Let's play with crypto!

9 min read Original article ↗

  • Ange Albertini Reverse engineering & Visual Documentations http://corkami.com

  • Crypto is hard!

  • HORROR And this is my usual reaction...

  • ...but I can still have fun with it...

  • PNG TrueCrypt Crypto ...so let’s play together !

  • AES Advanced Encryption Standard

  • 1 block (16 bytes)

  • we can’t control the output the differences are unpredictable

  • the opposite operation

  • we can restore the original block outwith the encryption key,

  • Recap • AES encrypts a block ◦ we don’t control

    the output • an encrypted block can be restored ◦ with the encryption key • encryption ⇔ decryption are just inverse functions ◦ we can decrypt plaintext ◦ we can recover the original block via encryption • we can’t control both input and output ◦ one, or the other

  • PNG Portable Network Graphics

  • The PNG format is made of chunks, like a cow.

  • Our beef chunks.

  • \x89 P N G \r \n ^Z \n Compulsory signature

    at offset 0 • identify the file type • identify transfer errors ◦ \x89 : non ASCII (ASCII = [0 - 128]) ◦ \r\n then \n : different end of line standards ◦ ^Z (\x1A) : “End Of File”

  • IHDR chunk: containing image information

  • IDAT chunk (compressed): pixels values

  • IEND chunk: End of File (‘s structure)

  • duckdu ckgo How can we encrypt oogle into uc?k

  • input and output? How can we control

  • key + initialization vector X blocks X blocks

  • = = = = ENC(IV ^ P1) IV ^ P1

    IV P1 ^ DEC(C1) C1 DEC(C1) P1 ^ DEC(C1) ⇒ IV Relations between blocks and IV We get a relation of IV from P1 and C1

  • How can we control the structure via encryption?

  • If we encrypt our picture, we get random data.

  • If we append another picture to this random data...

  • How can we control crypted data ?

  • We won’t☺ We’ll ask the file format to ignore it.

  • Adding a standard comment chunk (tEXt type)

  • The chunk position doesn’t matter.

  • Adding a completely custom bing chunk.

  • Step by step

  • Initial checks • S is a PNG ◦ the PNG

    format tolerates appended data • T is a PNG ◦ it allows custom chunks (at the beginning of the file, right after the signature) • S fits in a single chunk ◦ its size can be encoded in 4 bytes • AES-128 has a 16 bytes block size ◦ big enough to declare a chunk after the signature

  • Determine the first cipher block • R starts with P1,

    from S • once encrypted, R starts with: a. an 8 byte PNG signature b. a custom chunk ▪ that covers all the chunks from S 1. S is 14022 bytes, so that’s 14016 bytes of chunks 2. 14016 is encoded 000036c0 ▪ with a custom type: rmll lowercase ⇒ ancillary ⇒ ignored First cipher block of R, C1: 89 P N G \r \n 1A \n 00 00 36 C0 r m l l Signature ------------- Length ----- Type ------

  • First plaintext / cipher blocks First block of R, P1:

    89 P N G \r \n 1A \n 00 00 00 0D I H D R Signature ------------- Length ----- Type ------ First block of encrypted R, C1: 89 P N G \r \n 1A \n 00 00 36 C0 r m l l Signature ------------- Length ----- Type ------

  • Craft R The IV is determined. • Pad S to

    the next 16 bytes alignment • Encrypt via AES-CBC with our parameters → with this IV, S will start with: (after encryption) 1. a signature 2. a rmll chunk (covering the rest of S)

