partitionhider

Dangerous and risky bash scripts to conceal and recover partitions using literal writes to MBR
git clone git://git.defalsify.org/partitionhider.git
Log | Files | Refs | README | LICENSE

commit 7f7abfcc42d7b62b82d39523183ec9b0d95910ff
parent ec5727b595c87a7299207009f7c3b50a5fccbaa5
Author: nolash <dev@holbrook.no>
Date:   Tue, 24 Apr 2018 19:48:17 +0200

fix r.sh missing input param

Diffstat:
Mmbr-decrypt-and-hide/r.sh | 142++++++++++++-------------------------------------------------------------------
Dmbr-decrypt-and-hide/r2.sh | 37-------------------------------------
2 files changed, 21 insertions(+), 158 deletions(-)

diff --git a/mbr-decrypt-and-hide/r.sh b/mbr-decrypt-and-hide/r.sh @@ -1,137 +1,37 @@ -#!/bin/bash +#!/bin/bash -which ccrypt 2> /dev/null || exit 2 -which blockdev 2> /dev/null || exit 2 -which hexdump 2> /dev/null || exit 2 - -DEV=$1 -PART=$2 - -tmpdir=`mktemp -d` -if [ $? != 0 ]; then - exit 3 -fi - -mbroffset=$((446+(($PART-1)*16))) - -sizehex=`hexdump -e '1/4 "%08x"' -s$((mbroffset+8)) -n4 $DEV` -echo $sizehex -OFFSET=`printf "%d" 0x$sizehex` -OFFSET_DATA=$(($OFFSET+1000)) - -insize=`blockdev --getsize64 $DEV$PART` -if [ $? != 0 ]; then - exit 4 -fi -secsize=`blockdev --getss $DEV` -if [ $? != 0 ]; then +read dev part secsize dataoffset size pass < data +if [ -z $dev ] || [ -z $part ] || [ -z $secsize ] || [ -z $dataoffset ] || [ -z $size ] || [ -z $pass ]; then exit 4 fi -outbytesoffset=$(($secsize*$OFFSET)) - -echo "mbroffset $mbroffset" -# ccrypt prepends a magic number of 32 bytes at start of file -insize=$((insize+32)) - -cat <<EOF -*** WARNING WARNING WARNING *** - -This will write $(($insize+(4*$secsize))) bytes on $DEV at sector offset $OFFSET (byte $outbytesoffset) -Any existing data will be destroyed! - -It will also overwrite the partition entry for $DEV$PART - -EOF - -read -p "proceed? (type uppercase YES): " confirm -if [ -z "$confirm" ] || [ $confirm != "YES" ]; then - echo "aborted" - exit 1 -fi -read -sp "encryption password: " pass -echo -echo $pass > ${tmpdir}/.pass - -echo using tmpdir ${tmpdir} -echo "dumping data..." -dd if=$DEV$PART of=${tmpdir}/foo -if [ $? != 0 ]; then - exit 5 -fi - -echo "encrypting data..." -ccrypt ${tmpdir}/foo -k ${tmpdir}/.pass +secsize=`blockdev --getss $dev` if [ $? != 0 ]; then - exit 6 + exit 2 fi -# TODO: check if its on a boundary - -echo "writing data..." -dd if=$DEV of=$DEV skip=$mbroffset seek=$((($secsize*$OFFSET_DATA)+32)) bs=1 count=16 -dd if=${tmpdir}/foo.cpt of=$DEV seek=$((($secsize*$OFFSET_DATA)+16+32)) oflag=seek_bytes -if [ $? != 0 ]; then - exit 7 -fi - -shred ${tmpdir}/foo.cpt - -# create a file fs to write the encrypted scripts to -mkdir ${tmpdir}/mnt -dd if=/dev/zero of=${tmpdir}/scripts_blocks bs=$secsize count=1000 -if [ $? != 0 ]; then - exit 8 -fi - -mkfs.ext4 ${tmpdir}/scripts_blocks -if [ $? != 0 ]; then - exit 9 -fi - -mount ${tmpdir}/scripts_blocks ${tmpdir}/mnt +tmpdir=`mktemp -d` if [ $? != 0 ]; then - exit 10 + exit 3 fi -# create a tar of the scripts -cp w.sh r.sh ${tmpdir}/mnt -if [ $? != 0 ]; then - exit 11 -fi -cat <<eof > ${tmpdir}/mnt/data -$DEV $PART $secsize $((($secsize*$OFFSET_DATA)+32)) $insize $pass -eof +mbroffset=$((446+(($part-1)*16))) -umount ${tmpdir}/mnt -if [ $? != 0 ]; then - exit 12 -fi +echo inoffset is $dataoffset +echo $pass > ${tmpdir}/.pass +sizehex=`hexdump -e '1/4 "%08x"' -s$((dataoffset+8)) -n4 $dev` +offset=`printf "%d" 0x$sizehex` -# encrypt the scripts -ccrypt ${tmpdir}/scripts_blocks -k ${tmpdir}/.pass -if [ $? != 0 ]; then - exit 13 -fi -dd if=${tmpdir}/scripts_blocks.cpt of=$DEV seek=$OFFSET -if [ $? != 0 ]; then - exit 14 -fi +dd if=$dev of=$dev skip=$((($offset*512)+512032)) bs=1 count=16 seek=$mbroffset +dd if=$dev skip=$((dataoffset+16)) bs=1 count=$size | ccrypt -d -c -k ${tmpdir}/.pass > ${tmpdir}/part +dd if=${tmpdir}/part of=$dev seek=$offset -shred ${tmpdir}/.pass -shred ${tmpdir}/scripts_blocks.cpt -rm ${tmpdir} -rf +shred data +rm data -echo "removing partition entry" -dd if=/dev/zero of=$DEV seek=$mbroffset bs=1 count=16 -if [ $? != 0 ]; then - exit 15 +read -p "Please tell me where to copy the scripts (empty for no copy): " path +if [ -z $path ]; then + exit 0 fi -read -p "Remove script files? (type uppercase YES):" y -if [ $y == "YES" ]; then - `shred w.sh` - `shred r.sh` - `rm -v w.sh` - `rm -v r.sh` -fi +cp -v w.sh r.sh $path diff --git a/mbr-decrypt-and-hide/r2.sh b/mbr-decrypt-and-hide/r2.sh @@ -1,37 +0,0 @@ -#!/bin/bash - -read dev part dataoffset size pass < data -if [ -z $dev ] || [ -z $part ] || [ -z $dataoffset ] || [ -z $size ] || [ -z $pass ]; then - exit 4 -fi - -secsize=`blockdev --getss $dev` -if [ $? != 0 ]; then - exit 2 -fi - -tmpdir=`mktemp -d` -if [ $? != 0 ]; then - exit 3 -fi - -mbroffset=$((446+(($part-1)*16))) - -echo inoffset is $dataoffset -echo $pass > ${tmpdir}/.pass -sizehex=`hexdump -e '1/4 "%08x"' -s$((dataoffset+8)) -n4 $dev` -offset=`printf "%d" 0x$sizehex` - -dd if=$dev of=$dev skip=$((($offset*512)+512032)) bs=1 count=16 seek=$mbroffset -dd if=$dev skip=$((dataoffset+16)) bs=1 count=$size | ccrypt -d -c -k ${tmpdir}/.pass > ${tmpdir}/part -dd if=${tmpdir}/part of=$dev seek=$offset - -shred data -rm data - -read -p "Please tell me where to copy the scripts (empty for no copy): " path -if [ -z path ]; then - exit 0 -fi - -cp -v w.sh r.sh $path