Gentoo Archives: gentoo-user

From: Rodrigo Forlin <forlin@×××××.com>
To: gentoo-user@l.g.o
Subject: [gentoo-user] OT - Recover luks keys from a mounted crypted partition / extract initramfs from kernel
Date: Fri, 02 Nov 2007 08:38:30
Message-Id: e5a451190711020132j736c5f8bpda0319c8678ad210@mail.gmail.com
1 Hello all,
2
3 I have a system with two partitions:
4
5 - hda1 - /boot with grub files and kernel image with initramfs
6 embedded with CONFIG_INITRAMFS_SOURCE kernel option
7
8 - hda2 - luks crypted root partition
9
10 Every time kernel boot, loads embedded initramfs, which has the
11 --key-file, luksOpen hda2, mounts the partition and switch_root to it.
12
13 The problem is that i make some mistakes ($#%$#@@) on my system
14 and i can`t login anymore (i played a little too much with passwd and
15 shadow files). But I have an old hd image, with the same --key-file,
16 also embedded into kernel, but with this one i can login.
17
18 I don`t have the --key-file anymore. Just the ones in initramfs. I
19 thought about 2 alternatives to recover this key-file, but didn`t
20 succeded in any of them. Can someone help me to:
21
22 - Recover the --key-file from a already mounted and decrypted
23 partition or
24
25 - Extract the initramfs from kernel, so i can unzip and
26 (un)cpio it, so i can get my file from it.
27
28 I`ve already tried adding a different init=/path/to/init into
29 grub, but how i made my init from scrach, i`m ignoring these kernel
30 parameters;
31
32 I also tried to extract the initramfs with objcpy, but the kernel
33 file format is unrecognized.
34
35 Using kernel-2.6.16-gentoo-r13.
36
37 Don`t know what else i can try.
38
39 TIA,
40
41 Rodrigo Forlin
42 --
43 gentoo-user@g.o mailing list