127 lines
4.8 KiB
Plaintext
127 lines
4.8 KiB
Plaintext
|
|
#------------------------------------------------------------------------------
|
|
# $File: luks,v 1.5 2022/09/07 11:23:44 christos Exp $
|
|
# luks: file(1) magic for Linux Unified Key Setup
|
|
# URL: https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup
|
|
# http://fileformats.archiveteam.org/wiki/LUKS
|
|
# From: Anthon van der Neut <anthon@mnt.org>
|
|
# Update: Joerg Jenderek
|
|
# Note: verfied by command like `cryptsetup luksDump /dev/sda3`
|
|
|
|
0 string LUKS\xba\xbe LUKS encrypted file,
|
|
# https://reposcope.com/mimetype/application/x-raw-disk-image
|
|
!:mime application/x-raw-disk-image
|
|
#!:mime application/x-luks-volume
|
|
# img is the generic extension; no suffix for partitions; luksVolumeHeaderBackUp via zuluCrypt
|
|
!:ext /luks/img/luksVolumeHeaderBackUp
|
|
# version like: 1 2
|
|
>6 beshort x ver %d
|
|
# test for version 1 variant
|
|
>6 beshort 1
|
|
>>0 use luks-v1
|
|
# test for version 2 variant
|
|
>6 beshort >1
|
|
>>0 use luks-v2
|
|
# Reference: https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf
|
|
# http://mark0.net/download/triddefs_xml.7z/defs/l/luks.trid.xml
|
|
# display information about LUKS version 1
|
|
0 name luks-v1
|
|
# cipher-name like: aes twofish
|
|
>8 string x [%s,
|
|
# cipher-mode like: xts-plain64 cbc-essiv
|
|
>40 string x %s,
|
|
# hash specification like: sha256 sha1 ripemd160
|
|
>72 string x %s]
|
|
>168 string x UUID: %s
|
|
# NEW PART!
|
|
# payload-offset; start offset of the bulk data
|
|
>104 ubelong x \b, at %#x data
|
|
# key-bytes; number of key bytes; key-bytes*8=MK-bits
|
|
>108 ubelong x \b, %u key bytes
|
|
# mk-digest[20]; master key checksum from PBKDF2
|
|
>112 ubequad x \b, MK digest %#16.16llx
|
|
>>120 ubequad x \b%16.16llx
|
|
>>128 ubelong x \b%8.8x
|
|
# mk-digest-salt[32]; salt parameter for master key PBKDF2
|
|
>132 ubequad x \b, MK salt %#16.16llx
|
|
>>140 ubequad x \b%16.16llx
|
|
>>148 ubequad x \b%16.16llx
|
|
>>156 ubequad x \b%16.16llx
|
|
# mk-digest-iter; iterations parameter for master key PBKDF2
|
|
>164 ubelong x \b, %u MK iterations
|
|
# key slot 1
|
|
>208 ubelong =0x00AC71F3 \b; slot #0
|
|
>>208 use luks-slot
|
|
# key slot 2
|
|
>256 ubelong =0x00AC71F3 \b; slot #1
|
|
>>256 use luks-slot
|
|
# key slot 3
|
|
>304 ubelong =0x00AC71F3 \b; slot #2
|
|
>>304 use luks-slot
|
|
# key slot 4
|
|
>352 ubelong =0x00AC71F3 \b; slot #3
|
|
>>352 use luks-slot
|
|
# key slot 5
|
|
>400 ubelong =0x00AC71F3 \b; slot #4
|
|
>>400 use luks-slot
|
|
# key slot 6
|
|
>448 ubelong =0x00AC71F3 \b; slot #5
|
|
>>448 use luks-slot
|
|
# key slot 7
|
|
>496 ubelong =0x00AC71F3 \b; slot #6
|
|
>>496 use luks-slot
|
|
# key slot 8
|
|
>544 ubelong =0x00AC71F3 \b; slot #7
|
|
>>544 use luks-slot
|
|
# Reference: https://gitlab.com/cryptsetup/LUKS2-docs/-/raw/master/luks2_doc_wip.pdf
|
|
# http://mark0.net/download/triddefs_xml.7z/defs/l/luks2.trid.xml
|
|
# display information about LUKS version 2
|
|
0 name luks-v2
|
|
# hdr_size; size including JSON area called Metadata area by cryptsetup with value like: 16384
|
|
>8 ubequad x \b, header size %llu
|
|
# possible check for MAGIC_2ND after header
|
|
#>(8.Q) string SKUL\xba\xbe \b, 2nd_HEADER_OK
|
|
# seqid; sequence ID, increased on update; called Epoch by cryptsetup with value like: 3 4 8 10
|
|
>16 ubequad x \b, ID %llu
|
|
# label[48]; optional ASCII label or empty; called Label by cryptsetup with value like: "LUKS2_EXT4_ROOT"
|
|
>24 string >\0 \b, label %s
|
|
# csum_alg[32]; checksum algorithm like: sha256 sha1 sha512 wirlpool ripemd160
|
|
>72 string x \b, algo %s
|
|
# salt[64]; salt , unique for every header
|
|
>104 ubequad x \b, salt %#llx...
|
|
# uuid[40]; UID of device as string like: 242256c6-396e-4a35-af5f-5b70cb7af9a7
|
|
>168 string x \b, UUID: %-.40s
|
|
# subsystem[48]; optional owner subsystem label or empty
|
|
>208 string >\0 \b, sub label %-.48s
|
|
# hdr_offset; offset from device start [ bytes ] like: 0
|
|
>256 ubequad !0 \b, offset %llx
|
|
# char _padding [184]; must be zeroed
|
|
#>264 ubequad x \b, padding %#16.16llx
|
|
#>440 ubequad x \b...%16.16llx
|
|
# csum[64]; header checksum
|
|
>448 ubequad x \b, crc %#llx...
|
|
# char _padding4096 [7*512]; Padding , must be zeroed
|
|
#>512 ubequad x \b, more padding %#16.16llx
|
|
#>4088 ubequad x \b...%16.16llx
|
|
# JSON text data terminated by the zero character; unused remainder empty and filled with zeroes like:
|
|
# {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offse"
|
|
>0x1000 string x \b, at 0x1000 %s
|
|
#>0x1000 indirect x
|
|
# display information (like active) about LUKS1 slot
|
|
0 name luks-slot
|
|
# state of keyslot; 0x00AC71F3~active 0x0000DEAD~inactive
|
|
#>0 ubelong x \b, status %#8.8x
|
|
>0 ubelong =0x00AC71F3 active
|
|
>0 ubelong =0x0000DEAD inactive
|
|
# iteration parameter for PBKDF2
|
|
#>4 ubelong x \b, %u iterations
|
|
# salt parameter for PBKDF2
|
|
#>8 ubequad x \b, salt %#16.16llx
|
|
#>>16 ubequad x \b%16.16llx
|
|
#>>24 ubequad x \b%16.16llx
|
|
#>>32 ubequad x \b%16.16llx
|
|
# start sector of key material like: 8 0x200 0x3f8 0x5f0 0xdd0
|
|
>40 ubelong x \b, %#x material offset
|
|
# number of anti-forensic stripes like: 4000
|
|
>44 ubelong !4000 \b, %u stripes
|