[gentoo-user] OT - Recover luks keys from a mounted crypted partition / extract initramfs from kernel

[gentoo-user] OT - Recover luks keys from a mounted crypted partition / extract initramfs from kernel

[Rodrigo Forlin]

Hello all,

    I have a system with two partitions:

        - hda1 - /boot with grub files and kernel image with initramfs
embedded with CONFIG_INITRAMFS_SOURCE kernel option

        - hda2 - luks crypted root partition

    Every time kernel boot, loads embedded initramfs, which has the
--key-file, luksOpen hda2, mounts the partition and switch_root to it.

    The problem is that i make some mistakes ($#%$#@@) on my system
and i can`t login anymore (i played a little too much with passwd and
shadow files). But I have an old hd image, with the same --key-file,
also embedded into kernel, but with this one i can login.

    I don`t have the --key-file anymore. Just the ones in initramfs. I
thought about 2 alternatives to recover this key-file, but didn`t
succeded in any of them. Can someone help me to:

         - Recover the --key-file from a already mounted and decrypted
partition or

         - Extract the initramfs from kernel, so i can unzip and
(un)cpio it, so i can get my file from it.

    I`ve already tried adding a different init=/path/to/init into
grub, but how i made my init from scrach, i`m ignoring these kernel
parameters;

    I also tried to extract the initramfs with objcpy, but the kernel
file format is unrecognized.

    Using kernel-2.6.16-gentoo-r13.

    Don`t know what else i can try.

    TIA,

Rodrigo Forlin
-- 
gentoo-user@gentoo.org mailing list