blob: 3eeaaf87704336a54ed79c20fc1306d58b1c1025 [file] [log] [blame]
Ethan Yonkerbd7492d2016-12-07 13:55:01 -06001/*
2 * Copyright (C) 2016 The Team Win Recovery Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include "Decrypt.h"
Ethan Yonkere9afc3d2018-08-30 15:16:27 -050018#ifdef USE_KEYSTORAGE_4
19#include "Ext4CryptPie.h"
20#else
Ethan Yonkerbd7492d2016-12-07 13:55:01 -060021#include "Ext4Crypt.h"
Ethan Yonkere9afc3d2018-08-30 15:16:27 -050022#endif
Ethan Yonkerbd7492d2016-12-07 13:55:01 -060023
Ethan Yonker79f88bd2016-12-09 14:52:12 -060024#include <map>
Ethan Yonkerbd7492d2016-12-07 13:55:01 -060025#include <string>
26
27#include <errno.h>
28#include <stdio.h>
Ethan Yonker79f88bd2016-12-09 14:52:12 -060029#include <stdlib.h>
Ethan Yonkerbd7492d2016-12-07 13:55:01 -060030#include <sys/stat.h>
31#include <sys/types.h>
32
Ethan Yonkerfefe5912017-09-30 22:22:13 -050033#ifndef HAVE_LIBKEYUTILS
Ethan Yonkerbd7492d2016-12-07 13:55:01 -060034#include "key_control.h"
Ethan Yonkerfefe5912017-09-30 22:22:13 -050035#else
36#include <keyutils.h>
37#endif
Ethan Yonkerbd7492d2016-12-07 13:55:01 -060038
Ethan Yonkerfefe5912017-09-30 22:22:13 -050039#ifdef HAVE_SYNTH_PWD_SUPPORT
40#include "Weaver1.h"
41#include "cutils/properties.h"
42
43#include <openssl/sha.h>
44#include <openssl/aes.h>
45#include <openssl/evp.h>
46#include <openssl/rand.h>
47
48#include <dirent.h>
49#include <stdio.h>
50#include <stdint.h>
51#include <string.h>
52#include <sys/types.h>
53#include <fstream>
54
55#include <ext4_utils/ext4_crypt.h>
56
Ethan Yonkere9afc3d2018-08-30 15:16:27 -050057#ifdef USE_KEYSTORAGE_4
58#include <android/security/IKeystoreService.h>
59#else
Ethan Yonkerfefe5912017-09-30 22:22:13 -050060#include <keystore/IKeystoreService.h>
Ethan Yonkere9afc3d2018-08-30 15:16:27 -050061#include <keystore/authorization_set.h>
62#endif
Ethan Yonkerfefe5912017-09-30 22:22:13 -050063#include <binder/IPCThreadState.h>
64#include <binder/IServiceManager.h>
65
66#include <keystore/keystore.h>
Ethan Yonkerfefe5912017-09-30 22:22:13 -050067
68#include <algorithm>
69extern "C" {
70#include "crypto_scrypt.h"
71}
72#else
73#include "ext4_crypt.h"
74#endif //ifdef HAVE_SYNTH_PWD_SUPPORT
75
76#ifdef HAVE_GATEKEEPER1
77#include <android/hardware/gatekeeper/1.0/IGatekeeper.h>
78#else
Ethan Yonkerbd7492d2016-12-07 13:55:01 -060079#include <hardware/gatekeeper.h>
Ethan Yonkerfefe5912017-09-30 22:22:13 -050080#endif
Ethan Yonkerbd7492d2016-12-07 13:55:01 -060081#include "HashPassword.h"
82
83#include <android-base/file.h>
84
Ethan Yonker79f88bd2016-12-09 14:52:12 -060085// Store main DE raw ref / policy
86extern std::string de_raw_ref;
87extern std::map<userid_t, std::string> s_de_key_raw_refs;
88extern std::map<userid_t, std::string> s_ce_key_raw_refs;
89
90static bool lookup_ref_key_internal(std::map<userid_t, std::string>& key_map, const char* policy, userid_t* user_id) {
91 for (std::map<userid_t, std::string>::iterator it=key_map.begin(); it!=key_map.end(); ++it) {
92 if (strncmp(it->second.c_str(), policy, it->second.size()) == 0) {
93 *user_id = it->first;
94 return true;
95 }
96 }
97 return false;
98}
99
100extern "C" bool lookup_ref_key(const char* policy, char* policy_type) {
101 userid_t user_id = 0;
102 if (strncmp(de_raw_ref.c_str(), policy, de_raw_ref.size()) == 0) {
103 strcpy(policy_type, "1DK");
104 return true;
105 }
106 if (!lookup_ref_key_internal(s_de_key_raw_refs, policy, &user_id)) {
107 if (!lookup_ref_key_internal(s_ce_key_raw_refs, policy, &user_id)) {
108 return false;
109 } else
110 sprintf(policy_type, "1CE%d", user_id);
111 } else
112 sprintf(policy_type, "1DE%d", user_id);
113 return true;
114}
115
116extern "C" bool lookup_ref_tar(const char* policy_type, char* policy) {
117 if (strncmp(policy_type, "1", 1) != 0) {
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500118 printf("Unexpected version %c\n", policy_type[0]);
Ethan Yonker79f88bd2016-12-09 14:52:12 -0600119 return false;
120 }
121 const char* ptr = policy_type + 1; // skip past the version number
122 if (strncmp(ptr, "DK", 2) == 0) {
123 strncpy(policy, de_raw_ref.data(), de_raw_ref.size());
124 return true;
125 }
126 userid_t user_id = atoi(ptr + 2);
127 std::string raw_ref;
128 if (*ptr == 'D') {
129 if (lookup_key_ref(s_de_key_raw_refs, user_id, &raw_ref)) {
130 strncpy(policy, raw_ref.data(), raw_ref.size());
131 } else
132 return false;
133 } else if (*ptr == 'C') {
134 if (lookup_key_ref(s_ce_key_raw_refs, user_id, &raw_ref)) {
135 strncpy(policy, raw_ref.data(), raw_ref.size());
136 } else
137 return false;
138 } else {
139 printf("unknown policy type '%s'\n", policy_type);
140 return false;
141 }
142 return true;
143}
144
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500145#ifndef HAVE_GATEKEEPER1
Ethan Yonkerbd7492d2016-12-07 13:55:01 -0600146int gatekeeper_device_initialize(gatekeeper_device_t **dev) {
147 int ret;
148 const hw_module_t *mod;
149 ret = hw_get_module_by_class(GATEKEEPER_HARDWARE_MODULE_ID, NULL, &mod);
150
151 if (ret!=0) {
152 printf("failed to get hw module\n");
153 return ret;
154 }
155
156 ret = gatekeeper_open(mod, dev);
157
158 if (ret!=0)
159 printf("failed to open gatekeeper\n");
160 return ret;
161}
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500162#endif //ifndef HAVE_GATEKEEPER1
Ethan Yonkerbd7492d2016-12-07 13:55:01 -0600163
164bool Decrypt_DE() {
165 if (!e4crypt_initialize_global_de()) { // this deals with the overarching device encryption
166 printf("e4crypt_initialize_global_de returned fail\n");
167 return false;
168 }
169 if (!e4crypt_init_user0()) {
170 printf("e4crypt_init_user0 returned fail\n");
171 return false;
172 }
173 return true;
174}
175
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500176#ifdef HAVE_SYNTH_PWD_SUPPORT
177// Crappy functions for debugging, please ignore unless you need to debug
178/*void output_hex(const std::string& in) {
179 const char *buf = in.data();
180 char hex[in.size() * 2 + 1];
181 unsigned int index;
182 for (index = 0; index < in.size(); index++)
183 sprintf(&hex[2 * index], "%02X", buf[index]);
184 printf("%s", hex);
185}
186
187void output_hex(const char* buf, const int size) {
188 char hex[size * 2 + 1];
189 int index;
190 for (index = 0; index < size; index++)
191 sprintf(&hex[2 * index], "%02X", buf[index]);
192 printf("%s", hex);
193}
194
195void output_hex(const unsigned char* buf, const int size) {
196 char hex[size * 2 + 1];
197 int index;
198 for (index = 0; index < size; index++)
199 sprintf(&hex[2 * index], "%02X", buf[index]);
200 printf("%s", hex);
201}
202
203void output_hex(std::vector<uint8_t>* vec) {
204 char hex[3];
205 unsigned int index;
206 for (index = 0; index < vec->size(); index++) {
207 sprintf(&hex[0], "%02X", vec->at(index));
208 printf("%s", hex);
209 }
210}*/
211
212/* An alternative is to use:
213 * sqlite3 /data/system/locksettings.db "SELECT value FROM locksettings WHERE name='sp-handle' AND user=0;"
214 * but we really don't want to include the 1.1MB libsqlite in TWRP. We scan the spblob folder for the
215 * password data file (*.pwd) and get the handle from the filename instead. This is a replacement for
216 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/LockSettingsService.java#2017
217 * We never use this data as an actual long. We always use it as a string. */
218bool Find_Handle(const std::string& spblob_path, std::string& handle_str) {
219 DIR* dir = opendir(spblob_path.c_str());
220 if (!dir) {
221 printf("Error opening '%s'\n", spblob_path.c_str());
222 return false;
223 }
224
225 struct dirent* de = 0;
226
227 while ((de = readdir(dir)) != 0) {
228 if (strcmp(de->d_name, ".") == 0 || strcmp(de->d_name, "..") == 0)
229 continue;
230 size_t len = strlen(de->d_name);
231 if (len <= 4)
