I was under the impression that TrueCrypt installed a boot loader that was responsible for the pretty menu that you usually see when you boot. So to my surprise when I wanted to play around with it….it wasn’t. TrueCrypt actually uses a second stage to display that pretty menu. The traditional boot loader more or less just takes care of loading the second stage which sits compressed on the hard disk, if loading fails it will display some messages and that’s it. Since I still wanted to play around with it and preferably with the version actually sitting on my test machine’s hard disk I decided to dump it. The easiest way was to use Evil Maid, I modified the source slightly to prevent infection, it will still infect though if you omit a second argument :)
Here are the steps if you want to do it yourself:
- Retrieve the first 64 sectors, for example with “FTK Imager” if you are under windows
- Download the Evil Maid source
- Apply this patch (patch <evilmaid.patch)
- Run ./patch_tc <file_with_64_sectors> -f
This should look like this:
./patch_tc ~/Desktop/tc-full.dd -f TrueCrypt EvilMaid patcher v0.1 --------------------------------- TrueCrypt Boot Loader detected PatchTrueCrypt(): Compressed loader size: 11877 bytes PatchTrueCrypt(): Saved checksum 0x267DAC67 PatchTrueCrypt(): Loader memory size: 0x7000 (28672) bytes PatchTrueCrypt(): Decompressing the boot loader PatchTrueCrypt(): Decompression successful
The local directory where the executable patch_tc resides should now contain two files “sectors_backup” and “loader” which is the uncompressed second stage as you can see from a simple strings output:
strings -n 15 loader
No bootable partition found
TrueCrypt Boot Loader 7.1
Keyboard Controls:
[Esc]
Boot Non-Hidden System (Boot Manager)
Skip Authentication (Boot Manager)
[Esc] Cancel
Enter password
for hidden system:
Booting...
BIOS reserved too much memory:
- Upgrade BIOS
- Use a different motherboard model/brand
Warning: Caps Lock is on.
Incorrect password.
If you are sure the password is correct, the key data may be damaged. Boot your
TrueCrypt Rescue Disk and select 'Repair Options' > 'Restore key data'.
Bootable Partitions:
, Partition:
Press 1-9 to select partition:
Your BIOS does not support large drives
due to a bug
- Enable LBA in BIOS
Copying system to hidden volume. To abort, press Esc.
If aborted, copying will have to start from the beginning (if attempted again).
To fix bad sectors: 1) Terminate 2) Encrypt and decrypt sys partition 3) Retry
Remaining:
Copying completed.
Memory corrupted
DiabloHorn 