1

If I were to make a VM disk that was encrypetd, boot it, enter the encrypted passphrase and save the resulting 'image state' (of the running VM).

Would this image have the 'encrypted' files easily accessible?

Essentially I'm trying to understanding where exactly the 'decrypted filesystem' exists, is it in memory or somewhere else? This would depend on the actual implementation of the encryption - but I'm trying to know if there exists any implementation (Truecrypt / etc) such that it would NOT provide easy access to the files from the above state.


Said a slightly different way, is there any encryption implementation that 'decrypts' to a binary blob?

  • Frozen VM has a decryption key in memory which is saved to disk. Resuming it will not ask for the decryption key. You need to unmount the fs to remove key from RAM and you can't do this to the root filesystem but you can do it to other partitions if they are not in use. – Aria Mar 15 '18 at 19:16
  • I would assume that finding the key isn't that easy, is there an easy way one would find it? Other than trying to observe the memory looking for a frequently accessed 'area'/'cell'? – Chris Stryczynski Mar 15 '18 at 19:25
  • @ChrisStryczynski it's trivial. Don't forget that the OS in the VM knows how to find it in its file access functionality. And any piece of software compiled for that OS knows how to find the file access functionality. Worst case, assuming this is an unknown OS, it's just following jumps until you find something that looks like the assembly of your decryption routine and look which memory location it takes the key from. Realistically, this is probably all pretty well documented, because people need to be able to deal with the OS. – Marcus Müller Mar 15 '18 at 19:59
  • (in other words, it's a very normal thing to take a debugger and look at a frozen VM and analyze what its OS is doing. That's what debuggers are for. And that's why OS kernels come with debug symbol packages.) – Marcus Müller Mar 15 '18 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.