232 continue;
233 char* p = de->d_name;
234 p += len - 4;
235 if (strncmp(p, ".pwd", 4) == 0) {
236 handle_str = de->d_name;
237 handle_str = handle_str.substr(0, len - 4);
238 //*handle = strtoull(handle_str.c_str(), 0 , 16);
239 closedir(dir);
240 return true;
241 }
242 }
243 closedir(dir);
244 return false;
245}
246
247// The password data is stored in big endian and has to be swapped on little endian ARM
248template <class T>
249void endianswap(T *objp) {
250 unsigned char *memp = reinterpret_cast<unsigned char*>(objp);
251 std::reverse(memp, memp + sizeof(T));
252}
253
254/* This is the structure of the data in the password data (*.pwd) file which the structure can be found
255 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#187 */
256struct password_data_struct {
257 int password_type;
258 unsigned char scryptN;
259 unsigned char scryptR;
260 unsigned char scryptP;
261 int salt_len;
262 void* salt;
263 int handle_len;
264 void* password_handle;
265};
266
267/* C++ replacement for
268 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#764 */
269bool Get_Password_Data(const std::string& spblob_path, const std::string& handle_str, password_data_struct *pwd) {
270 std::string pwd_file = spblob_path + handle_str + ".pwd";
271 std::string pwd_data;
272 if (!android::base::ReadFileToString(pwd_file, &pwd_data)) {
273 printf("Failed to read '%s'\n", pwd_file.c_str());
274 return false;
275 }
276 //output_hex(pwd_data.data(), pwd_data.size());printf("\n");
277 const int* intptr = (const int*)pwd_data.data();
278 pwd->password_type = *intptr;
279 endianswap(&pwd->password_type);
280 //printf("password type %i\n", pwd->password_type); // 2 was PIN, 1 for pattern, 2 also for password, -1 for default password
281 const unsigned char* byteptr = (const unsigned char*)pwd_data.data() + sizeof(int);
282 pwd->scryptN = *byteptr;
283 byteptr++;
284 pwd->scryptR = *byteptr;
285 byteptr++;
286 pwd->scryptP = *byteptr;
287 byteptr++;
288 intptr = (const int*)byteptr;
289 pwd->salt_len = *intptr;
290 endianswap(&pwd->salt_len);
291 if (pwd->salt_len != 0) {
292 pwd->salt = malloc(pwd->salt_len);
293 if (!pwd->salt) {
294 printf("Get_Password_Data malloc salt\n");
295 return false;
296 }
297 memcpy(pwd->salt, intptr + 1, pwd->salt_len);
Ethan Yonkere131bec2017-12-15 23:48:02 -0600298 intptr++;
299 byteptr = (const unsigned char*)intptr;
300 byteptr += pwd->salt_len;
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500301 } else {
302 printf("Get_Password_Data salt_len is 0\n");
303 return false;
304 }
Ethan Yonkere131bec2017-12-15 23:48:02 -0600305 intptr = (const int*)byteptr;
306 pwd->handle_len = *intptr;
307 endianswap(&pwd->handle_len);
308 if (pwd->handle_len != 0) {
309 pwd->password_handle = malloc(pwd->handle_len);
310 if (!pwd->password_handle) {
311 printf("Get_Password_Data malloc password_handle\n");
312 return false;
313 }
314 memcpy(pwd->password_handle, intptr + 1, pwd->handle_len);
315 } else {
316 printf("Get_Password_Data handle_len is 0\n");
317 // Not an error if using weaver
318 }
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500319 return true;
320}
321
322/* C++ replacement for
323 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#765
324 * called here
325 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#1050 */
326bool Get_Password_Token(const password_data_struct *pwd, const std::string& Password, unsigned char* password_token) {
327 if (!password_token) {
328 printf("password_token is null\n");
329 return false;
330 }
331 unsigned int N = 1 << pwd->scryptN;
332 unsigned int r = 1 << pwd->scryptR;
333 unsigned int p = 1 << pwd->scryptP;
334 //printf("N %i r %i p %i\n", N, r, p);
335 int ret = crypto_scrypt(reinterpret_cast<const uint8_t*>(Password.data()), Password.size(),
336 reinterpret_cast<const uint8_t*>(pwd->salt), pwd->salt_len,
337 N, r, p,
338 password_token, 32);
339 if (ret != 0) {
340 printf("scrypt error\n");
341 return false;
342 }
343 return true;
344}
345
346// Data structure for the *.weaver file, see Get_Weaver_Data below
347struct weaver_data_struct {
348 unsigned char version;
349 int slot;
350};
351
352/* C++ replacement for
353 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#501
354 * called here
355 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#768 */
356bool Get_Weaver_Data(const std::string& spblob_path, const std::string& handle_str, weaver_data_struct *wd) {
357 std::string weaver_file = spblob_path + handle_str + ".weaver";
358 std::string weaver_data;
359 if (!android::base::ReadFileToString(weaver_file, &weaver_data)) {
360 printf("Failed to read '%s'\n", weaver_file.c_str());
361 return false;
362 }
363 //output_hex(weaver_data.data(), weaver_data.size());printf("\n");
364 const unsigned char* byteptr = (const unsigned char*)weaver_data.data();
365 wd->version = *byteptr;
366 //printf("weaver version %i\n", wd->version);
367 const int* intptr = (const int*)weaver_data.data() + sizeof(unsigned char);
368 wd->slot = *intptr;
369 //endianswap(&wd->slot); not needed
370 //printf("weaver slot %i\n", wd->slot);
371 return true;
372}
373
374namespace android {
375
376// On Android 8.0 for some reason init can't seem to completely stop keystore
377// so we have to kill it too if it doesn't die on its own.
378static void kill_keystore() {
379 DIR* dir = opendir("/proc");
380 if (dir) {
381 struct dirent* de = 0;
382
383 while ((de = readdir(dir)) != 0) {
384 if (strcmp(de->d_name, ".") == 0 || strcmp(de->d_name, "..") == 0)
385 continue;
386
387 int pid = -1;
388 int ret = sscanf(de->d_name, "%d", &pid);
389
390 if (ret == 1) {
391 char cmdpath[PATH_MAX];
392 sprintf(cmdpath, "/proc/%d/cmdline", pid);
393
394 FILE* file = fopen(cmdpath, "r");
395 size_t task_size = PATH_MAX;
396 char task[PATH_MAX];
397 char* p = task;
398 if (getline(&p, &task_size, file) > 0) {
399 if (strstr(task, "keystore") != 0) {
400 printf("keystore pid %d found, sending kill.\n", pid);
401 kill(pid, SIGINT);
402 usleep(5000);
403 kill(pid, SIGKILL);
404 }
405 }
406 fclose(file);
407 }
408 }
409 closedir(dir);
410 }
411}
412
413// The keystore holds a file open on /data so we have to stop / kill it
414// if we want to be able to unmount /data for things like formatting.
415static void stop_keystore() {
416 printf("Stopping keystore...\n");
417 property_set("ctl.stop", "keystore");
418 usleep(5000);
419 kill_keystore();
420}
421
422/* These next 2 functions try to get the keystore service 50 times because
423 * the keystore is not always ready when TWRP boots */
424sp<IBinder> getKeystoreBinder() {
425 sp<IServiceManager> sm = defaultServiceManager();
426 return sm->getService(String16("android.security.keystore"));
427}
428
429sp<IBinder> getKeystoreBinderRetry() {
430 printf("Starting keystore...\n");
431 property_set("ctl.start", "keystore");
432 int retry_count = 50;
433 sp<IBinder> binder = getKeystoreBinder();
434 while (binder == NULL && retry_count) {
435 printf("Waiting for keystore service... %i\n", retry_count--);
436 sleep(1);
437 binder = getKeystoreBinder();
438 }
439 return binder;
440}
441
442namespace keystore {
443
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600444#define SYNTHETIC_PASSWORD_VERSION_V1 1
445#define SYNTHETIC_PASSWORD_VERSION 2
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500446#define SYNTHETIC_PASSWORD_PASSWORD_BASED 0
447#define SYNTHETIC_PASSWORD_KEY_PREFIX "USRSKEY_synthetic_password_"
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500448#define USR_PRIVATE_KEY_PREFIX "USRPKEY_synthetic_password_"
449
450static std::string mKey_Prefix;
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500451
452/* The keystore alias subid is sometimes the same as the handle, but not always.
