libfvde_metadata_block_read_data: unsupported block size: 2466354417

[dunkhong]

I am decrypting a encrypted disk by FileVault2, I guess. But, I got error the following:

libfvde_metadata_block_read_data: header data:
00000000: d9 79 20 d6 01 77 a1 b7  bc 32 75 91 2a 52 ba 22   .y ..w.. .2u.*R."
00000010: 48 d8 f7 87 0f 39 8d 69  51 e0 48 94 14 8a 78 5e   H....9.i Q.H...x^
00000020: 0c a1 c3 fd ee 1a a9 5f  9c c1 d4 d6 c2 91 b4 1f   ......._ ........
00000030: f1 94 01 93 09 56 08 37  1d 00 2d 4f 3d fc 68 91   .....V.7 ..-O=.h.

libfvde_metadata_block_read_data: checksum				: 0xd62079d9
libfvde_metadata_block_read_data: initial value				: 0xb7a17701
libfvde_metadata_block_read_data: version				: 12988
libfvde_metadata_block_read_data: type					: 0x9175
libfvde_metadata_block_read_data: serial number				: 0x22ba522a
libfvde_metadata_block_read_data: group					: 7605798084567095368
libfvde_metadata_block_read_data: unknown3				: 0x5e788a149448e051
libfvde_metadata_block_read_data: number				: 6893070318429249804
libfvde_metadata_block_read_data: unknown5				: 0x1fb491c2d6d4c19c
libfvde_metadata_block_read_data: size					: 2466354417
libfvde_metadata_block_read_data: unknown6				: 0x37085609
libfvde_metadata_block_read_data: unknown7				: 0x9168fc3d4f2d001d

 Unable to open: /dev/loop14p2.
 libfvde_metadata_block_read_data: unsupported block size: 2466354417.
 libfvde_encrypted_metadata_read: unable to read metadata block.
 libfvde_volume_open_read: unable to read primary encrypted metadata.
 libfvde_volume_open_file_io_handle: unable to read from file IO handle.
 info_handle_open_input: unable to open input volume.

I am using libfvde-20180108.
Any help with this would be greatly appreciated.
Thank you.

[delikat]

Seeing a similar issue on libfvde-20190104 with a FileVault2 encrypted SD card.

fvdeinfo 20190104

Unable to open: /dev/disk3s2.
libfvde_metadata_block_read_data: unsupported block size: 843235416.
libfvde_encrypted_metadata_read: unable to read metadata block.
libfvde_volume_open_read: unable to read primary encrypted metadata.
libfvde_volume_open_file_io_handle: unable to read from file IO handle.
info_handle_open_input: unable to open input volume.

[joachimmetz]

Could you provide me with format debug output.

Also see: https://github.com/libyal/libfvde/wiki/Troubleshooting#verbose-and-debug-output

[delikat]

Yes, here's the stderr output: https://filebin.net/fehpd3bbrwdgc0rk/debug.log (it's quite large, about 32MB)

I configured with --enable-verbose-output --enable-debug-output. Thanks for taking a look!

Here's also an mmls of the card:

GUID Partition Table (EFI)
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Safety Table
001:  -------   0000000000   0000000039   0000000040   Unallocated
002:  Meta      0000000001   0000000001   0000000001   GPT Header
003:  Meta      0000000002   0000000033   0000000032   Partition Table
004:  000       0000000040   0000409639   0000409600   EFI System Partition
005:  001       0000409640   0030619607   0030209968   Hmm
006:  002       0030619608   0030881751   0000262144   Booter
007:  -------   0030881752   0030881791   0000000040   Unallocated

[joachimmetz]

Yes, here's the stderr output: https://filebin.net/fehpd3bbrwdgc0rk/debug.log (it's quite large, about 32MB)

Thx, I'll have a look as soon as time permits.

For the future know you can compress the log file gzip debug.log

[bulhakov-adf]

Hi @joachimmetz,

I have faced the same problem with removable media volume, Here is an output —
fvdeinfo_output.txt

It looks like skipping the block size check for 8192 value fixes the problem, but I am not sure that this is a right approach.

I can share a 7 GB image with a password via Google Drive.

[n0rdlicht90]

i have also the same problem with a removable media volume. Is there a solution for this? Here my error.log file:

error.log.gz

The mmls of the removable media volume is:

GUID Partition Table (EFI)
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Safety Table
001:  -------   0000000000   0000000039   0000000040   Unallocated
002:  Meta      0000000001   0000000001   0000000001   GPT Header
003:  Meta      0000000002   0000000033   0000000032   Partition Table
004:  000       0000000040   0000409639   0000409600   EFI System Partition
005:  001       0000409640   0014847335   0014437696   
006:  002       0014847336   0015109479   0000262144   Booter
007:  -------   0015109480   0015109519   0000000040   Unallocated

And i use the command:

./fvdeinfo -p passwort -o $((512*409640)) ~/Sicherung/FileVault2/Image/FileVault2.dd

[joachimmetz]

thx for the additional debug information, I'll have a look at time permits.

[joachimmetz]

For both error.log.gz and fvdeinfo_output.txt there is "random" data after a 0x0013 block. Could this be related to #12 ?

[joachimmetz]

I can share a 7 GB image with a password via Google Drive.

@bulhakov-adf if you still have the image, that could be useful in determining what the cause of this is.

[joachimmetz]

same error message seen in combination with physical volume with different key data in the volume header

For both error.log.gz and fvdeinfo_output.txt

• 0x0013 block with 2 blocks as part of transaction
• followed by a 0x001a block
• error message is raised

And for debug.txt from #53

• 0x0013 block with 4 blocks as part of transaction
• followed by a 0x0016, 0x0017, 0x0011 blocks
• error message is raised

maybe related on how the encrypted metadata should be read?