HarrysFerrarievich
14-01-2015, 09:20
приветствую.
у меня был криптован HDD, посредством DriveCrypt plus pack. Частично раскриптован.
После был глюк и сделал ошибочно fixboot /mbr.
по итогу слетела загрузочная область где шел запрос пароля.
После ряда рекомендаций на одном из форумов, а также при переписке с суппортом софта, была сброшена инструкция:
1: Install the SAME version of DCPP on another computer and install
Bootauth on it. Encrypt the drive and start the decryption
2: Save the first PHYSICAL sector of the boot hard drive on the other
computer with a file. I recommend to use a Windows program called HxD
for this.
3: Transfer the physical sector (512 bytes)on the hard drive with the
lost MBR overwriting the restored MBR at physical sector #0. He will
have to use a linux or DOS CD with appropriate tools for this
operation, or put the drive into another machine and run HXD
paste the data over the top of the existing MBR.
4: Scan from the physical start of the disk looking for the sector
with the following hex bytes(in ascending order)
"22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 00 00 00 00"
if the above can't be found he should search for:
"22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 01 00 00 00"
then:
"22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 02 00 00 00"
finally
"22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 03 00 00 00"
When the place on the disk is found identify the SECTOR offset of this
data. if the offset to the data is a BYTE offset the value will be
wholly divisible by 512 and it should be devided by 512. If it is a
SECTOR number then the number should be left as it is.
The SECTOR number needs to be expressed in hex. For example Sector
0x000740EF might be identified as the place where the above bytes were
found. Now the hex SECTOR number should always have at least eight
digits. so if the sector number is written as (0x) 740EF then add
leading digits so there are at least 8 digits. IE (0x) 000740EF [This
is VERY important]. Now write each pair of digits in REVERSE order,
so we get EF 40 07 00. Do NOT reverse the order of the DIGIT PAIR
which must remain the same. Basically we are dealing with "little
endian" computers which store larger values in low-high order in
ascending memory locations.
Now, on the NEWLEY restored MBR boot loader at SECTOR #0, at offset 10
decimal, (0x0A in hex) enter there - the four pairs of HEX digits,
in the newly reveresed order including any leading zero bytes. Before
these digits their should be 80 80 80 80 (but not on all versions so
don't worry if not)
Save out the sector now modified and reset the computer. If everything
has worked then the bootauth screen should appear.
Note that I cannot offer any advice on linux or DOS tools to do the
search or update the data. He needs to find someone local who knows
what they are doing. HOWEVER he can put the hard drive into another
Windows machine, and use a free program called HxD to do all he needs
including the searching. Note that offsets are expressed in BYTE
offsets so he will need to divide his hex value by 0x200 ( in calc hex
mode) or 512 in calc DEC mode, before reversing the digits.
Windows 7 calc can be placed in programmer-> HEX mode for entering the
offset and dividing down. Remember to enter 200 (Hex) for the
division when in HEX mode, which is equal to 512 decimal, the size of
one disk sector.
To access physical hard drives HxD must be started as an
administrator. BE SURE YOU ARE ACCESSING THE CORRECT HARD DRIVE with
HxD If he installs the drive in the machine he got bootauth from then
bootauth should be uninstalled on that machine first. HE will then see
a standard Windows MBR on that machine, if he opens the wrong drive.
далее мои действия по порядку и где возникла загвостка.
1. на виртуалку поставлена система, поставлен DCPP, закриптован, начал раскриптовывать-прервал (все как по инструкции и как было у меня).
2. зашел через лив-сд, сделал fixmbr.
3. зашел через лив-сд, с флешки запустил HxD, а также на флешку закинул новый newmbr с архива DCPP.
4. в HxD мне надо открыть физический диск я так понимаю? а не логический "зарезервированно системой" ?
