Skip to content

Add BitLocker FVEAutoUnlock support (auto-unlocked secondary volumes) #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jschicht wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Add BitLocker FVEAutoUnlock support (auto-unlocked secondary volumes) #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e4813fd
Code clean up
joachimmetz Jun 7, 2026
a5e347f
Add BitLocker FVEAutoUnlock support (auto-unlocked secondary volumes)
jschicht Jun 11, 2026
896c0f2
Supporting external key
jschicht Jun 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
122 changes: 119 additions & 3 deletions bdetools/bdeinfo.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,15 +67,32 @@ void usage_fprint(
fprintf( stream, "Use bdeinfo to determine information about a BitLocker Drive\n"
" Encrypted (BDE) volume\n\n" );

fprintf( stream, "Usage: bdeinfo [ -k keys ] [ -o offset ] [ -p password ]\n"
" [ -r password ] [ -s filename ] [ -huvV ] source\n\n" );
fprintf( stream, "Usage: bdeinfo [ -B blob ] [ -E key ] [ -I identifier ] [ -k keys ]\n"
" [ -K key ] [ -o offset ] [ -p password ]\n"
" [ -r password ] [ -s filename ] [ -AhuvV ] source\n\n" );

fprintf( stream, "\tsource: the source file or device\n\n" );

fprintf( stream, "\t-A: print the auto-unlock key of the (operating system)\n"
"\t volume. Requires the volume to be unlocked, e.g. by\n"
"\t providing its password, recovery password or startup key.\n" );
fprintf( stream, "\t-B: specify the file containing the FVEAutoUnlock blob\n"
"\t (the binary 'Data' value from the registry key\n"
"\t HKLM\\SYSTEM\\CurrentControlSet\\Control\\FVEAutoUnlock\\{GUID}).\n"
"\t Used together with -K to unlock a secondary volume.\n" );
fprintf( stream, "\t-E: the external (startup) key of a secondary volume\n"
"\t formatted in base16 (64 hexadecimal characters).\n"
"\t Used together with -I to unlock a secondary volume\n"
"\t directly.\n" );
fprintf( stream, "\t-h: shows this help\n" );
fprintf( stream, "\t-I: the identifier (GUID) of the VMK that the -E external\n"
"\t key unwraps.\n" );
fprintf( stream, "\t-k: the full volume encryption key and tweak key\n"
"\t formatted in base16 and separated by a : character\n"
"\t e.g. FVEK:TWEAK\n" );
fprintf( stream, "\t-K: the auto-unlock key of the operating system volume\n"
"\t formatted in base16 (64 hexadecimal characters).\n"
"\t Used together with -B to unlock a secondary volume.\n" );
fprintf( stream, "\t-o: specify the volume offset in bytes\n" );
fprintf( stream, "\t-p: specify the password/passphrase\n" );
fprintf( stream, "\t-r: specify the recovery password\n" );
Expand Down Expand Up @@ -139,6 +156,10 @@ int main( int argc, char * const argv[] )
#endif
{
libbde_error_t *error = NULL;
system_character_t *option_auto_unlock_blob = NULL;
system_character_t *option_auto_unlock_key = NULL;
system_character_t *option_external_key = NULL;
system_character_t *option_external_key_identifier = NULL;
system_character_t *option_keys = NULL;
system_character_t *option_password = NULL;
system_character_t *option_recovery_password = NULL;
Expand All @@ -147,6 +168,7 @@ int main( int argc, char * const argv[] )
system_character_t *source = NULL;
char *program = "bdeinfo";
system_integer_t option = 0;
int print_auto_unlock_key = 0;
int result = 0;
int unattended_mode = 0;
int verbose = 0;
Expand Down Expand Up @@ -189,7 +211,7 @@ int main( int argc, char * const argv[] )
while( ( option = bdetools_getopt(
argc,
argv,
_SYSTEM_STRING( "hk:o:p:r:s:uvV" ) ) ) != (system_integer_t) -1 )
_SYSTEM_STRING( "AB:E:hI:k:K:o:p:r:s:uvV" ) ) ) != (system_integer_t) -1 )
{
switch( option )
{
Expand All @@ -205,17 +227,42 @@ int main( int argc, char * const argv[] )