453 * In the case of handle 0c5303fd2010fe29, the alias subid used c5303fd2010fe29
454 * without the leading 0. We could try to parse the data from a previous
455 * keystore request, but I think this is an easier solution because there
456 * is little to no documentation on the format of data we get back from
457 * the keystore in this instance. We also want to copy everything to a temp
458 * folder so that any key upgrades that might take place do not actually
459 * upgrade the keys on the data partition. We rename all 1000 uid files to 0
460 * to pass the keystore permission checks. */
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500461bool Find_Keystore_Alias_SubID_And_Prep_Files(const userid_t user_id, std::string& keystoreid, const std::string& handle_str) {
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500462 char path_c[PATH_MAX];
463 sprintf(path_c, "/data/misc/keystore/user_%d", user_id);
464 char user_dir[PATH_MAX];
465 sprintf(user_dir, "user_%d", user_id);
466 std::string source_path = "/data/misc/keystore/";
467 source_path += user_dir;
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500468 std::string handle_sub = handle_str;
469 while (handle_sub.substr(0,1) == "0") {
470 std::string temp = handle_sub.substr(1);
471 handle_sub = temp;
472 }
473 mKey_Prefix = "";
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500474
475 mkdir("/tmp/misc", 0755);
476 mkdir("/tmp/misc/keystore", 0755);
477 std::string destination_path = "/tmp/misc/keystore/";
478 destination_path += user_dir;
479 if (mkdir(destination_path.c_str(), 0755) && errno != EEXIST) {
480 printf("failed to mkdir '%s' %s\n", destination_path.c_str(), strerror(errno));
481 return false;
482 }
483 destination_path += "/";
484
485 DIR* dir = opendir(source_path.c_str());
486 if (!dir) {
487 printf("Error opening '%s'\n", source_path.c_str());
488 return false;
489 }
490 source_path += "/";
491
492 struct dirent* de = 0;
493 size_t prefix_len = strlen(SYNTHETIC_PASSWORD_KEY_PREFIX);
494 bool found_subid = false;
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500495 bool has_pkey = false; // PKEY has priority over SKEY
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500496
497 while ((de = readdir(dir)) != 0) {
498 if (strcmp(de->d_name, ".") == 0 || strcmp(de->d_name, "..") == 0)
499 continue;
500 if (!found_subid) {
501 size_t len = strlen(de->d_name);
502 if (len <= prefix_len)
503 continue;
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500504 if (strstr(de->d_name, SYNTHETIC_PASSWORD_KEY_PREFIX) && !has_pkey)
505 mKey_Prefix = SYNTHETIC_PASSWORD_KEY_PREFIX;
506 else if (strstr(de->d_name, USR_PRIVATE_KEY_PREFIX)) {
507 mKey_Prefix = USR_PRIVATE_KEY_PREFIX;
508 has_pkey = true;
509 } else
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500510 continue;
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500511 if (strstr(de->d_name, handle_sub.c_str())) {
512 keystoreid = handle_sub;
513 printf("keystoreid matched handle_sub: '%s'\n", keystoreid.c_str());
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500514 found_subid = true;
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500515 } else {
516 std::string file = de->d_name;
517 std::size_t found = file.find_last_of("_");
518 if (found != std::string::npos) {
519 keystoreid = file.substr(found + 1);
520 printf("possible keystoreid: '%s'\n", keystoreid.c_str());
521 //found_subid = true; // we'll keep going in hopes that we find a pkey or a match to the handle_sub
522 }
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500523 }
524 }
525 std::string src = source_path;
526 src += de->d_name;
527 std::ifstream srcif(src.c_str(), std::ios::binary);
528 std::string dst = destination_path;
529 dst += de->d_name;
530 std::size_t source_uid = dst.find("1000");
531 if (source_uid != std::string::npos)
532 dst.replace(source_uid, 4, "0");
533 std::ofstream dstof(dst.c_str(), std::ios::binary);
534 printf("copying '%s' to '%s'\n", src.c_str(), dst.c_str());
535 dstof << srcif.rdbuf();
536 srcif.close();
537 dstof.close();
538 }
539 closedir(dir);
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500540 if (!found_subid && !mKey_Prefix.empty() && !keystoreid.empty())
541 found_subid = true;
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500542 return found_subid;
543}
544
545/* C++ replacement for function of the same name
546 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#867
547 * returning an empty string indicates an error */
Ethan Yonkere131bec2017-12-15 23:48:02 -0600548std::string unwrapSyntheticPasswordBlob(const std::string& spblob_path, const std::string& handle_str, const userid_t user_id, const void* application_id, const size_t application_id_size, uint32_t auth_token_len) {
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500549 std::string disk_decryption_secret_key = "";
550
551 std::string keystore_alias_subid;
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500552 if (!Find_Keystore_Alias_SubID_And_Prep_Files(user_id, keystore_alias_subid, handle_str)) {
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500553 printf("failed to scan keystore alias subid and prep keystore files\n");
554 return disk_decryption_secret_key;
555 }
556
557 // First get the keystore service
558 sp<IBinder> binder = getKeystoreBinderRetry();
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500559#ifdef USE_KEYSTORAGE_4
560 sp<security::IKeystoreService> service = interface_cast<security::IKeystoreService>(binder);
561#else
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500562 sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500563#endif
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500564 if (service == NULL) {
565 printf("error: could not connect to keystore service\n");
566 return disk_decryption_secret_key;
567 }
568
Ethan Yonkere131bec2017-12-15 23:48:02 -0600569 if (auth_token_len > 0) {
570 printf("Starting keystore_auth service...\n");
571 property_set("ctl.start", "keystore_auth");
572 }
573
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500574 // Read the data from the .spblob file per: https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#869
575 std::string spblob_file = spblob_path + handle_str + ".spblob";
576 std::string spblob_data;
577 if (!android::base::ReadFileToString(spblob_file, &spblob_data)) {
578 printf("Failed to read '%s'\n", spblob_file.c_str());
579 return disk_decryption_secret_key;
580 }
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600581 unsigned char* byteptr = (unsigned char*)spblob_data.data();
582 if (*byteptr != SYNTHETIC_PASSWORD_VERSION && *byteptr != SYNTHETIC_PASSWORD_VERSION_V1) {
583 printf("Unsupported synthetic password version %i\n", *byteptr);
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500584 return disk_decryption_secret_key;
585 }
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600586 const unsigned char* synthetic_password_version = byteptr;
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500587 byteptr++;
588 if (*byteptr != SYNTHETIC_PASSWORD_PASSWORD_BASED) {
589 printf("spblob data is not SYNTHETIC_PASSWORD_PASSWORD_BASED\n");
590 return disk_decryption_secret_key;
591 }
592 byteptr++; // Now we're pointing to the blob data itself
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600593 if (*synthetic_password_version == SYNTHETIC_PASSWORD_VERSION_V1) {
594 printf("spblob v1\n");
595 /* We're now going to handle decryptSPBlob: https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#115
596 * Called from https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#879
597 * This small function ends up being quite a headache. The call to get data from the keystore basically is not needed in TWRP at this time.
598 * The keystore data seems to be the serialized data from an entire class in Java. Specifically I think it represents:
599 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java
600 * or perhaps
601 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java
602 * but the only things we "need" from this keystore are a user ID and the keyAlias which ends up being USRSKEY_synthetic_password_{handle_str}
603 * the latter of which we already have. We may need to figure out how to get the user ID if we ever support decrypting mulitple users.