5. открываю в HxD файл new_mbr новый который, и открываю "логический диск", тут в виртуалке правда хз как попасть на точный, ибо там их две штуки светится без обозначения буквы диска. буду смотреть по "A disk read error occurred...BOOTMGR is missing...BOOTMGR is compr".
6. настройках, выбираю "512 байт в строке", иначе я не знаю, как мне выделить сугубо 512 байт ? суть в том, чтобы выделить 512 байт в новом new_mbr и кликнуть "копировать", затем идем во вкладку с нашим логич диском и здесь "выделить все" и копировать с заменой.
Но загвостка, у меня не активно почему то "вставить".
-------------- Поправьте, если где ошибаюсь.
далее согласно инструкции от DCPP суппорта, после вышеуказанной замены, ищу
22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 00 00 00 00
и вот концовочку, может кто из технически подкованных людей понимает что следует сделать?
When the place on the disk is found identify the SECTOR offset of this
data. if the offset to the data is a BYTE offset the value will be
wholly divisible by 512 and it should be devided by 512. If it is a
SECTOR number then the number should be left as it is.
The SECTOR number needs to be expressed in hex. For example Sector
0x000740EF might be identified as the place where the above bytes were
found. Now the hex SECTOR number should always have at least eight
digits. so if the sector number is written as (0x) 740EF then add
leading digits so there are at least 8 digits. IE (0x) 000740EF [This
is VERY important]. Now write each pair of digits in REVERSE order,
so we get EF 40 07 00. Do NOT reverse the order of the DIGIT PAIR
which must remain the same. Basically we are dealing with "little
endian" computers which store larger values in low-high order in
ascending memory locations.
Now, on the NEWLEY restored MBR boot loader at SECTOR #0, at offset 10
decimal, (0x0A in hex) enter there - the four pairs of HEX digits,
in the newly reveresed order including any leading zero bytes. Before
these digits their should be 80 80 80 80 (but not on all versions so
don't worry if not)
Save out the sector now modified and reset the computer. If everything
has worked then the bootauth screen should appear.
у меня был криптован HDD, посредством DriveCrypt plus pack. Частично раскриптован.
После был глюк и сделал ошибочно fixboot /mbr.
по итогу слетела загрузочная область где шел запрос пароля.
После ряда рекомендаций на одном из форумов, а также при переписке с суппортом софта, была сброшена инструкция:
1: Install the SAME version of DCPP on another computer and install
Bootauth on it. Encrypt the drive and start the decryption
2: Save the first PHYSICAL sector of the boot hard drive on the other
computer with a file. I recommend to use a Windows program called HxD
for this.
3: Transfer the physical sector (512 bytes)on the hard drive with the
lost MBR overwriting the restored MBR at physical sector #0. He will
have to use a linux or DOS CD with appropriate tools for this
operation, or put the drive into another machine and run HXD
paste the data over the top of the existing MBR.
4: Scan from the physical start of the disk looking for the sector
with the following hex bytes(in ascending order)
"22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 00 00 00 00"
if the above can't be found he should search for:
"22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 01 00 00 00"
then:
"22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 02 00 00 00"
finally
"22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 03 00 00 00"
When the place on the disk is found identify the SECTOR offset of this
data. if the offset to the data is a BYTE offset the value will be
wholly divisible by 512 and it should be devided by 512. If it is a
SECTOR number then the number should be left as it is.
The SECTOR number needs to be expressed in hex. For example Sector
0x000740EF might be identified as the place where the above bytes were
found. Now the hex SECTOR number should always have at least eight
digits. so if the sector number is written as (0x) 740EF then add
leading digits so there are at least 8 digits. IE (0x) 000740EF [This
is VERY important]. Now write each pair of digits in REVERSE order,
so we get EF 40 07 00. Do NOT reverse the order of the DIGIT PAIR
which must remain the same. Basically we are dealing with "little
endian" computers which store larger values in low-high order in
ascending memory locations.