  • Result 1. signature 2. S chunks 3. padding 4. T

    chunks (pre-decrypted) 0000: 89 50 4E 47-0D 0A 1A 0A-00 00 00 0D-49 48 44 52 ëPNG IHDR 0010: 00 00 02 1A-00 00 00 BE-08 06 00 00-00 73 AB A6 + s½ª 0020: F7 00 00 36-8D 49 44 41-54 58 C3 EC-D9 CB 7A D3 ˜ 6ìIDATX+8+-z+ 0030: 66 02 C6 71-3A 9D 43 DB-95 9F 67 3A-09 98 10 4C f ¦q:¥C¦òƒg: ÿ L ... 36A0: F5 2D D0 30-33 33 33 BB-C4 3C 04 33-33 33 BB D8 )--0333+-< 333++ 36B0: FE 07 A4 AD-F2 BC 37 7B-32 76 00 00-00 00 49 45 ¦ ñ¡=+7{2v IE 36C0: 4E 44 AE 42-60 82 00 00-00 00 00 00-00 00 00 00 ND«B`é.......... 36D0: 43 F7 62 F2-4C 6A 07 4D-03 41 82 84-3C D3 F4 39 C˜b=Lj M Aéä<+(9 36E0: FC 27 90 6B-82 71 C8 34-3E 48 4D C1-4C 2A BB 96 n'Ékéq+4>HM-L*+û 36F0: 3C 97 01 67-FE B3 E4 03-E9 09 B2 C3-7E 54 B7 23 <ù g¦¦S T ¦+~T+# 3700: 57 37 3F 1E-DF 67 B3 E8-60 B3 EC A6-CA 51 61 11 W7? ¯g¦F`¦8ª-Qa ... 5CE0: CC 22 8A A0-EC 19 8C DD-26 79 03 29-03 90 93 F1 ¦"èá8 î¦&y ) Éô± 5CF0: 41 CE 4F DB-C0 70 A5 74-D0 74 B7 2E-06 9B 48 7C A+O¦+pÑt-t+. ¢H| 5D00: 2F A6 D1 ED-57 FB 88 67-D1 B0 10 4C-1C 6E CB 15 /ª-fWvêg-¦ L n-

  • 1. signature 2. custom chunk a. CRC32 3. T chunks

    4. padding Encrypted result 0000: 89 50 4E 47-0D 0A 1A 0A-00 00 36 C0-72 6D 6C 6C ëPNG 6+rmll 0010: 9A 3E 30 1C-F1 D6 E1 41-B7 38 DB A1-5A 71 57 8F Ü>0 ±+ßA+8¦íZqWÅ 0020: 6E 49 A0 D5-76 4C 33 7D-9B CA 44 B8-72 27 48 D9 nIá+vL3}¢-D+r'H+ 0030: 64 20 A6 7F-38 D8 89 4A-9F 5F 92 45-17 5D 70 BA d ª8+ëJƒ_ÆE ]p¦ ... 36A0: 4D 1E 79 E7-9E F5 81 AC-0C 4C 3B 03-75 43 2B 15 M ytP)ü¼ L; uC+ 36B0: B6 9F F4 32-E8 3C 02 67-96 DA 7B 1D-A8 E5 1E BF ¦ƒ(2F< gû+{ ¿s + 36C0: D1 04 25 DF-E5 92 E3 62-30 9A F6 08-60 57 BC 5B - %¯sÆpb0Ü÷ `W+[ 36D0: 98 38 F0 D6-00 00 00 0D-49 48 44 52-00 00 00 86 ÿ8=+ IHDR å 36E0: 00 00 00 86-08 02 00 00-00 97 1B 65-C6 00 00 25 å ù e¦ % 36F0: FE 49 44 41-54 78 5E D4-C0 C1 0A 00-10 0C 00 50 ¦IDATx^++- P 3700: FF FF 6F CA-8D B8 A8 95-92 1C 56 0E-36 9B F9 0E o-ì+¿òÆ V 6¢· ... 5CE0: EE 4B 05 D4-46 49 B3 66-30 ED 6E BF-E7 23 7B C9 eK +FI¦f0fn+t#{+ 5CF0: C8 D7 51 F8-99 B7 9C 00-00 00 00 49-45 4E 44 AE ++Q°Ö+£ IEND« 5D00: 42 60 82 00-00 00 00 00-00 00 00 00-00 00 00 00 B`é.............