604 * There are 2 calls to a Java decrypt funcion that is overloaded. These 2 calls go in completely different directions despite the seemingly
605 * similar use of decrypt() and decrypt parameters. To figure out where things were going, I added logging to:
606 * https://android.googlesource.com/platform/libcore/+/android-8.0.0_r23/ojluni/src/main/java/javax/crypto/Cipher.java#2575
607 * Logger.global.severe("Cipher tryCombinations " + prov.getName() + " - " + prov.getInfo());
608 * To make logging work in libcore, import java.util.logging.Logger; and either set a better logging level or modify the framework to log everything
609 * regardless of logging level. This will give you some strings that you can grep for and find the actual crypto provider in use. In our case there were
610 * 2 different providers in use. The first stage to get the intermediate key used:
611 * https://android.googlesource.com/platform/external/conscrypt/+/android-8.0.0_r23/common/src/main/java/org/conscrypt/OpenSSLProvider.java
612 * which is a pretty straight-forward OpenSSL implementation of AES/GCM/NoPadding. */
613 // First we personalize as seen https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#102
614 void* personalized_application_id = PersonalizedHashBinary(PERSONALISATION_APPLICATION_ID, (const char*)application_id, application_id_size);
615 if (!personalized_application_id) {
616 printf("malloc personalized_application_id\n");
Ethan Yonkere131bec2017-12-15 23:48:02 -0600617 return disk_decryption_secret_key;
618 }
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600619 //printf("personalized application id: "); output_hex((unsigned char*)personalized_application_id, SHA512_DIGEST_LENGTH); printf("\n");
620 // Now we'll decrypt using openssl AES/GCM/NoPadding
621 OpenSSL_add_all_ciphers();
622 int actual_size=0, final_size=0;
623 EVP_CIPHER_CTX *d_ctx = EVP_CIPHER_CTX_new();
624 const unsigned char* iv = (const unsigned char*)byteptr; // The IV is the first 12 bytes of the spblob
625 //printf("iv: "); output_hex((const unsigned char*)iv, 12); printf("\n");
626 const unsigned char* cipher_text = (const unsigned char*)byteptr + 12; // The cipher text comes immediately after the IV
627 //printf("cipher_text: "); output_hex((const unsigned char*)cipher_text, spblob_data.size() - 2 - 12); printf("\n");
628 const unsigned char* key = (const unsigned char*)personalized_application_id; // The key is the now personalized copy of the application ID
629 //printf("key: "); output_hex((const unsigned char*)key, 32); printf("\n");
630 EVP_DecryptInit(d_ctx, EVP_aes_256_gcm(), key, iv);
631 std::vector<unsigned char> intermediate_key;
632 intermediate_key.resize(spblob_data.size() - 2 - 12, '\0');
633 EVP_DecryptUpdate(d_ctx, &intermediate_key[0], &actual_size, cipher_text, spblob_data.size() - 2 - 12);
634 unsigned char tag[AES_BLOCK_SIZE];
635 EVP_CIPHER_CTX_ctrl(d_ctx, EVP_CTRL_GCM_SET_TAG, 16, tag);
636 EVP_DecryptFinal_ex(d_ctx, &intermediate_key[actual_size], &final_size);
637 EVP_CIPHER_CTX_free(d_ctx);
638 free(personalized_application_id);
639 //printf("spblob_data size: %lu actual_size %i, final_size: %i\n", spblob_data.size(), actual_size, final_size);
640 intermediate_key.resize(actual_size + final_size - 16, '\0');// not sure why we have to trim the size by 16 as I don't see where this is done in Java side
641 //printf("intermediate key: "); output_hex((const unsigned char*)intermediate_key.data(), intermediate_key.size()); printf("\n");
642
643 // When using secdis (aka not weaver) you must supply an auth token to the keystore prior to the begin operation
644 if (auth_token_len > 0) {
645 /*::keystore::KeyStoreServiceReturnCode auth_result = service->addAuthToken(auth_token, auth_token_len);
646 if (!auth_result.isOk()) {
647 // The keystore checks the uid of the calling process and will return a permission denied on this operation for user 0
648 printf("keystore error adding auth token\n");
649 return disk_decryption_secret_key;
650 }*/
651 // The keystore refuses to allow the root user to supply auth tokens, so we write the auth token to a file earlier and
652 // run a separate service that runs user the system user to add the auth token. We wait for the auth token file to be
653 // deleted by the keymaster_auth service and check for a /auth_error file in case of errors. We quit after after a while if
654 // the /auth_token file never gets deleted.
655 int auth_wait_count = 20;
656 while (access("/auth_token", F_OK) == 0 && auth_wait_count-- > 0)
657 usleep(5000);
658 if (auth_wait_count == 0 || access("/auth_error", F_OK) == 0) {
659 printf("error during keymaster_auth service\n");
660 /* If you are getting this error, make sure that you have the keymaster_auth service defined in your init scripts, preferrably in init.recovery.{ro.hardware}.rc
661 * service keystore_auth /sbin/keystore_auth
662 * disabled
663 * oneshot
664 * user system
665 * group root
666 * seclabel u:r:recovery:s0
667 *
668 * And check dmesg for error codes regarding this service if needed. */
669 return disk_decryption_secret_key;
670 }
671 }
672
673 int32_t ret;
674
675 /* We only need a keyAlias which is USRSKEY_synthetic_password_b6f71045af7bd042 which we find and a uid which is -1 or 1000, I forget which
676 * as the key data will be read again by the begin function later via the keystore.
677 * The data is in a hidl_vec format which consists of a type and a value. */
678 /*::keystore::hidl_vec<uint8_t> data;
679 std::string keystoreid = SYNTHETIC_PASSWORD_KEY_PREFIX;
680 keystoreid += handle_str;
681
682 ret = service->get(String16(keystoreid.c_str()), user_id, &data);
683 if (ret < 0) {
684 printf("Could not connect to keystore service %i\n", ret);
685 return disk_decryption_secret_key;
686 } else if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*//*) {
687 printf("keystore error: (%d)\n", /*responses[ret],*//* ret);
688 return disk_decryption_secret_key;
689 } else {
690 printf("keystore returned: "); output_hex(&data[0], data.size()); printf("\n");
691 }*/
692
693 // Now we'll break up the intermediate key into the IV (first 12 bytes) and the cipher text (the rest of it).
694 std::vector<unsigned char> nonce = intermediate_key;
695 nonce.resize(12);
696 intermediate_key.erase (intermediate_key.begin(),intermediate_key.begin()+12);
697 //printf("nonce: "); output_hex((const unsigned char*)nonce.data(), nonce.size()); printf("\n");
698 //printf("cipher text: "); output_hex((const unsigned char*)intermediate_key.data(), intermediate_key.size()); printf("\n");
699
700 /* Now we will begin the second decrypt call found in
701 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#122
702 * This time we will use https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java
703 * and https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java
704 * First we set some algorithm parameters as seen in two places:
705 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#297
706 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#216 */
707 size_t maclen = 128;
708 ::keystore::AuthorizationSetBuilder begin_params;
709 begin_params.Authorization(::keystore::TAG_ALGORITHM, ::keystore::Algorithm::AES);
710 begin_params.Authorization(::keystore::TAG_BLOCK_MODE, ::keystore::BlockMode::GCM);
711 begin_params.Padding(::keystore::PaddingMode::NONE);
712 begin_params.Authorization(::keystore::TAG_NONCE, nonce);
713 begin_params.Authorization(::keystore::TAG_MAC_LENGTH, maclen);
714 //keymasterArgs.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES);
715 //keymasterArgs.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, mKeymasterBlockMode);
716 //keymasterArgs.addEnum(KeymasterDefs.KM_TAG_PADDING, mKeymasterPadding);
717 //keymasterArgs.addUnsignedInt(KeymasterDefs.KM_TAG_MAC_LENGTH, mTagLengthBits);
718 ::keystore::hidl_vec<uint8_t> entropy; // No entropy is needed for decrypt
719 entropy.resize(0);
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500720 std::string keystore_alias = mKey_Prefix;
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600721 keystore_alias += keystore_alias_subid;
722 String16 keystore_alias16(keystore_alias.c_str());
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500723#ifdef USE_KEYSTORAGE_4
724 android::hardware::keymaster::V4_0::KeyPurpose purpose = android::hardware::keymaster::V4_0::KeyPurpose::DECRYPT;
725 security::keymaster::OperationResult begin_result;
726 security::keymaster::OperationResult update_result;
727 security::keymaster::OperationResult finish_result;
728 ::android::security::keymaster::KeymasterArguments empty_params;
729 // These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63
730 service->begin(binder, keystore_alias16, (int32_t)purpose, true, android::security::keymaster::KeymasterArguments(begin_params.hidl_data()), entropy, -1, &begin_result);
731#else
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600732 ::keystore::KeyPurpose purpose = ::keystore::KeyPurpose::DECRYPT;
733 OperationResult begin_result;
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500734 OperationResult update_result;
735 OperationResult finish_result;
736 ::keystore::hidl_vec<::keystore::KeyParameter> empty_params;
737 empty_params.resize(0);
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600738 // These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63
739 service->begin(binder, keystore_alias16, purpose, true, begin_params.hidl_data(), entropy, -1, &begin_result);
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500740#endif
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600741 ret = begin_result.resultCode;
742 if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
743 printf("keystore begin error: (%d)\n", /*responses[ret],*/ ret);
744 return disk_decryption_secret_key;
745 } else {
746 //printf("keystore begin operation successful\n");
747 }
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600748 // The cipher.doFinal call triggers an update to the keystore followed by a finish https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#64
749 // See also https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/KeyStoreCryptoOperationChunkedStreamer.java#208
750 service->update(begin_result.token, empty_params, intermediate_key, &update_result);
751 ret = update_result.resultCode;
752 if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
753 printf("keystore update error: (%d)\n", /*responses[ret],*/ ret);
754 return disk_decryption_secret_key;
755 } else {
756 //printf("keystore update operation successful\n");
757 //printf("keystore update returned: "); output_hex(&update_result.data[0], update_result.data.size()); printf("\n"); // this ends up being the synthetic password
758 }
759 // We must use the data in update_data.data before we call finish below or the data will be gone
760 // The payload data from the keystore update is further personalized at https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#153
761 // We now have the disk decryption key!
