How make bitleaker USB #2
Comments
|
Thank you @turbofiesta . Yes, you can make the bootable USB with BitLeaker. Please do the steps below.
If you have any further questions, please let me know. Best regards, Seunghun |
|
Thanks I'll try! |
|
Hi Seunghun, I just tried going through the same. With a couple extra steps (enable I would assume that it's not necessarily required, though, given the overall steps involved? The kernel module has been installed: But then I'm failing on Anything to try here? I just grabbed the live iso today: Thanks! |
|
Hi @wwade , thank you for your effort. It seems that your Ubuntu was installed under BIOS mode instead of UEFI mode. Please reinstall Ubuntu with UEFI mode and try to install the bitleaker-grub again. :) Best regards, Seunghun |
|
Here's a different question, but similar issue. When I run grub2, and boot Windows, it seems to go to the Bitlocker Recovery key instead of booting Windows. I added grub2 to the shim. At least I THOUGHT I did. Has Windows 10 updated something so that booting from something like grub2 will always result in a "failed" boot (no TPM key, always recovery key), or is it something like the UEFI mode issue you mentioned above? I THOUGHT I had installed things with UEFI. Is there a good way to check that? |
|
Hi @roboknight , The "failed" boot is just because the system is not booted with the bootmgfw.efi file directly. Please see the answer I wrote at #3 (comment). Best regards, Seunghun |
|
Yeah, that must be the other two PCR 7 values that are "different". I WISH I knew how to compute those two. That would just be awesome. Then you could pretty much just reset the device and not have to worry about replaying the log, because you know 5 of the values are fixed, and you could just compute the other two. That would be pretty amazing. Of course, those 5 values could change to something else at any time, so replaying the log is super handy, regardless. |
|
Actually, I got around this (just for analysis purposes) by booting THROUGH bitleaker and into Windows (without Bitlocker) and then checking to see if I could bind to PCR 7. Turns out you can. Then you can have bitleaker boot and watch the boot process as if you are connected to the TPM with hardware (like I mentioned in the other two comments). It really helped a lot. I now just have to figure out how to use TPM 2.0 to send the proper commands for unlocking the TPM. Once that happens, I THINK I'll be almost all the way there. I was even able to use the bitleaker I compiled that allows you to choose TCG 1.2 or TCG 2.0. I'm sure glad you had the code in there for TCG 1.2. |
|
@roboknight Wow, congratulations, and it's great news! I am impressed by your achievement. I hope I can hear good news from you soon. |
|
@kkamagui, I am SO much closer. I FINALLY have constructed a "livecd" that contains bitleaker. I wished I had discovered Cubic a lot sooner. It let me build a live CD with all of the packages needed for Ubuntu 18.04 on my Ubuntu 20.04 machine (as well as cloning a copy of bitleaker). I had to modify a few things to get Bitleaker actually loaded, but it now loads, even on a "Secure Boot" machine. Now I can FINALLY play around with the TPM properly I believe. I think I can even clone napper into it as well, that way I have a basic way to test things (your Napper live CD is super useful, but if I find something, would be nice to immediately run Bitleaker...) The only thing now is that I'd like to be able to have it "autoboot"... It doesn't really do that yet. I have to provide all the grub commands. I think it is because I modified grub without "installing it" properly. At any rate, I need to check the TPM commands, and see if I can make the "sha1" version work. |
Hi, must the live USB be persistent so as to install bitleaker? I tried creating a persistent one but it is super slow due to writes to the USB. I also similarly cannot get PCR data from the bitleaker driver, though i am fairly confident i have booted in UEFI mode (I see the grub screen as show at UEFI - Community Help Wiki and my disk partition information |
|
Hello @nickylimjj, If your USB drive is too slow, you would better use another one for speedup. By the way, does your system have a TPM v2.0? Best regards, Seunghun |
|
Hi @kkamagui I have resorted to just doing it natively on my dual-booted ubuntu. Yea it does have a TPM v2.0 I isolated the failure to the following and when i run |
|
Hi @nickylimjj , Oh, you got the right thing. Would you show me the full log data? Best regards, Seunghun |
|
Hi @kkamagui, Apologies for the delay. Pasted below. |
|
@kkamagui, was wondering if you have had the chance to analyze the logs above. Thank you. |
