Phone won't accept decryption (FDE) password anymore.

Search This thread

htcuser311

New member
Sep 3, 2017
3
0
My device: HTC One M7 Android 4.2.2, S-ON, Root, CWM recovery (years old version)
My ultimate goal was: Get xposed framework. Install via app failed after rebooting due to S-ON, so I wanted to install through recovery. (this is irrelevant to the issue IMO)
What I tried to get there: Decrypting my /data partition in adb (because CWM doesn't support it)
What I found: https : // forumDOTfairphoneDOTcom/t/how-to-mount-encrypted-data-in-recovery/25724

Everything(!) I actually did: (commands after $ means executed on host machine (ubuntu), prefixed by ~ # means run on phone in adb shell)

$ adb shell
~ # setprop ro.crypto.state encrypted
~ # vdc cryptfs checkpw "<wrong password>"
200 0 1
~ # mount /dev/block/dm-0 /data
mount: mounting /dev/block/dm-0 on /data failed: no such file or directory
(( a couple commands like ls and cat to find out what my /data partition should be ))
(( ended up finding out in fstab that it's mmcblk0p37 ))
~ # mount /dev/block/mmcblk0p27 ((accidentally wrong one))
mount: mounting /dev/block/mmcblk0p27 on /data failed: Invalid argument
~ # mount /dev/block/mmcblk0p37
mount: mounting /dev/block/mmcblk0p37 on /data failed: Invalid argument
(( notice i entered wrong password ))
~ # vdc cryptfs checkpw "<right password>"
200 0 2
~ # mount /dev/block/mmcblk0p37
mount: mounting /dev/block/mmcblk0p37 on /data failed: Invalid argument
(( a couple more tried of the previous two commands for no legit reason ))
~ # mount -o rw,remount /dev/block/mmcblk0p37
mount: mounting /dev/block/mmcblk0p37 on /data failed: Invalid argument
(( exit adb shell ))
(( execute $ adb remount )) (( as google suggested (on host machine, not in adb shell obv) ))
$ adb shell
~ # mount -t ext2 /dev/block/mmcblk0p37 (( accidentally wrong fstype ))
mount: mounting /dev/block/mmcblk0p37 on /data failed: Invalid argument
~ # mount -t ext4 /dev/block/mmcblk0p37
mount: mounting /dev/block/mmcblk0p37 on /data failed: Invalid argument
~ # mount -t ext4 /dev/block/mmcblk0p27 (( why not? ))
mount: mounting /dev/block/mmcblk0p37 on /data failed: Invalid argument
~ # exit (( i got frustrated ))


Before I did all this the phone was working normally (after install xposed via app (which gave me xposed version 3x because I had that one previously installed via receovery. But I wanted the newest (5x) so I went all that way)). After I did all these steps - which to me are readonly things which shouldn't brick anything - I got frustrated and wanted to give up, so I rebooted. Now everytime I enter the - 100% correct - password, it tells me to "try again" (guessing it means wrong password? idk).

The whole xposed stuff is irrelevant in my opinion, because after I've installed it using the xposed installer (APK) I rebooted twice and decryption worked fine both times.

What the hell have I done (I'd say I'm a linux expert and I honestly don't see how I could've possible broken anything by what I did) and how can I fix it?
 

htcuser311

New member
Sep 3, 2017
3
0
UPDATE: I got myself the cryptheader from the "extra" partition using the read_emmc vulnerability. That way I got the encrypted key and salt. (cryptheader)
I then used this and a modified bruteforce script to check if my right password is still right. Result: It doesn't seem so.
My password contained special characters and was 15 chars long, bruteforce is not an option.

Is there anyway what I did could've changed the password? If so, can I reproduce and get the new key somehow? The cryptheader is not corrupted and still intact. The /data partition (encrypted) is not corrupted and still intact. (I assume this because the encrypted partition's hexdump starts with "This is an encrypted partition:)", which is a HTC easter egg.)
 

alray

Inactive Recognized Contributor
May 22, 2012
8,932
3,593
UPDATE: I got myself the cryptheader from the "extra" partition using the read_emmc vulnerability. That way I got the encrypted key and salt. (cryptheader)
I then used this and a modified bruteforce script to check if my right password is still right. Result: It doesn't seem so.
My password contained special characters and was 15 chars long, bruteforce is not an option.

Is there anyway what I did could've changed the password? If so, can I reproduce and get the new key somehow? The cryptheader is not corrupted and still intact. The /data partition (encrypted) is not corrupted and still intact. (I assume this because the encrypted partition's hexdump starts with "This is an encrypted partition:)", which is a HTC easter egg.)

I'm far from being a linux expert but the simplest would be to factory reset using htc's recovery to remove /data encryption and start from scratch (unless you have some really important data that must be saved from your /data partition)
 

htcuser311

New member
Sep 3, 2017
3
0
I'm far from being a linux expert but the simplest would be to factory reset using htc's recovery to remove /data encryption and start from scratch (unless you have some really important data that must be saved from your /data partition)

I have decided to give up on trying and did a "factory reset" (formatted /data and /data/sdcard through CWM, rebooted, set up device for first use, formatted /data again through CWM to result in clean system).

Fun-fact: Before I did what bricked the system I actually made a backup. The device (µSD-Card) decided to go corrupted filesystem though. I managed to recover most of the files but the /system partition backup (which might have saved me) remained corrupted. I was able to restore all my personal data though, so doing a factory reset wasn't that bad for me.