762 disk_decryption_secret_key = PersonalizedHash(PERSONALIZATION_FBE_KEY, (const char*)&update_result.data[0], update_result.data.size());
763 //printf("disk_decryption_secret_key: '%s'\n", disk_decryption_secret_key.c_str());
764 ::keystore::hidl_vec<uint8_t> signature;
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600765 service->finish(begin_result.token, empty_params, signature, entropy, &finish_result);
766 ret = finish_result.resultCode;
767 if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
768 printf("keystore finish error: (%d)\n", /*responses[ret],*/ ret);
769 return disk_decryption_secret_key;
770 } else {
771 //printf("keystore finish operation successful\n");
772 }
773 stop_keystore();
774 return disk_decryption_secret_key;
775 } else if (*synthetic_password_version == SYNTHETIC_PASSWORD_VERSION) {
776 printf("spblob v2\n");
777 /* Version 2 of the spblob is basically the same as version 1, but the order of getting the intermediate key and disk decryption key have been flip-flopped
778 * as seen in https://android.googlesource.com/platform/frameworks/base/+/5025791ac6d1538224e19189397de8d71dcb1a12
779 */
780 /* First decrypt call found in
781 * https://android.googlesource.com/platform/frameworks/base/+/android-8.1.0_r18/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#135
782 * We will use https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java
783 * and https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java
784 * First we set some algorithm parameters as seen in two places:
785 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#297
786 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#216 */
787 // When using secdis (aka not weaver) you must supply an auth token to the keystore prior to the begin operation
788 if (auth_token_len > 0) {
789 /*::keystore::KeyStoreServiceReturnCode auth_result = service->addAuthToken(auth_token, auth_token_len);
790 if (!auth_result.isOk()) {
791 // The keystore checks the uid of the calling process and will return a permission denied on this operation for user 0
792 printf("keystore error adding auth token\n");
793 return disk_decryption_secret_key;
794 }*/
795 // The keystore refuses to allow the root user to supply auth tokens, so we write the auth token to a file earlier and
796 // run a separate service that runs user the system user to add the auth token. We wait for the auth token file to be
797 // deleted by the keymaster_auth service and check for a /auth_error file in case of errors. We quit after after a while if
798 // the /auth_token file never gets deleted.
799 int auth_wait_count = 20;
800 while (access("/auth_token", F_OK) == 0 && auth_wait_count-- > 0)
801 usleep(5000);
802 if (auth_wait_count == 0 || access("/auth_error", F_OK) == 0) {
803 printf("error during keymaster_auth service\n");
804 /* If you are getting this error, make sure that you have the keymaster_auth service defined in your init scripts, preferrably in init.recovery.{ro.hardware}.rc
805 * service keystore_auth /sbin/keystore_auth
806 * disabled
807 * oneshot
808 * user system
809 * group root
810 * seclabel u:r:recovery:s0
811 *
812 * And check dmesg for error codes regarding this service if needed. */
813 return disk_decryption_secret_key;
814 }
815 }
816 int32_t ret;
817 size_t maclen = 128;
818 unsigned char* iv = (unsigned char*)byteptr; // The IV is the first 12 bytes of the spblob
819 ::keystore::hidl_vec<uint8_t> iv_hidlvec;
820 iv_hidlvec.setToExternal((unsigned char*)byteptr, 12);
821 //printf("iv: "); output_hex((const unsigned char*)iv, 12); printf("\n");
822 unsigned char* cipher_text = (unsigned char*)byteptr + 12; // The cipher text comes immediately after the IV
823 ::keystore::hidl_vec<uint8_t> cipher_text_hidlvec;
824 cipher_text_hidlvec.setToExternal(cipher_text, spblob_data.size() - 14 /* 1 each for version and SYNTHETIC_PASSWORD_PASSWORD_BASED and 12 for the iv */);
825 ::keystore::AuthorizationSetBuilder begin_params;
826 begin_params.Authorization(::keystore::TAG_ALGORITHM, ::keystore::Algorithm::AES);
827 begin_params.Authorization(::keystore::TAG_BLOCK_MODE, ::keystore::BlockMode::GCM);
828 begin_params.Padding(::keystore::PaddingMode::NONE);
829 begin_params.Authorization(::keystore::TAG_NONCE, iv_hidlvec);
830 begin_params.Authorization(::keystore::TAG_MAC_LENGTH, maclen);
831 ::keystore::hidl_vec<uint8_t> entropy; // No entropy is needed for decrypt
832 entropy.resize(0);
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500833 std::string keystore_alias = mKey_Prefix;
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600834 keystore_alias += keystore_alias_subid;
835 String16 keystore_alias16(keystore_alias.c_str());
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500836#ifdef USE_KEYSTORAGE_4
837 android::hardware::keymaster::V4_0::KeyPurpose purpose = android::hardware::keymaster::V4_0::KeyPurpose::DECRYPT;
838 security::keymaster::OperationResult begin_result;
839 security::keymaster::OperationResult update_result;
840 security::keymaster::OperationResult finish_result;
841 ::android::security::keymaster::KeymasterArguments empty_params;
842 // These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63
843 service->begin(binder, keystore_alias16, (int32_t)purpose, true, android::security::keymaster::KeymasterArguments(begin_params.hidl_data()), entropy, -1, &begin_result);
844#else
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600845 ::keystore::KeyPurpose purpose = ::keystore::KeyPurpose::DECRYPT;
846 OperationResult begin_result;
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500847 OperationResult update_result;
848 OperationResult finish_result;
849 ::keystore::hidl_vec<::keystore::KeyParameter> empty_params;
850 empty_params.resize(0);
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600851 // These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63
852 service->begin(binder, keystore_alias16, purpose, true, begin_params.hidl_data(), entropy, -1, &begin_result);
Ethan Yonkere9afc3d2018-08-30 15:16:27 -0500853#endif
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600854 ret = begin_result.resultCode;
855 if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
856 printf("keystore begin error: (%d)\n", /*responses[ret],*/ ret);
857 return disk_decryption_secret_key;
858 } /*else {
859 printf("keystore begin operation successful\n");
860 }*/
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600861 // The cipher.doFinal call triggers an update to the keystore followed by a finish https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#64
862 // See also https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/KeyStoreCryptoOperationChunkedStreamer.java#208
863 service->update(begin_result.token, empty_params, cipher_text_hidlvec, &update_result);
864 ret = update_result.resultCode;
865 if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
866 printf("keystore update error: (%d)\n", /*responses[ret],*/ ret);
867 return disk_decryption_secret_key;
868 } /*else {
869 printf("keystore update operation successful\n");
870 printf("keystore update returned: "); output_hex(&update_result.data[0], update_result.data.size()); printf("\n"); // this ends up being the synthetic password
871 }*/
872 //printf("keystore resulting data: "); output_hex((unsigned char*)&update_result.data[0], update_result.data.size()); printf("\n");
873 // We must copy the data in update_data.data before we call finish below or the data will be gone
874 size_t keystore_result_size = update_result.data.size();
875 unsigned char* keystore_result = (unsigned char*)malloc(keystore_result_size);
876 if (!keystore_result) {
877 printf("malloc on keystore_result\n");
878 return disk_decryption_secret_key;
879 }
880 memcpy(keystore_result, &update_result.data[0], update_result.data.size());
881 //printf("keystore_result data: "); output_hex(keystore_result, keystore_result_size); printf("\n");
