tabletseeker/gist:29eaf62d24be327f15bc27c534ea3d1d

tabletseeker · 2026-07-11T21:38:16Z

echo "--> 1. Wiping background system locks and clean-unmounting everything..." &&
sudo swapoff -a 2>/dev/null || true &&
sudo umount -R /mnt/target_clean 2>/dev/null || true &&
sudo umount -R /media/* 2>/dev/null || true &&
sudo umount -R /mnt/* 2>/dev/null || true &&

echo "--> 2. Resolving your active device-mapper path link..." &&
ACTIVE_MAPPER=$(lsblk -no NAME /dev/vda2 | grep -v vda2 | head -n 1) &&
if [ -z "$ACTIVE_MAPPER" ]; then
echo "Partition closed. Re-opening cleanly now..." &&
sudo cryptsetup open /dev/vda2 luks-70fa0081-58e5-4948-9e2e-81ecf11c2aab;
ACTIVE_MAPPER="luks-70fa0081-58e5-4948-9e2e-81ecf11c2aab";
else
echo "Found running attachment mapper: /dev/mapper/$ACTIVE_MAPPER";
fi &&

echo "--> 3. Mounting the target file structure into memory..." &&
sudo mkdir -p /mnt/target_clean &&
sudo mount /dev/mapper/$ACTIVE_MAPPER /mnt/target_clean &&
sudo mount /dev/vda1 /mnt/target_clean/boot/efi &&
sudo mount --bind /dev /mnt/target_clean/dev &&
sudo mount --bind /proc /mnt/target_clean/proc &&
sudo mount --bind /sys /mnt/target_clean/sys &&

echo "--> 4. Regenerating a high-entropy valid passkey asset file..." &&
sudo mkdir -p /mnt/target_clean/etc/cryptsetup-initramfs &&
sudo dd bs=512 count=4 if=/dev/urandom of=/mnt/target_clean/etc/cryptsetup-initramfs/boot.key status=none &&
sudo chmod 400 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key &&

echo "--> 5. Enrolling the fresh valid key file into your drive header..." &&
echo "!!! TYPE YOUR REAL LINUX DISK ENCRYPTION PASSWORD BELOW !!!" &&
sudo cryptsetup luksAddKey /dev/vda2 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key &&

echo "--> 6. Forcing a clean initramfs image compilation pass..." &&
sudo chroot /mnt/target_clean sh -c "update-initramfs -u -k all" &&

echo "--> 7. Safely unmounting and locking device layers..." &&
sudo umount -R /mnt/target_clean &&
sudo cryptsetup close $ACTIVE_MAPPER 2>/dev/null || true &&
echo "=======================================================" &&
echo " SUCCESS: Valid keyfile integrated! Ready to reboot. " &&
echo "======================================================="

tabletseeker · 2026-07-11T21:52:27Z

/dev/null || true
sudo umount -R /mnt/target_clean 2>/dev/null || true

echo "--> 2. Opening storage using the true hardware path name..."
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44 2>/dev/null || true
sudo cryptsetup close target_repair_node 2>/dev/null || true
sudo cryptsetup open /dev/vda2 target_repair_node

echo "--> 3. Mounting the target file structure into memory cleanly..."
sudo mkdir -p /mnt/target_clean
sudo mount /dev/mapper/target_repair_node /mnt/target_clean
sudo mount /dev/vda1 /mnt/target_clean/boot/efi
sudo mount --bind /dev /mnt/target_clean/dev
sudo mount --bind /proc /mnt/target_clean/proc
sudo mount --bind /sys /mnt/target_clean/sys

echo "--> 4. Regenerating a high-entropy valid passkey asset file..."
sudo mkdir -p /mnt/target_clean/etc/cryptsetup-initramfs
sudo dd bs=512 count=4 if=/dev/urandom of=/mnt/target_clean/etc/cryptsetup-initramfs/boot.key status=none
sudo chmod 400 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key

echo "--> 5. Enrolling the fresh valid key file into your drive header..."
sudo cryptsetup luksAddKey /dev/vda2 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key

echo "--> 6. Synchronizing the internal system tables to match the true boot UUID..."
sudo tee /mnt/target_clean/etc/crypttab << 'EOF'
luks-0c349def-f79f-4dc7-934c-4fc12238ae44 UUID=0c349def-f79f-4dc7-934c-4fc12238ae44 /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=1
cryptswap /dev/vda3 /dev/urandom swap,cipher=aes-xts-plain64,size=256,noauto
EOF