return( EXIT_FAILURE );

case (system_integer_t) 'A':
print_auto_unlock_key = 1;

break;

case (system_integer_t) 'B':
option_auto_unlock_blob = optarg;

break;

case (system_integer_t) 'E':
option_external_key = optarg;

break;

case (system_integer_t) 'h':
usage_fprint(
stdout );

return( EXIT_SUCCESS );

case (system_integer_t) 'I':
option_external_key_identifier = optarg;

break;

case (system_integer_t) 'k':
option_keys = optarg;

break;

case (system_integer_t) 'K':
option_auto_unlock_key = optarg;

break;

case (system_integer_t) 'o':
option_volume_offset = optarg;

Expand Down Expand Up @@ -341,6 +388,75 @@ int main( int argc, char * const argv[] )
goto on_error;
}
}
if( option_auto_unlock_key != NULL )
{
if( info_handle_set_auto_unlock_key(
bdeinfo_info_handle,
option_auto_unlock_key,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set auto-unlock key.\n" );

goto on_error;
}
}
if( option_auto_unlock_blob != NULL )
{
if( info_handle_set_auto_unlock_blob(
bdeinfo_info_handle,
option_auto_unlock_blob,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set FVEAutoUnlock blob.\n" );

goto on_error;
}
}
if( option_external_key != NULL )
{
if( info_handle_set_external_key(
bdeinfo_info_handle,
option_external_key,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set external key.\n" );

goto on_error;
}
}
if( option_external_key_identifier != NULL )
{
if( info_handle_set_external_key_identifier(
bdeinfo_info_handle,
option_external_key_identifier,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set external key identifier.\n" );

goto on_error;
}
}
if( print_auto_unlock_key != 0 )
{
if( info_handle_set_print_auto_unlock_key(
bdeinfo_info_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to enable printing of the auto-unlock key.\n" );

goto on_error;
}
}
if( option_volume_offset != NULL )
{
if( info_handle_set_volume_offset(
Expand Down
104 changes: 99 additions & 5 deletions bdetools/bdemount.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,20 +71,34 @@ void usage_fprint(
fprintf( stream, "Use bdemount to mount a BitLocker Drive Encrypted (BDE) volume\n\n" );

#if defined( HAVE_LIBFUSE ) || defined( HAVE_LIBFUSE3 ) || defined( HAVE_LIBOSXFUSE )
fprintf( stream, "Usage: bdemount [ -k keys ] [ -o offset ] [ -p password ]\n"
fprintf( stream, "Usage: bdemount [ -B blob ] [ -E key ] [ -I identifier ] [ -k keys ]\n"
" [ -K key ] [ -o offset ] [ -p password ]\n"
" [ -r recovery_password ] [ -s startup_key_path ]\n"
" [ -X extended_options ] [ -huvV ] volume mount_point\n\n" );
#else
fprintf( stream, "Usage: bdemount [ -k keys ] [ -o offset ] [ -p password ]\n"
fprintf( stream, "Usage: bdemount [ -B blob ] [ -E key ] [ -I identifier ] [ -k keys ]\n"
" [ -K key ] [ -o offset ] [ -p password ]\n"
" [ -r recovery_password ] [ -s startup_key_path ]\n"
" [ -huvV ] volume mount_point\n\n" );
#endif
fprintf( stream, "\tvolume: a BitLocker Drive Encrypted (BDE) volume\n\n" );
fprintf( stream, "\tmount_point: the directory to serve as mount point\n\n" );