882 ::keystore::hidl_vec<uint8_t> signature;
Ethan Yonkerc5dd5792018-03-08 21:26:44 -0600883 service->finish(begin_result.token, empty_params, signature, entropy, &finish_result);
884 ret = finish_result.resultCode;
885 if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) {
886 printf("keystore finish error: (%d)\n", /*responses[ret],*/ ret);
887 free(keystore_result);
888 return disk_decryption_secret_key;
889 } /*else {
890 printf("keystore finish operation successful\n");
891 }*/
892 stop_keystore();
893
894 /* Now we do the second decrypt call as seen in:
895 * https://android.googlesource.com/platform/frameworks/base/+/android-8.1.0_r18/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#136
896 */
897 const unsigned char* intermediate_iv = keystore_result;
898 //printf("intermediate_iv: "); output_hex((const unsigned char*)intermediate_iv, 12); printf("\n");
899 const unsigned char* intermediate_cipher_text = (const unsigned char*)keystore_result + 12; // The cipher text comes immediately after the IV
900 int cipher_size = keystore_result_size - 12;
901 //printf("intermediate_cipher_text: "); output_hex((const unsigned char*)intermediate_cipher_text, cipher_size); printf("\n");
902 // First we personalize as seen https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#102
903 void* personalized_application_id = PersonalizedHashBinary(PERSONALISATION_APPLICATION_ID, (const char*)application_id, application_id_size);
904 if (!personalized_application_id) {
905 printf("malloc personalized_application_id\n");
906 free(keystore_result);
907 return disk_decryption_secret_key;
908 }
909 //printf("personalized application id: "); output_hex((unsigned char*)personalized_application_id, SHA512_DIGEST_LENGTH); printf("\n");
910 // Now we'll decrypt using openssl AES/GCM/NoPadding
911 OpenSSL_add_all_ciphers();
912 int actual_size=0, final_size=0;
913 EVP_CIPHER_CTX *d_ctx = EVP_CIPHER_CTX_new();
914 const unsigned char* key = (const unsigned char*)personalized_application_id; // The key is the now personalized copy of the application ID
915 //printf("key: "); output_hex((const unsigned char*)key, 32); printf("\n");
916 EVP_DecryptInit(d_ctx, EVP_aes_256_gcm(), key, intermediate_iv);
917 unsigned char* secret_key = (unsigned char*)malloc(cipher_size);
918 EVP_DecryptUpdate(d_ctx, secret_key, &actual_size, intermediate_cipher_text, cipher_size);
919 unsigned char tag[AES_BLOCK_SIZE];
920 EVP_CIPHER_CTX_ctrl(d_ctx, EVP_CTRL_GCM_SET_TAG, 16, tag);
921 EVP_DecryptFinal_ex(d_ctx, secret_key + actual_size, &final_size);
922 EVP_CIPHER_CTX_free(d_ctx);
923 free(personalized_application_id);
924 free(keystore_result);
925 int secret_key_real_size = actual_size - 16;
926 //printf("secret key: "); output_hex((const unsigned char*)secret_key, secret_key_real_size); printf("\n");
927 // The payload data from the keystore update is further personalized at https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#153
928 // We now have the disk decryption key!
929 disk_decryption_secret_key = PersonalizedHash(PERSONALIZATION_FBE_KEY, (const char*)secret_key, secret_key_real_size);
930 //printf("disk_decryption_secret_key: '%s'\n", disk_decryption_secret_key.c_str());
931 free(secret_key);
932 return disk_decryption_secret_key;
Ethan Yonkere131bec2017-12-15 23:48:02 -0600933 }
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500934 return disk_decryption_secret_key;
935}
936
937}}
938
939#define PASSWORD_TOKEN_SIZE 32
940
Ethan Yonkere131bec2017-12-15 23:48:02 -0600941/* C++ replacement for
942 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#992
943 * called here
944 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#813 */
945bool Get_Secdis(const std::string& spblob_path, const std::string& handle_str, std::string& secdis_data) {
946 std::string secdis_file = spblob_path + handle_str + ".secdis";
947 if (!android::base::ReadFileToString(secdis_file, &secdis_data)) {
948 printf("Failed to read '%s'\n", secdis_file.c_str());
949 return false;
950 }
951 //output_hex(secdis_data.data(), secdis_data.size());printf("\n");
952 return true;
953}
954
955// C++ replacement for https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#1033
956userid_t fakeUid(const userid_t uid) {
957 return 100000 + uid;
958}
959
960bool Is_Weaver(const std::string& spblob_path, const std::string& handle_str) {
961 std::string weaver_file = spblob_path + handle_str + ".weaver";
962 struct stat st;
963 if (stat(weaver_file.c_str(), &st) == 0)
964 return true;
965 return false;
966}
967
968bool Free_Return(bool retval, void* weaver_key, password_data_struct* pwd) {
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500969 if (weaver_key)
970 free(weaver_key);
Ethan Yonkere131bec2017-12-15 23:48:02 -0600971 if (pwd->salt)
972 free(pwd->salt);
973 if (pwd->password_handle)
974 free(pwd->password_handle);
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500975 return retval;
976}
977
978/* Decrypt_User_Synth_Pass is the TWRP C++ equivalent to spBasedDoVerifyCredential
979 * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/LockSettingsService.java#1998 */
980bool Decrypt_User_Synth_Pass(const userid_t user_id, const std::string& Password) {
981 bool retval = false;
982 void* weaver_key = NULL;
983 password_data_struct pwd;
984 pwd.salt = NULL;
Ethan Yonkere131bec2017-12-15 23:48:02 -0600985 pwd.salt_len = 0;
986 pwd.password_handle = NULL;
987 pwd.handle_len = 0;
988 char application_id[PASSWORD_TOKEN_SIZE + SHA512_DIGEST_LENGTH];
989
990 uint32_t auth_token_len = 0;
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500991
992 std::string secret; // this will be the disk decryption key that is sent to vold
993 std::string token = "!"; // there is no token used for this kind of decrypt, key escrow is handled by weaver
994 int flags = FLAG_STORAGE_DE;
995 if (user_id == 0)
996 flags = FLAG_STORAGE_DE;
997 else
998 flags = FLAG_STORAGE_CE;
999 char spblob_path_char[PATH_MAX];
1000 sprintf(spblob_path_char, "/data/system_de/%d/spblob/", user_id);
1001 std::string spblob_path = spblob_path_char;
1002 long handle = 0;
1003 std::string handle_str;
1004 // Get the handle: https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/LockSettingsService.java#2017
1005 if (!Find_Handle(spblob_path, handle_str)) {
1006 printf("Error getting handle\n");
Ethan Yonkere131bec2017-12-15 23:48:02 -06001007 return Free_Return(retval, weaver_key, &pwd);
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001008 }
1009 printf("Handle is '%s'\n", handle_str.c_str());
1010 // Now we begin driving unwrapPasswordBasedSyntheticPassword from: https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#758
1011 // First we read the password data which contains scrypt parameters
1012 if (!Get_Password_Data(spblob_path, handle_str, &pwd)) {
1013 printf("Failed to Get_Password_Data\n");
Ethan Yonkere131bec2017-12-15 23:48:02 -06001014 return Free_Return(retval, weaver_key, &pwd);
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001015 }
1016 //printf("pwd N %i R %i P %i salt ", pwd.scryptN, pwd.scryptR, pwd.scryptP); output_hex((char*)pwd.salt, pwd.salt_len); printf("\n");
1017 unsigned char password_token[PASSWORD_TOKEN_SIZE];
1018 //printf("Password: '%s'\n", Password.c_str());
1019 // The password token is the password scrypted with the parameters from the password data file
1020 if (!Get_Password_Token(&pwd, Password, &password_token[0])) {
1021 printf("Failed to Get_Password_Token\n");
Ethan Yonkere131bec2017-12-15 23:48:02 -06001022 return Free_Return(retval, weaver_key, &pwd);
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001023 }
1024 //output_hex(&password_token[0], PASSWORD_TOKEN_SIZE);printf("\n");
Ethan Yonkere131bec2017-12-15 23:48:02 -06001025 if (Is_Weaver(spblob_path, handle_str)) {
1026 printf("using weaver\n");
1027 // BEGIN PIXEL 2 WEAVER