Now, on the NEWLEY restored MBR boot loader at SECTOR #0, at offset 10
decimal, (0x0A in hex) enter there - the four pairs of HEX digits,
in the newly reveresed order including any leading zero bytes. Before
these digits their should be 80 80 80 80 (but not on all versions so
don't worry if not)
Save out the sector now modified and reset the computer. If everything
has worked then the bootauth screen should appear.
Note that I cannot offer any advice on linux or DOS tools to do the
search or update the data. He needs to find someone local who knows
what they are doing. HOWEVER he can put the hard drive into another
Windows machine, and use a free program called HxD to do all he needs
including the searching. Note that offsets are expressed in BYTE
offsets so he will need to divide his hex value by 0x200 ( in calc hex
mode) or 512 in calc DEC mode, before reversing the digits.
Windows 7 calc can be placed in programmer-> HEX mode for entering the
offset and dividing down. Remember to enter 200 (Hex) for the
division when in HEX mode, which is equal to 512 decimal, the size of
one disk sector.
To access physical hard drives HxD must be started as an
administrator. BE SURE YOU ARE ACCESSING THE CORRECT HARD DRIVE with
HxD If he installs the drive in the machine he got bootauth from then
bootauth should be uninstalled on that machine first. HE will then see
a standard Windows MBR on that machine, if he opens the wrong drive.
далее мои действия по порядку и где возникла загвостка.
1. на виртуалку поставлена система, поставлен DCPP, закриптован, начал раскриптовывать-прервал (все как по инструкции и как было у меня).
2. зашел через лив-сд, сделал fixmbr.
3. зашел через лив-сд, с флешки запустил HxD, а также на флешку закинул новый newmbr с архива DCPP.
4. в HxD мне надо открыть физический диск я так понимаю? а не логический "зарезервированно системой" ?
5. открываю в HxD файл new_mbr новый который, и открываю "логический диск", тут в виртуалке правда хз как попасть на точный, ибо там их две штуки светится без обозначения буквы диска. буду смотреть по "A disk read error occurred...BOOTMGR is missing...BOOTMGR is compr".
6. настройках, выбираю "512 байт в строке", иначе я не знаю, как мне выделить сугубо 512 байт ? суть в том, чтобы выделить 512 байт в новом new_mbr и кликнуть "копировать", затем идем во вкладку с нашим логич диском и здесь "выделить все" и копировать с заменой.
Но загвостка, у меня не активно почему то "вставить".
-------------- Поправьте, если где ошибаюсь.
далее согласно инструкции от DCPP суппорта, после вышеуказанной замены, ищу
22 AC CD 84 88 42 AD CE CA B0 21 ED 1E 3B 58 41 00 00 00 00
и вот концовочку, может кто из технически подкованных людей понимает что следует сделать?
When the place on the disk is found identify the SECTOR offset of this
data. if the offset to the data is a BYTE offset the value will be
wholly divisible by 512 and it should be devided by 512. If it is a
SECTOR number then the number should be left as it is.
The SECTOR number needs to be expressed in hex. For example Sector
0x000740EF might be identified as the place where the above bytes were
found. Now the hex SECTOR number should always have at least eight
digits. so if the sector number is written as (0x) 740EF then add
leading digits so there are at least 8 digits. IE (0x) 000740EF [This
is VERY important]. Now write each pair of digits in REVERSE order,
so we get EF 40 07 00. Do NOT reverse the order of the DIGIT PAIR
which must remain the same. Basically we are dealing with "little
endian" computers which store larger values in low-high order in
ascending memory locations.
Now, on the NEWLEY restored MBR boot loader at SECTOR #0, at offset 10
decimal, (0x0A in hex) enter there - the four pairs of HEX digits,
in the newly reveresed order including any leading zero bytes. Before
these digits their should be 80 80 80 80 (but not on all versions so
don't worry if not)
Save out the sector now modified and reset the computer. If everything
has worked then the bootauth screen should appear.