sudo tee /mnt/target_clean/etc/cryptsetup-initramfs/crypttab << 'EOF'
luks-0c349def-f79f-4dc7-934c-4fc12238ae44 UUID=0c349def-f79f-4dc7-934c-4fc12238ae44 /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=1
EOF

echo "--> 7. Forcing a clean initramfs image compilation pass..."
sudo chroot /mnt/target_clean sh -c "update-initramfs -u -k all && update-grub"

echo "--> 8. VERIFYING SUCCESS: Checking for keyfile footprint inside binary image..."
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key"

echo "--> 9. Safely unmounting and locking device layers..."
sudo umount -R /mnt/target_clean
sudo cryptsetup close target_repair_node
echo "======================================================="
echo " VICTORY: Valid keyfile integrated! Ready to reboot. "
echo "======================================================="
--> 1. Wiping background system locks and clean-unmounting everything...
--> 2. Opening storage using the true hardware path name...
Enter passphrase for /dev/vda2:
--> 3. Mounting the target file structure into memory cleanly...
--> 4. Regenerating a high-entropy valid passkey asset file...
--> 5. Enrolling the fresh valid key file into your drive header...
Enter any existing passphrase:
--> 6. Synchronizing the internal system tables to match the true boot UUID...
luks-0c349def-f79f-4dc7-934c-4fc12238ae44 UUID=0c349def-f79f-4dc7-934c-4fc12238ae44 /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=1
cryptswap /dev/vda3 /dev/urandom swap,cipher=aes-xts-plain64,size=256,noauto
luks-0c349def-f79f-4dc7-934c-4fc12238ae44 UUID=0c349def-f79f-4dc7-934c-4fc12238ae44 /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=1
--> 7. Forcing a clean initramfs image compilation pass...
update-initramfs: Generating /boot/initrd.img-6.19.8-surface-3
cryptsetup: ERROR: Source mismatch: luks-0c349def-f79f-4dc7-934c-4fc12238ae44
uses N/A, but UUID=0c349def-f79f-4dc7-934c-4fc12238ae44 is 253:2
cryptsetup: WARNING: target 'target_repair_node' not found in /etc/crypttab
device-mapper: table ioctl on luks-0c349def-f79f-4dc7-934c-4fc12238ae44 failed: No such device or address
Command failed.
cryptsetup: WARNING: Couldn't determine cipher modules to load for
luks-0c349def-f79f-4dc7-934c-4fc12238ae44
W: Couldn't identify type of root file system '/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44' for fsck hook
Generating grub configuration file ...
Found background image: /usr/share/images/desktop-base/desktop-grub.png
Found linux image: /boot/vmlinuz-6.19.8-surface-3
Found initrd image: /boot/initrd.img-6.19.8-surface-3
Warning: os-prober will be executed to detect other bootable partitions.
Its output will be used to detect bootable binaries on them and create new boot entries.
Found Debian GNU/Linux forky/sid on /dev/sda3
Adding boot menu entry for UEFI Firmware Settings ...
done
--> 8. VERIFYING SUCCESS: Checking for keyfile footprint inside binary image...
--> 9. Safely unmounting and locking device layers...

VICTORY: Valid keyfile integrated! Ready to reboot.

tabletseeker · 2026-07-11T21:56:24Z

#!/bin/bash
echo "================================================================="
echo " CALAMARES CRYPTOGRAPHIC SYSTEM AUDIT INTERFACE "
echo "================================================================="
echo ""

echo "[1/5] SCANNING RAW VIRTUAL DISK CHANNELS..."
lsblk -o NAME,FSTYPE,SIZE,UUID,MOUNTPOINTS /dev/vda
echo ""

echo "[2/5] AUDITING ACTIVE KERNEL MAPPER PROFILES..."
sudo cryptsetup status luks-0c349def-f79f-4dc7-934c-4fc12238ae44 2>/dev/null || echo "Mapper luks-0c349def is currently closed."
sudo cryptsetup status target_repair_node 2>/dev/null || echo "Mapper target_repair_node is currently closed."
echo ""

echo "[3/5] LOCATING EMBEDDED KEYFILE ASSETS ON ACTIVE MOUNTS..."
echo "Checking live host mount tree locations:"
find /mnt /tmp -name "boot.key" -o -name "crypto_keyfile.bin" 2>/dev/null || echo "No key assets found on live host paths."
echo ""

echo "[4/5] MOUNTING CORE ENCRYPTED TREE TO CHECK TARGET FILES..."