1028 // Get the weaver data from the .weaver file which tells us which slot to use when we ask weaver for the escrowed key
1029 // https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#768
1030 weaver_data_struct wd;
1031 if (!Get_Weaver_Data(spblob_path, handle_str, &wd)) {
1032 printf("Failed to get weaver data\n");
1033 return Free_Return(retval, weaver_key, &pwd);
1034 }
1035 // The weaver key is the the password token prefixed with "weaver-key" padded to 128 with nulls with the password token appended then SHA512
1036 // https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#1059
1037 weaver_key = PersonalizedHashBinary(PERSONALISATION_WEAVER_KEY, (char*)&password_token[0], PASSWORD_TOKEN_SIZE);
1038 if (!weaver_key) {
1039 printf("malloc error getting weaver_key\n");
1040 return Free_Return(retval, weaver_key, &pwd);
1041 }
1042 // Now we start driving weaverVerify: https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#343
1043 // Called from https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#776
1044 android::vold::Weaver weaver;
1045 if (!weaver) {
1046 printf("Failed to get weaver service\n");
1047 return Free_Return(retval, weaver_key, &pwd);
1048 }
1049 // Get the key size from weaver service
1050 uint32_t weaver_key_size = 0;
1051 if (!weaver.GetKeySize(&weaver_key_size)) {
1052 printf("Failed to get weaver key size\n");
1053 return Free_Return(retval, weaver_key, &pwd);
1054 } else {
1055 //printf("weaver key size is %u\n", weaver_key_size);
1056 }
1057 //printf("weaver key: "); output_hex((unsigned char*)weaver_key, weaver_key_size); printf("\n");
1058 // Send the slot from the .weaver file, the computed weaver key, and get the escrowed key data
1059 std::vector<uint8_t> weaver_payload;
1060 // TODO: we should return more information about the status including time delays before the next retry
1061 if (!weaver.WeaverVerify(wd.slot, weaver_key, &weaver_payload)) {
1062 printf("failed to weaver verify\n");
1063 return Free_Return(retval, weaver_key, &pwd);
1064 }
1065 //printf("weaver payload: "); output_hex(&weaver_payload); printf("\n");
1066 // Done with weaverVerify
1067 // Now we will compute the application ID
1068 // https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#964
1069 // Called from https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#780
1070 // The escrowed weaver key data is prefixed with "weaver-pwd" padded to 128 with nulls with the weaver payload appended then SHA512
1071 void* weaver_secret = PersonalizedHashBinary(PERSONALISATION_WEAVER_PASSWORD, (const char*)weaver_payload.data(), weaver_payload.size());
1072 //printf("weaver secret: "); output_hex((unsigned char*)weaver_secret, SHA512_DIGEST_LENGTH); printf("\n");
1073 // The application ID is the password token and weaver secret appended to each other
1074 memcpy((void*)&application_id[0], (void*)&password_token[0], PASSWORD_TOKEN_SIZE);
1075 memcpy((void*)&application_id[PASSWORD_TOKEN_SIZE], weaver_secret, SHA512_DIGEST_LENGTH);
1076 //printf("application ID: "); output_hex((unsigned char*)application_id, PASSWORD_TOKEN_SIZE + SHA512_DIGEST_LENGTH); printf("\n");
1077 // END PIXEL 2 WEAVER
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001078 } else {
Ethan Yonkere131bec2017-12-15 23:48:02 -06001079 printf("using secdis\n");
1080 std::string secdis_data;
1081 if (!Get_Secdis(spblob_path, handle_str, secdis_data)) {
1082 printf("Failed to get secdis data\n");
1083 return Free_Return(retval, weaver_key, &pwd);
1084 }
1085 void* secdiscardable = PersonalizedHashBinary(PERSONALISATION_SECDISCARDABLE, (char*)secdis_data.data(), secdis_data.size());
1086 if (!secdiscardable) {
1087 printf("malloc error getting secdiscardable\n");
1088 return Free_Return(retval, weaver_key, &pwd);
1089 }
1090 memcpy((void*)&application_id[0], (void*)&password_token[0], PASSWORD_TOKEN_SIZE);
1091 memcpy((void*)&application_id[PASSWORD_TOKEN_SIZE], secdiscardable, SHA512_DIGEST_LENGTH);
1092
1093 int ret = -1;
1094 bool request_reenroll = false;
1095 android::sp<android::hardware::gatekeeper::V1_0::IGatekeeper> gk_device;
1096 gk_device = ::android::hardware::gatekeeper::V1_0::IGatekeeper::getService();
1097 if (gk_device == nullptr) {
1098 printf("failed to get gatekeeper service\n");
1099 return Free_Return(retval, weaver_key, &pwd);
1100 }
1101 if (pwd.handle_len <= 0) {
1102 printf("no password handle supplied\n");
1103 return Free_Return(retval, weaver_key, &pwd);
1104 }
1105 android::hardware::hidl_vec<uint8_t> pwd_handle_hidl;
1106 pwd_handle_hidl.setToExternal(const_cast<uint8_t *>((const uint8_t *)pwd.password_handle), pwd.handle_len);
1107 void* gk_pwd_token = PersonalizedHashBinary(PERSONALIZATION_USER_GK_AUTH, (char*)&password_token[0], PASSWORD_TOKEN_SIZE);
1108 if (!gk_pwd_token) {
1109 printf("malloc error getting gatekeeper_key\n");
1110 return Free_Return(retval, weaver_key, &pwd);
1111 }
1112 android::hardware::hidl_vec<uint8_t> gk_pwd_token_hidl;
1113 gk_pwd_token_hidl.setToExternal(const_cast<uint8_t *>((const uint8_t *)gk_pwd_token), SHA512_DIGEST_LENGTH);
1114 android::hardware::Return<void> hwRet =
1115 gk_device->verify(fakeUid(user_id), 0 /* challange */,
1116 pwd_handle_hidl,
1117 gk_pwd_token_hidl,
1118 [&ret, &request_reenroll, &auth_token_len]
1119 (const android::hardware::gatekeeper::V1_0::GatekeeperResponse &rsp) {
1120 ret = static_cast<int>(rsp.code); // propagate errors
1121 if (rsp.code >= android::hardware::gatekeeper::V1_0::GatekeeperStatusCode::STATUS_OK) {
1122 auth_token_len = rsp.data.size();
1123 request_reenroll = (rsp.code == android::hardware::gatekeeper::V1_0::GatekeeperStatusCode::STATUS_REENROLL);
1124 ret = 0; // all success states are reported as 0
1125 // The keystore refuses to allow the root user to supply auth tokens, so we write the auth token to a file here and later
1126 // run a separate service that runs as the system user to add the auth token. We wait for the auth token file to be
1127 // deleted by the keymaster_auth service and check for a /auth_error file in case of errors. We quit after a while seconds if
1128 // the /auth_token file never gets deleted.
1129 unlink("/auth_token");
1130 FILE* auth_file = fopen("/auth_token","wb");
1131 if (auth_file != NULL) {
1132 fwrite(rsp.data.data(), sizeof(uint8_t), rsp.data.size(), auth_file);
1133 fclose(auth_file);
1134 } else {
1135 printf("failed to open /auth_token for writing\n");
1136 ret = -2;
1137 }
1138 } else if (rsp.code == android::hardware::gatekeeper::V1_0::GatekeeperStatusCode::ERROR_RETRY_TIMEOUT && rsp.timeout > 0) {
1139 ret = rsp.timeout;
1140 }
1141 }
1142 );
1143 free(gk_pwd_token);
1144 if (!hwRet.isOk() || ret != 0) {
1145 printf("gatekeeper verification failed\n");
1146 return Free_Return(retval, weaver_key, &pwd);
1147 }
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001148 }
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001149 // Now we will handle https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#816
1150 // Plus we will include the last bit that computes the disk decrypt key found in:
1151 // https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#153
Ethan Yonkere131bec2017-12-15 23:48:02 -06001152 secret = android::keystore::unwrapSyntheticPasswordBlob(spblob_path, handle_str, user_id, (const void*)&application_id[0], PASSWORD_TOKEN_SIZE + SHA512_DIGEST_LENGTH, auth_token_len);
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001153 if (!secret.size()) {
1154 printf("failed to unwrapSyntheticPasswordBlob\n");
Ethan Yonkere131bec2017-12-15 23:48:02 -06001155 return Free_Return(retval, weaver_key, &pwd);
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001156 }
1157 if (!e4crypt_unlock_user_key(user_id, 0, token.c_str(), secret.c_str())) {
1158 printf("e4crypt_unlock_user_key returned fail\n");
Ethan Yonkere131bec2017-12-15 23:48:02 -06001159 return Free_Return(retval, weaver_key, &pwd);
