ads

dimanche 13 septembre 2015

[FIX] FED-Patcher (ForceEncrypt Disable Patcher)



Hello everybody,

I created a tool for the nexus 9 that gets rid of the ForceEncrypt flag in a generic way. It does that by patching the currently installed boot.img.

Background
The Android CDD (Compatibility Definition Document) suggests that all devices SHOULD enable full disk-encryption (FDE) by default. Even though I support every step towards more security I have to criticize this approach. FDE comes at a price. Encryption takes time because some component has to de- and encrypt the stuff on the disk at some point and in the case of the nexus 9 (aka flounder) it's the CPU's task. Even though the nexus 9's CPU has 4 pretty fast cores you can still easily feel the difference between FDE in the on- or off-state. The I/O is faster and boot-times take only half as long. (I did not do any measurements)
There is an ongoing discussion about this topic in cyanogenmod's gerrit. Although it's a fun read it is pretty clear that this exchange of views is not going anywhere near a useful outcome.
Because performance is important to me and my tablet does not need the extra security I created the FED-Patcher (ForceEncrypt Disable Patcher)

How does it work?
FED-Patcher is a simple flashable ZIP that is supposed to be run in a recovery that has busybox integrated (like TWRP or CWM). This is what it does:
  1. Checks if your device is compatible

  2. Dumps the currently installed boot.img.

  3. Unpacks the dump of your currently installed boot.img. The unpacking process is done via a self-compiled, statically linked version of unmkbootimg.

  4. It patches the filesystem tables which include the force-enable flags. This process will change "forceenable" to "encryptable".

  5. Creates a new boot.img. The unpacking process is done via a self-compiled, statically linked version of mkbootimg.

  6. Flashes the modified boot.img


Supported devices
  • HTC Nexus 9 WiFi (flounder)

In theory, the HTC Nexus 9 LTE (flounder_lte) should work too but I have no device for testing.

What do I need to make this work?
  1. A supported device (Your nexus 9)

  2. An already installed ROM with forceencrypt flag. (like cyanogenmod CM12.1)


How do I use it?
  1. Make a thorough, conservative backup of your data if there is any on your device

  2. Go into your recovery (TWRP, CWM)

  3. Flash fed_patcher-signed.zip

  4. If your device is already encrypted (You booted your ROM at least once) you need to do a full wipe to get rid of the encryption. This full wipe will clear all your data on your data-partition (where your apps as well as their settings are stored) as well as on your internal storage so please, do a backup before. If you don't do a backup and want to restore your data... well... Call obama.


Is it dangerous?
Well, I implemented tons of checks that prevent pretty much anything bad from happening. But, of course, we're dealing with the boot-partition here. Even though I tested FED-Patcher quite a lot there is still room for crap hitting the fan.

Screenshot
Scroll down to the attached thumbnails.

Credits
* pbatard for making (un)mkbootimg (dunno if he is on xda)
* @rovo89 for his xposed framework - I used some of his ideas by reading the source of his xposed installer flashable ZIP for FED-Patcher.








Attached Thumbnails


Click image for larger version<br/><br/>Name:	Screenshot.jpg<br/>Views:	N/A<br/>Size:	114.1 KB<br/>ID:	3472146
 











Attached Files






File Type: zip fed_patcher-signed.zip -
[Click for QR Code]
(1.22 MB)







Aucun commentaire:

Enregistrer un commentaire