fprintf( stream, "\t-B: specify the file containing the FVEAutoUnlock blob (the binary\n"
"\t 'Data' value from the registry key HKLM\\SYSTEM\\CurrentControlSet\n"
"\t \\Control\\FVEAutoUnlock\\{GUID}). Used together with -K to unlock\n"
"\t a secondary (auto-unlocked) volume\n" );
fprintf( stream, "\t-E: specify the external (startup) key of a secondary volume formatted\n"
"\t in base16 (64 hexadecimal characters). Used together with -I to\n"
"\t unlock a secondary volume directly\n" );
fprintf( stream, "\t-h: shows this help\n" );
fprintf( stream, "\t-I: specify the identifier (GUID) of the VMK that the -E external key\n"
"\t unwraps\n" );
fprintf( stream, "\t-k: specify the full volume encryption key and tweak key formatted in\n"
"\t base16 and separated by a : character e.g. FVEK:TWEAK\n" );
fprintf( stream, "\t-K: specify the auto-unlock key of the operating system volume formatted\n"
"\t in base16 (64 hexadecimal characters). Used together with -B to\n"
"\t unlock a secondary (auto-unlocked) volume\n" );
fprintf( stream, "\t-o: specify the volume offset in bytes\n" );
fprintf( stream, "\t-p: specify the password/passphrase\n" );
fprintf( stream, "\t-r: specify the recovery password/passphrase\n" );
Expand Down Expand Up @@ -153,6 +167,10 @@ int main( int argc, char * const argv[] )
#endif
{
libbde_error_t *error = NULL;
system_character_t *option_auto_unlock_blob = NULL;
system_character_t *option_auto_unlock_key = NULL;
system_character_t *option_external_key = NULL;
system_character_t *option_external_key_identifier = NULL;
system_character_t *option_keys = NULL;
system_character_t *option_offset = NULL;
system_character_t *option_password = NULL;
Expand Down Expand Up @@ -230,9 +248,9 @@ int main( int argc, char * const argv[] )
program );

#if defined( HAVE_LIBFUSE ) || defined( HAVE_LIBFUSE3 ) || defined( HAVE_LIBOSXFUSE )
options = _SYSTEM_STRING( "hk:o:p:r:s:uvVX:" );
options = _SYSTEM_STRING( "B:E:hI:k:K:o:p:r:s:uvVX:" );
#else
options = _SYSTEM_STRING( "hk:o:p:r:s:uvV" );
options = _SYSTEM_STRING( "B:E:hI:k:K:o:p:r:s:uvV" );
#endif
while( ( option = bdetools_getopt(
argc,
Expand All @@ -253,17 +271,37 @@ int main( int argc, char * const argv[] )

return( EXIT_FAILURE );

case (system_integer_t) 'B':
option_auto_unlock_blob = optarg;

break;

case (system_integer_t) 'E':
option_external_key = optarg;

break;

case (system_integer_t) 'h':
usage_fprint(
stdout );

return( EXIT_SUCCESS );

case (system_integer_t) 'I':
option_external_key_identifier = optarg;

break;

case (system_integer_t) 'k':
option_keys = optarg;

break;

case (system_integer_t) 'K':
option_auto_unlock_key = optarg;

break;

case (system_integer_t) 'o':
option_offset = optarg;

Expand Down Expand Up @@ -424,6 +462,62 @@ int main( int argc, char * const argv[] )
goto on_error;
}
}
if( option_auto_unlock_key != NULL )
{
if( mount_handle_set_auto_unlock_key(
bdemount_mount_handle,
option_auto_unlock_key,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set auto-unlock key.\n" );

goto on_error;
}
}
if( option_auto_unlock_blob != NULL )
{
if( mount_handle_set_auto_unlock_blob(
bdemount_mount_handle,
option_auto_unlock_blob,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set FVEAutoUnlock blob.\n" );

goto on_error;
}
}
if( option_external_key != NULL )
{
if( mount_handle_set_external_key(
bdemount_mount_handle,
option_external_key,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set external key.\n" );

goto on_error;
}
}
if( option_external_key_identifier != NULL )
{
if( mount_handle_set_external_key_identifier(
bdemount_mount_handle,
option_external_key_identifier,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set external key identifier.\n" );

goto on_error;
}
}
#if defined( WINAPI )
path_prefix = _SYSTEM_STRING( "\\BDE" );
#else
Expand Down Expand Up @@ -572,7 +666,7 @@ int main( int argc, char * const argv[] )
&bdemount_fuse_operations,
sizeof( struct fuse_operations ),
bdemount_mount_handle );

if( bdemount_fuse_handle == NULL )
{
fprintf(
Expand Down
Loading