Safely peek inside using a neutral temporary name to avoid resource locks

sudo mkdir -p /tmp/diag_peeker
if sudo cryptsetup open /dev/vda2 diag_peeker --readonly; then
sudo mount -o ro /dev/mapper/diag_peeker /tmp/diag_peeker

echo "--- TARGET CRYPTTAB ---"
cat /tmp/diag_peeker/etc/crypttab || echo "ERROR: crypttab missing"
echo ""

echo "--- TARGET FSTAB ---"
cat /tmp/diag_peeker/etc/fstab || echo "ERROR: fstab missing"
echo ""

echo "--- TARGET HOOK CONFIGURATIONS ---"
cat /tmp/diag_peeker/etc/cryptsetup-initramfs/conf-hook 2>/dev/null || echo "conf-hook missing"
echo ""

echo "--- TARGET EMBED HOOK CONTENT ---"
cat /tmp/diag_peeker/etc/initramfs-tools/hooks/embed_keyfile 2>/dev/null || echo "embed_keyfile hook missing"
echo ""

echo "--- INTERNAL HARDWARE KEYS RECORDED IN DRIVE HEADER ---"
sudo cryptsetup luksDump /dev/vda2 | grep -A 4 "Key Slot"
echo ""

sudo umount /tmp/diag_peeker
sudo cryptsetup close diag_peeker

else
echo "CRITICAL: Could not unlock /dev/vda2 for file auditing."
fi
echo ""

echo "[5/5] CHECKING LIVE STORAGE FILE ALLOCATIONS..."
df -h
echo "================================================================="

tabletseeker · 2026-07-11T21:57:43Z

echo "================================================================="
echo " CALAMARES CRYPTOGRAPHIC SYSTEM AUDIT INTERFACE "
echo "================================================================="
echo ""

echo "[1/5] SCANNING RAW VIRTUAL DISK CHANNELS..."
lsblk -o NAME,FSTYPE,SIZE,UUID,MOUNTPOINTS /dev/vda
echo ""

echo "[2/5] AUDITING ACTIVE KERNEL MAPPER PROFILES..."
sudo cryptsetup status luks-0c349def-f79f-4dc7-934c-4fc12238ae44 2>/dev/null || echo "Mapper luks-0c349def is currently closed."
sudo cryptsetup status target_repair_node 2>/dev/null || echo "Mapper target_repair_node is currently closed."
echo ""

echo "[3/5] LOCATING EMBEDDED KEYFILE ASSETS ON ACTIVE MOUNTS..."
echo "Checking live host mount tree locations:"
find /mnt /tmp -name "boot.key" -o -name "crypto_keyfile.bin" 2>/dev/null || echo "No key assets found on live host paths."
echo ""

echo "[4/5] MOUNTING CORE ENCRYPTED TREE TO CHECK TARGET FILES..."

Safely peek inside using a neutral temporary name to avoid resource locks

sudo mkdir -p /tmp/diag_peeker
if sudo cryptsetup open /dev/vda2 diag_peeker --readonly; then
sudo mount -o ro /dev/mapper/diag_peeker /tmp/diag_peeker

echo "--- TARGET CRYPTTAB ---"
cat /tmp/diag_peeker/etc/crypttab || echo "ERROR: crypttab missing"
echo ""

echo "--- TARGET FSTAB ---"
cat /tmp/diag_peeker/etc/fstab || echo "ERROR: fstab missing"
echo ""

echo "--- TARGET HOOK CONFIGURATIONS ---"
cat /tmp/diag_peeker/etc/cryptsetup-initramfs/conf-hook 2>/dev/null || echo "conf-hook missing"
echo ""

echo "--- TARGET EMBED HOOK CONTENT ---"
cat /tmp/diag_peeker/etc/initramfs-tools/hooks/embed_keyfile 2>/dev/null || echo "embed_keyfile hook missing"
echo ""

echo "--- INTERNAL HARDWARE KEYS RECORDED IN DRIVE HEADER ---"
sudo cryptsetup luksDump /dev/vda2 | grep -A 4 "Key Slot"
echo ""

sudo umount /tmp/diag_peeker
sudo cryptsetup close diag_peeker

else
echo "CRITICAL: Could not unlock /dev/vda2 for file auditing."
fi
echo ""

echo "[5/5] CHECKING LIVE STORAGE FILE ALLOCATIONS..."
df -h
echo "================================================================="