|
Hello @nickylimjj , According to your log messages, your system failed to execute TPM2_PolicyAuthorize(). This means that your system doesn't use the same PCR policy as other systems. BitLeaker focuses on the Bitlocker drive configured with the Secure boot policy. Best regards, Seunghun |
|
Thanks for the analysis! I am currently investigating my PC's secureboot policy as I have the error message Will share my findings with you after finding them out. [Update: Looking at the bitlocker-api logs in Event Viewer, it seems that the reason it |
|
Hi, I have deduced it to be the secure boot option "enable MS UEFI CA Key"
|
Apologies @kkamagui, but going back to the original question, must I use a persistent USB? (i used |
To update, I manage to perform a regular Ubuntu install (along with the bootloader) onto a USB 3.0. None of the 'persistent live' or live ubuntu. So my /dev/sdXY is mounted on /boot/efi and /dev/sdXZ is mounted on /. bitleaker's bootloader (grubx64.efi) is on the The Thank you. |
I might have had some experience with this. Basically, I ended up creating a python3 version of the script that works. It appears that your system supports full TPM 2.0... my script SHOULD work for you, but I've had mostly systems I'll label as TPM 1.2 compatible (they support TPM 2.0, but they use SHA1 instead). I believe my github fork has the script up to date, but I think it should fix your problem. |
|
You can take a look at my Python3 script also and you may see some differences in the headers. Also, you might have to set TPM2TOOLS_TCTI to your TPM device... Probably not, since I THINK your device is being handled appropriately, but I did have a version of my python3 script that was checking that environment variable. At any rate, I think I was in the middle of refactoring something, but I believe you need to take a look at tpm2_load.bin and see what it has in it. For SHA1 the header had to change, but you have the SHA2 (which was his original code I think)... at Any rate, I believe the SHA2 header should be:
Then you just have to make sure the 32 bytes of hash are getting put into the tmp2_load.bin file correctly. Also, as a quick check, tpm2_load.bin should be 0xf7 bytes long (247 bytes). |
|
Just in case, TPMTOOLS2_TCTI should be set something like this: Again, not sure you need THIS as it DOES appear your TPM device is being accessed. |
|
Hi @roboknight thanks for your response! I have tried your scripts out, but I don't seem to have the |
|
I don't suppose you'd be able to upload a copy of your ISO you built through Cubic? I'm having trouble getting a bootable USB built! |
Here is a link
Basically, you SHOULD just need to boot USB first. It doesn't need to install anything. This was a rough pass and I haven't needed to use this for a while. I have the following rough steps:
Not sure if you really need the uuid line, but it was what I had. At any rate, it may or may not work for you. As I said, it doesn't autoboot. It may hang, it may crash, it might do all kinds of things, so no warranty, expressed, or implied. |
The above comment was meant for you. It wouldn't let me escape a previous comment I started and wanted to bail on. |
You have to have the latest tpm2-tools ... I'm surprised the source repos didn't work there because that's been how I've updated my tpm2-tools. I haven't had to build them for a little while though, so maybe they've introduced a build bug that causes bootstrap to fail? At any rate, I believe this is something I might have run into if I failed to 'sleep' a second time. There is a flag that gets set that indicates a "dirty" TPM... one that had a context that was effectively flushed by this process. I think it wants the context back. To fix it, my script slept a second time, cleaning the "dirty" TPM bit. But when it sleeps the second time, it is WITHOUT the driver. This way, the TPM thinks it is restored. It is, just with a PCR slate of all zeros. I then had to "set up" the TPM slightly. I think this is where the tpm2_hierarchy comes in, IIRC. I think I just got the TPM2_TOOLS from Github and built the master branch. I'm not sure when tpm2_hierarchycontrol was introduced. But that is what it is doing, is re-enabling the platform hierarchy (that's, I believe, the key you want to use) as well as another one. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Great job!!!!
Maybe you are planning to release a ready bitleaker USB version (.iso) ? I want to test this on my system.
Or maybe you can give some advice how can I do it myself (how to create a bootable bitleaker USB).
Thank you!
The text was updated successfully, but these errors were encountered: