actually hangs.

Here's a full stack trace from when it hangs:

* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
  * frame #0: 0x00007fff74e0e20a libsystem_kernel.dylib`mach_msg_trap + 10
    frame #1: 0x00007fff74e0d724 libsystem_kernel.dylib`mach_msg + 60
    frame #2: 0x00007fff4ce73785 CoreFoundation`__CFRunLoopServiceMachPort + 341
    frame #3: 0x00007fff4ce72ad7 CoreFoundation`__CFRunLoopRun + 1783
    frame #4: 0x00007fff4ce72153 CoreFoundation`CFRunLoopRunSpecific + 483
    frame #5: 0x00007fff4c15cd96 HIToolbox`RunCurrentEventLoopInMode + 286
    frame #6: 0x00007fff4c15cb06 HIToolbox`ReceiveNextEventCommon + 613
    frame #7: 0x00007fff4c15c884 HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 64
    frame #8: 0x00007fff4a40da73 AppKit`_DPSNextEvent + 2085
    frame #9: 0x00007fff4aba3e34 AppKit`-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 3044
    frame #10: 0x00007fff4a402885 AppKit`-[NSApplication run] + 764
    frame #11: 0x00007fff4a3d1a72 AppKit`NSApplicationMain + 804
    frame #12: 0x0000000100006c92 FileVaultCracker`main(argc=3, argv=0x00007ffeefbff550) at main.m:34
    frame #13: 0x00007fff74cc7015 libdyld.dylib`start + 1

  thread #7, name = 'com.apple.NSEventThread'
    frame #0: 0x00007fff74e0e20a libsystem_kernel.dylib`mach_msg_trap + 10
    frame #1: 0x00007fff74e0d724 libsystem_kernel.dylib`mach_msg + 60
    frame #2: 0x00007fff4ce73785 CoreFoundation`__CFRunLoopServiceMachPort + 341
    frame #3: 0x00007fff4ce72ad7 CoreFoundation`__CFRunLoopRun + 1783
    frame #4: 0x00007fff4ce72153 CoreFoundation`CFRunLoopRunSpecific + 483
    frame #5: 0x00007fff4a54afc4 AppKit`_NSEventThread + 184
    frame #6: 0x00000001003a9665 libsystem_pthread.dylib`_pthread_body + 340
    frame #7: 0x00000001003a9511 libsystem_pthread.dylib`_pthread_start + 377
    frame #8: 0x00000001003a8bfd libsystem_pthread.dylib`thread_start + 13

  thread #10
    frame #0: 0x00007fff74e1828a libsystem_kernel.dylib`__workq_kernreturn + 10
    frame #1: 0x00000001003a900d libsystem_pthread.dylib`_pthread_wqthread + 1035
    frame #2: 0x00000001003a8bed libsystem_pthread.dylib`start_wqthread + 13

  thread #15
    frame #0: 0x00000001003a8be0 libsystem_pthread.dylib`start_wqthread

  thread #17
    frame #0: 0x00007fff74e0e20a libsystem_kernel.dylib`mach_msg_trap + 10
    frame #1: 0x00007fff74e0d724 libsystem_kernel.dylib`mach_msg + 60
    frame #2: 0x00007fff4ce73785 CoreFoundation`__CFRunLoopServiceMachPort + 341
    frame #3: 0x00007fff4ce72ad7 CoreFoundation`__CFRunLoopRun + 1783
    frame #4: 0x00007fff4ce72153 CoreFoundation`CFRunLoopRunSpecific + 483
    frame #5: 0x00007fff4ceb0be3 CoreFoundation`CFRunLoopRun + 99
    frame #6: 0x000000010000a7f1 FileVaultCracker`-[CoreStorageHelper unlockLogicalVolumeUUID:withAKSUUID:](self=0x0000600000024940, _cmd="unlockLogicalVolumeUUID:withAKSUUID:", volumeUUID=@"820E68FC-3A9B-4646-AA26-1AC13959187F", aksUUID=@"37CACE88-1D06-4BB7-AC6C-C904246DA18E") at CoreStorageHelper.m:135
    frame #7: 0x0000000100008eb2 FileVaultCracker`-[FileVaultCracker crackPasswords:](self=0x000060800010bfd0, _cmd="crackPasswords:", passwords=@"290 elements") at FileVaultCracker.m:359
    frame #8: 0x00007fff4ef7d1f8 Foundation`__NSThread__start__ + 1197
    frame #9: 0x00000001003a9665 libsystem_pthread.dylib`_pthread_body + 340
    frame #10: 0x00000001003a9511 libsystem_pthread.dylib`_pthread_start + 377
    frame #11: 0x00000001003a8bfd libsystem_pthread.dylib`thread_start + 13

  thread #18
    frame #0: 0x00007fff74e1828a libsystem_kernel.dylib`__workq_kernreturn + 10
    frame #1: 0x00000001003a900d libsystem_pthread.dylib`_pthread_wqthread + 1035
    frame #2: 0x00000001003a8bed libsystem_pthread.dylib`start_wqthread + 13

It's breaking while running this code on line 135 in the CoreStorageHelper.m file (unlockLogicalVolumeUUID:withAKSUUID function):

CFRunLoopRun();

Digging deeper into the trace, the break happens on thread 17 in crackPasswords function in FileVaultCracker.m on line 359:

if( [ cs unlockLogicalVolumeUUID: volumeUUID withAKSUUID: ( __bridge NSString * )aks ] )

I was able to get the program to stop hanging by hardcoding in the UUID of the logical drive on line 133 in the CoreStorageHelper.m file (unlockLogicalVolumeUUID:withAKSUUID), overwriting what was originally there, but was then presented with the AKS dialogue. Additionally, there was no drive activity while the function was running, but I'm not sure if this all happens in memory.

Looking into the self _passwords var, there is an array of strings pulled from the wordlist, so I don't know if there was an issue or not with the file selector as previously mentioned.

OK, can you pull the latest changes and try again?

Yup, that solved the first issue as described by @bikr.

The AKS issue persists, however (even with fresh reboot and 1 thread selected)

Same stack trace?

Closing as no feedback.