    CALAMARES CRYPTOGRAPHIC SYSTEM AUDIT INTERFACE

=================================================================

[1/5] SCANNING RAW VIRTUAL DISK CHANNELS...
NAME FSTYPE SIZE UUID MOUNTPOINTS
vda 20G
├─vda1 vfat 300M 8CFE-32E0
├─vda2 crypto_LUKS 15.5G 0c349def-f79f-4dc7-934c-4fc12238ae44
└─vda3 crypto_LUKS 4.2G 9e7e1b0a-6ffd-4b61-ab64-8ad2da9bbd16
└─luks-9e7e1b0a-6ffd-4b61-ab64-8ad2da9bbd16 swap 4.2G 34e3b373-6ce7-42ae-8788-84c760aed3ad

[2/5] AUDITING ACTIVE KERNEL MAPPER PROFILES...
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 is inactive.
Mapper luks-0c349def is currently closed.
/dev/mapper/target_repair_node is inactive.
Mapper target_repair_node is currently closed.

[3/5] LOCATING EMBEDDED KEYFILE ASSETS ON ACTIVE MOUNTS...
Checking live host mount tree locations:
No key assets found on live host paths.

[4/5] MOUNTING CORE ENCRYPTED TREE TO CHECK TARGET FILES...
Enter passphrase for /dev/vda2:
--- TARGET CRYPTTAB ---
luks-0c349def-f79f-4dc7-934c-4fc12238ae44 UUID=0c349def-f79f-4dc7-934c-4fc12238ae44 /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=1
cryptswap /dev/vda3 /dev/urandom swap,cipher=aes-xts-plain64,size=256,noauto

--- TARGET FSTAB ---

/etc/fstab: static file system information.

Use 'blkid' to print the universally unique identifier for a device; this may

be used with UUID= as a more robust way to name devices that works even if

disks are added and removed. See fstab(5).

UUID=8CFE-32E0 /boot/efi vfat defaults 0 2
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 / ext4 defaults 0 1
/dev/mapper/luks-9e7e1b0a-6ffd-4b61-ab64-8ad2da9bbd16 swap swap defaults 0 0

--- TARGET HOOK CONFIGURATIONS ---

Configuration file for the cryptroot initramfs hook.

KEYFILE_PATTERN: ...

The value of this variable is interpreted as a shell pattern.

Matching key files from the crypttab(5) are included in the initramfs

image. The associated devices can then be unlocked without manual

intervention. (For instance if /etc/crypttab lists two key files

/etc/keys/{root,swap}.key, you can set KEYFILE_PATTERN="/etc/keys/*.key"

to add them to the initrd.)

If KEYFILE_PATTERN if null or unset (default) then no key file is

copied to the initramfs image.

Note that the glob(7) is not expanded for crypttab(5) entries with a

'keyscript=' option. In that case, the field is not treated as a file

name but given as argument to the keyscript.

WARNING:

* If the initramfs image is to include private key material, you'll

want to create it with a restrictive umask in order to keep

non-privileged users at bay. For instance, set UMASK=0077 in

/etc/initramfs-tools/initramfs.conf

* If you use cryptsetup-suspend, private key material inside the

initramfs will be in memory during suspend period, defeating the

purpose of cryptsetup-suspend.

#KEYFILE_PATTERN=

ASKPASS: [ y | n ]

Whether to include the askpass binary to the initramfs image. askpass

is required for interactive passphrase prompts, and ASKPASS=y (the

default) is implied when the hook detects that same device needs to be

unlocked interactively (i.e., not via keyfile nor keyscript) at

initramfs stage. Setting ASKPASS=n also skips `cryptroot-unlock`

inclusion as it requires the askpass executable.

#ASKPASS=y

--- TARGET EMBED HOOK CONTENT ---
embed_keyfile hook missing

--- INTERNAL HARDWARE KEYS RECORDED IN DRIVE HEADER ---
Key Slot 0: ENABLED
Iterations: 11475522
Salt: 4b d2 c7 ae fa 7e a8 c5 10 86 52 e6 49 d5 c8 e3
d8 71 0b 09 f7 7b 21 84 1b a9 df c8 37 70 f0 26
Key material offset: 8

Key Slot 1: ENABLED
Iterations: 11602500
Salt: 8d 07 0d b6 f8 8f 23 09 b6 a8 2c 1e ac bd 66 bc
09 4a f6 39 34 80 67 19 c0 85 e2 48 6d 42 97 37
Key material offset: 512