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001160 }
Ethan Yonkere9afc3d2018-08-30 15:16:27 -05001161#ifdef USE_KEYSTORAGE_4
1162 if (!e4crypt_prepare_user_storage("", user_id, 0, flags)) {
1163#else
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001164 if (!e4crypt_prepare_user_storage(nullptr, user_id, 0, flags)) {
Ethan Yonkere9afc3d2018-08-30 15:16:27 -05001165#endif
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001166 printf("failed to e4crypt_prepare_user_storage\n");
Ethan Yonkere131bec2017-12-15 23:48:02 -06001167 return Free_Return(retval, weaver_key, &pwd);
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001168 }
1169 printf("Decrypted Successfully!\n");
1170 retval = true;
Ethan Yonkere131bec2017-12-15 23:48:02 -06001171 return Free_Return(retval, weaver_key, &pwd);
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001172}
1173#endif //HAVE_SYNTH_PWD_SUPPORT
1174
1175int Get_Password_Type(const userid_t user_id, std::string& filename) {
1176 struct stat st;
1177 char spblob_path_char[PATH_MAX];
1178 sprintf(spblob_path_char, "/data/system_de/%d/spblob/", user_id);
1179 if (stat(spblob_path_char, &st) == 0) {
1180#ifdef HAVE_SYNTH_PWD_SUPPORT
1181 printf("Using synthetic password method\n");
1182 std::string spblob_path = spblob_path_char;
1183 std::string handle_str;
1184 if (!Find_Handle(spblob_path, handle_str)) {
1185 printf("Error getting handle\n");
1186 return 0;
1187 }
1188 printf("Handle is '%s'\n", handle_str.c_str());
1189 password_data_struct pwd;
1190 if (!Get_Password_Data(spblob_path, handle_str, &pwd)) {
1191 printf("Failed to Get_Password_Data\n");
1192 return 0;
1193 }
1194 if (pwd.password_type == 1) // In Android this means pattern
1195 return 2; // In TWRP this means pattern
1196 else if (pwd.password_type == 2) // In Android this means PIN or password
1197 return 1; // In TWRP this means PIN or password
1198 return 0; // We'll try the default password
1199#else
1200 printf("Synthetic password support not present in TWRP\n");
1201 return -1;
1202#endif
1203 }
1204 std::string path;
1205 if (user_id == 0) {
1206 path = "/data/system/";
1207 } else {
1208 char user_id_str[5];
1209 sprintf(user_id_str, "%i", user_id);
1210 path = "/data/system/users/";
1211 path += user_id_str;
1212 path += "/";
1213 }
1214 filename = path + "gatekeeper.password.key";
1215 if (stat(filename.c_str(), &st) == 0 && st.st_size > 0)
1216 return 1;
1217 filename = path + "gatekeeper.pattern.key";
1218 if (stat(filename.c_str(), &st) == 0 && st.st_size > 0)
1219 return 2;
1220 printf("Unable to locate gatekeeper password file '%s'\n", filename.c_str());
1221 filename = "";
1222 return 0;
1223}
1224
Ethan Yonkerbd7492d2016-12-07 13:55:01 -06001225bool Decrypt_User(const userid_t user_id, const std::string& Password) {
1226 uint8_t *auth_token;
1227 uint32_t auth_token_len;
1228 int ret;
1229
1230 struct stat st;
1231 if (user_id > 9999) {
1232 printf("user_id is too big\n");
1233 return false;
1234 }
1235 std::string filename;
1236 bool Default_Password = (Password == "!");
1237 if (Get_Password_Type(user_id, filename) == 0 && !Default_Password) {
1238 printf("Unknown password type\n");
1239 return false;
1240 }
1241 int flags = FLAG_STORAGE_DE;
1242 if (user_id == 0)
1243 flags = FLAG_STORAGE_DE;
1244 else
1245 flags = FLAG_STORAGE_CE;
Ethan Yonkerbd7492d2016-12-07 13:55:01 -06001246 if (Default_Password) {
1247 if (!e4crypt_unlock_user_key(user_id, 0, "!", "!")) {
1248 printf("e4crypt_unlock_user_key returned fail\n");
1249 return false;
1250 }
Ethan Yonkere9afc3d2018-08-30 15:16:27 -05001251#ifdef USE_KEYSTORAGE_4
1252 if (!e4crypt_prepare_user_storage("", user_id, 0, flags)) {
1253#else
Ethan Yonkerbd7492d2016-12-07 13:55:01 -06001254 if (!e4crypt_prepare_user_storage(nullptr, user_id, 0, flags)) {
Ethan Yonkere9afc3d2018-08-30 15:16:27 -05001255#endif
Ethan Yonkerbd7492d2016-12-07 13:55:01 -06001256 printf("failed to e4crypt_prepare_user_storage\n");
1257 return false;
1258 }
1259 printf("Decrypted Successfully!\n");
1260 return true;
1261 }
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001262 if (stat("/data/system_de/0/spblob", &st) == 0) {
1263#ifdef HAVE_SYNTH_PWD_SUPPORT
1264 printf("Using synthetic password method\n");
1265 return Decrypt_User_Synth_Pass(user_id, Password);
1266#else
1267 printf("Synthetic password support not present in TWRP\n");
Ethan Yonkerbd7492d2016-12-07 13:55:01 -06001268 return false;
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001269#endif
1270 }
Ethan Yonkerbd7492d2016-12-07 13:55:01 -06001271 printf("password filename is '%s'\n", filename.c_str());
1272 if (stat(filename.c_str(), &st) != 0) {
1273 printf("error stat'ing key file: %s\n", strerror(errno));
1274 return false;
1275 }
1276 std::string handle;
1277 if (!android::base::ReadFileToString(filename, &handle)) {
1278 printf("Failed to read '%s'\n", filename.c_str());
1279 return false;
1280 }
1281 bool should_reenroll;
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001282#ifdef HAVE_GATEKEEPER1
1283 bool request_reenroll = false;
1284 android::sp<android::hardware::gatekeeper::V1_0::IGatekeeper> gk_device;
1285 gk_device = ::android::hardware::gatekeeper::V1_0::IGatekeeper::getService();
1286 if (gk_device == nullptr)
1287 return false;
1288 android::hardware::hidl_vec<uint8_t> curPwdHandle;
1289 curPwdHandle.setToExternal(const_cast<uint8_t *>((const uint8_t *)handle.c_str()), st.st_size);
1290 android::hardware::hidl_vec<uint8_t> enteredPwd;
1291 enteredPwd.setToExternal(const_cast<uint8_t *>((const uint8_t *)Password.c_str()), Password.size());
1292
1293 android::hardware::Return<void> hwRet =
1294 gk_device->verify(user_id, 0 /* challange */,
1295 curPwdHandle,
1296 enteredPwd,
1297 [&ret, &request_reenroll, &auth_token, &auth_token_len]
1298 (const android::hardware::gatekeeper::V1_0::GatekeeperResponse &rsp) {
1299 ret = static_cast<int>(rsp.code); // propagate errors
1300 if (rsp.code >= android::hardware::gatekeeper::V1_0::GatekeeperStatusCode::STATUS_OK) {
1301 auth_token = new uint8_t[rsp.data.size()];
1302 auth_token_len = rsp.data.size();
1303 memcpy(auth_token, rsp.data.data(), auth_token_len);
1304 request_reenroll = (rsp.code == android::hardware::gatekeeper::V1_0::GatekeeperStatusCode::STATUS_REENROLL);
1305 ret = 0; // all success states are reported as 0
1306 } else if (rsp.code == android::hardware::gatekeeper::V1_0::GatekeeperStatusCode::ERROR_RETRY_TIMEOUT && rsp.timeout > 0) {
1307 ret = rsp.timeout;
1308 }
1309 }
1310 );
1311 if (!hwRet.isOk()) {
1312 return false;
1313 }
1314#else
1315 gatekeeper_device_t *gk_device;
1316 ret = gatekeeper_device_initialize(&gk_device);
1317 if (ret!=0)
1318 return false;
1319 ret = gk_device->verify(gk_device, user_id, 0, (const uint8_t *)handle.c_str(), st.st_size,
Ethan Yonkerbd7492d2016-12-07 13:55:01 -06001320 (const uint8_t *)Password.c_str(), (uint32_t)Password.size(), &auth_token, &auth_token_len,
1321 &should_reenroll);
1322 if (ret !=0) {
1323 printf("failed to verify\n");
1324 return false;
1325 }
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001326#endif
Ethan Yonkerbd7492d2016-12-07 13:55:01 -06001327 char token_hex[(auth_token_len*2)+1];
1328 token_hex[(auth_token_len*2)] = 0;
1329 uint32_t i;
1330 for (i=0;i<auth_token_len;i++) {
1331 sprintf(&token_hex[2*i], "%02X", auth_token[i]);
1332 }
1333 // The secret is "Android FBE credential hash" plus appended 0x00 to reach 128 bytes then append the user's password then feed that to sha512sum
1334 std::string secret = HashPassword(Password);
1335 if (!e4crypt_unlock_user_key(user_id, 0, token_hex, secret.c_str())) {
1336 printf("e4crypt_unlock_user_key returned fail\n");
1337 return false;
1338 }
1339 if (!e4crypt_prepare_user_storage(nullptr, user_id, 0, flags)) {
1340 printf("failed to e4crypt_prepare_user_storage\n");
1341 return false;
1342 }
1343 printf("Decrypted Successfully!\n");
1344 return true;
1345}