🔬 Script to mount decrypted disk on Android 12 https://twitter.com/mild_sunrise/status/1449321409793175552

README.md

Important: This script is not really meant to be used as is, instead you should execute each step one by one, understanding its purpose. I highly recommend you read the accompanying Twitter thread before trying it.

--

This is a script that performs all needed actions to mount the userdata partition of an Android 12 emulator device (AVD).

To use it, run it from the AVD's folder (i.e. the folder where userdata-qemu.img and encryptionkey.img are located). A data folder will be created, and the userdata partition will be mounted there.

Like I said, I highly recommend you read my Twitter thread first. TL;DR:

• Before running, make sure you have qemu-nbd, dmsetup and especially fscryptctl

• Before running, you need to download my Android scripts in the current directory.

• Before running, you need to patch your kernel to have dm-default-key support. This is the patch to apply.

• This is for Android 12, which comes with FBE + Metadata encryption by default.

  • Older Androids don't come with metadata encryption, so the extract metadata key and decrypt disk blocks can be skipped (mount nbd0 directly).
  • Even older Androids come with an entirely different (and more simple) approach called FDE (Full Disk Encryption). You can find scripts for decrypting that around the internet.
  • If it's the oldest possible thing ever, then it has no encryption.
  • Keep in mind your version may be patched or use different defaults.

• This assumes only 1 user on the emulador.

• Again, this is meant to be executed by you. It's a very primitive script; for example, if it fails, you've have to clean up before running it again.

mount.sh

#!/usr/bin/bash
set -eEuxo pipefail

mkdir -p data metadata

# mount QEMU partitions
modprobe nbd max_part=63
qemu-nbd -c /dev/nbd0 encryptionkey.img.qcow2 -r
qemu-nbd -c /dev/nbd1 userdata-qemu.img.qcow2 -r

# extract metadata key
mount /dev/nbd0p1 metadata -o ro,noload
KEY=$(./vold.py --raw --hex metadata/vold/metadata_encryption/key)

# decrypt disk
SOURCE=/dev/nbd1
SIZE="$(blockdev --getsz $SOURCE)"
dmsetup create userdata --table "0 $SIZE default-key aes-xts-plain64 $KEY 0 $SOURCE 0 2 sector_size:4096 iv_large_sectors"

# mount disk
mount /dev/mapper/userdata data -o ro,noload

# feed master keys to decrypt files
for key_dir in unencrypted/key misc/vold/user_keys/{de/0,ce/0/current}; do
  ./vold.py --raw data/$key_dir | fscryptctl add_key data
done

echo 'Done!'