Key Slot 2: ENABLED
Iterations: 11602500
Salt: dd 23 db 45 1d 66 8b 78 a1 7e 2c b6 c5 d0 75 ba
45 cf bf 92 86 41 42 b8 14 7d dd 7b 1e 9d 13 e4
Key material offset: 1016

Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

[5/5] CHECKING LIVE STORAGE FILE ALLOCATIONS...
Filesystem Size Used Avail Use% Mounted on
udev 612M 0 612M 0% /dev
tmpfs 197M 908K 196M 1% /run
/dev/sda3 6.8G 4.6G 1.9G 71% /
tmpfs 985M 96K 985M 1% /dev/shm
efivarfs 256K 7.5K 244K 3% /sys/firmware/efi/efivars
tmpfs 985M 4.0K 985M 1% /tmp
none 1.0M 0 1.0M 0% /run/credentials/systemd-journald.service
/dev/sda2 488M 111M 342M 25% /boot
/dev/sda1 510M 168K 510M 1% /boot/efi
tmpfs 197M 36K 197M 1% /run/user/1000

tabletseeker · 2026-07-11T21:58:43Z

echo "--> 1. Terminating background storage mapping blocks..."
sudo swapoff -a 2>/dev/null || true
sudo umount -R /mnt/target_clean 2>/dev/null || true
sudo cryptsetup close luks-9e7e1b0a-6ffd-4b61-ab64-8ad2da9bbd16 2>/dev/null || true
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44 2>/dev/null || true

echo "--> 2. Re-opening storage container using the exact name crypttab checks for..."
sudo cryptsetup open /dev/vda2 luks-0c349def-f79f-4dc7-934c-4fc12238ae44

echo "--> 3. Remounting core system directory sectors cleanly..."
sudo mkdir -p /mnt/target_clean
sudo mount /dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /mnt/target_clean
sudo mount /dev/vda1 /mnt/target_clean/boot/efi
sudo mount --bind /dev /mnt/target_clean/dev
sudo mount --bind /proc /mnt/target_clean/proc
sudo mount --bind /sys /mnt/target_clean/sys

echo "--> 4. Writing a clean, high-entropy keyfile asset to the target root..."
sudo mkdir -p /mnt/target_clean/etc/cryptsetup-initramfs
sudo dd bs=512 count=4 if=/dev/urandom of=/mnt/target_clean/etc/cryptsetup-initramfs/boot.key status=none
sudo chmod 400 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key

echo "--> 5. Enrolling the valid key into hardware Key Slot 3..."
sudo cryptsetup luksAddKey /dev/vda2 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key

echo "--> 6. Aligning the target system tables to eliminate swap locks..."
sudo tee /mnt/target_clean/etc/crypttab << 'EOF'
luks-0c349def-f79f-4dc7-934c-4fc12238ae44 UUID=0c349def-f79f-4dc7-934c-4fc12238ae44 /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=3
cryptswap /dev/vda3 /dev/urandom swap,cipher=aes-xts-plain64,size=256,noauto
EOF

sudo tee /mnt/target_clean/etc/fstab << 'EOF'
UUID=8CFE-32E0 /boot/efi vfat defaults 0 2
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 / ext4 defaults 0 1
/dev/mapper/cryptswap none swap sw,x-systemd.makefs 0 0
EOF

echo "--> 7. Populating the initramfs ramdisk file-copy script hook..."
sudo tee /mnt/target_clean/etc/cryptsetup-initramfs/conf-hook << 'EOF'
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
EOF

sudo mkdir -p /mnt/target_clean/etc/initramfs-tools/hooks
sudo tee /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile << 'EOF'
#!/bin/sh
if [ "$1" = "prereqs" ]; then exit 0; fi
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
mkdir -p "$2/etc/cryptsetup-initramfs"
cp -p /etc/cryptsetup-initramfs/boot.key "$2/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile

echo "--> 8. Triggering pristine ramdisk and bootloader compilation..."
sudo chroot /mnt/target_clean sh -c "echo 'RESUME=none' > /etc/initramfs-tools/conf.d/resume && update-initramfs -u -k all && update-grub"

echo "--> 9. VERIFYING SUCCESS: Scanning boot target for the keyfile payload..."
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key"

echo "--> 10. Safely locking down drive structures..."
sudo umount -R /mnt/target_clean
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44
echo "======================================================="
echo " FIXED: Verification pass complete. Ready to boot! "
echo "======================================================="

tabletseeker · 2026-07-11T22:01:30Z