  • For more information (PDF, JPG, GynCryption, PiP…): https://speakerdeck.com/ange/when-aes-equals-episode-v https://www.youtube.com/watch?v=wbHkVZfCNuE

  • Let’s play with TrueCrypt

  • ëPNG♪◙→◙ ♪IHDR ☻→ ╛◘♠ s½ª ≈ 6ìIDATX├∞┘╦z╙ ╪ α ►JFIF

    ☺☺☺ ┤ ┤ █ C ♠♦♣♠♣♦♠ ♠♣♠••♠◘◙►◙◙◦◦◙¶♫ ☼♀►↨¶↑↑↨¶▬▬→↔%▼→ ←#∟▬▬ , #&')*)↓▼ -0-(0%()( █ C☺•• •◙◘◙‼◙◙‼(→▬→(((( (((((((((((((((( %PDF-1.3◙%─σ≥σδº ≤á╨─╞◙4 0 obj◙<< /Length 5 0 R / Filter /FlateDec ode >>◙stream◙x☺ ⌂ELF☺☻☺♥ ☻ ¶ ☺ ▬:É 4 4 ☻ ( ☺ ► ► ♠K¼ ♠K¼ ♣ ☺ ☺ ∙Φ► ∙Φ ► ∙Φ ♠ ☺ ╣E)lUPX!↓◄♪ä MZÉ ♥ ♦ ╕ @ ◘☺ ♫▼║♫ ┤◦═!╕☺L═!Th is program canno t be run in DOS mode.♪♪◙$ PK♥♦¶ ◘ î◄|>á# SÇ≈♀ ♫∟ ↕ Cl ftypisom ☻ isomiso2avc1mp41 *freevideo se rved by mod_h264 _streaming ▲¿<mo ov lmvhd |% ░Ç|%░Ç ♥Φ ),( ☺ Standard file format headers ZIP JPG PE

  • d/Γ↨jôù☺♫Ö▲b¶n0ï ∟RKl♣╟┐l⌂QH┐▐φ♫ö ┬_φ┬Ió£ná→╖G∙♣Σ► -◄8╓ZX◙nb¶ìMÇx▄Ö ╟ü╪Gñö◙-•╢É}►f~+ m←↓ü;·\$¿4σ╫áú≈₧ U'k~ù^▒H▄s₧╦êΘµ♦ ♠╔,Gδ;åa┤∙NßWπsδ »M\π◄=┌G]t +ßQ^l

    ┴mí≡èτDz╜&╜⌠╨SOî Vg£ª}ù↓¢┘;4Γ╖á♠┘ ñ▼ö►:♂╠L♦9♂╚╢ÆH( ô ª╛‼ß±ùH»S╪g)m' (7☻òá╡L'6G☺ÖÇ♠"î üLδ░╣»e╧¬ç╒"∞òα~ ░§§É↑â╜ærâp╥xε▲♣ ┌Uü╜╫l╪Ñ≥ôùRc∙╠Γ ¡öàx₧╢₧╚f▌Z┘é♪!Ω L◄±Ä3╬╤ε}:ÇRu╒º¢ ▬£÷Cd▼├à·3g~Bêc┌ MΦvεÖ/à╕⌂Ñ9ôΓ≈♫╤ ┐╩P┴╥F¥0½╙'*"ú▌◙ ¡╔^輶│ÅDN▌♀♂¬↨♠ !>τ╡⌐A!┬W`δÜp£]₧ Y≡yí#û?♥╞-î§yY¶╖ ◦σï½Ü◙E¬"╫⌂2Θ♠╨6 ⌡ù@e7▲▬▌╒<╤TQTHΩ Ω╟╬ìPδW9▀8◄Σê♫╨Ω ♦♠Æ►♂r▬╜E╣&╚☻⌠¬░ πa ┐╪å<6▀vMR6₧☻: ♦: n┬F≡_τ╝╫╦≡m▌▬ ┬ô£Ç`☼Jl◘∞• ÿ╗≥∞ ╒[►y♠→↨Ñà╩t‼╫α┬Å J·¶ë├α♫╠◄Θi_╥I╗╗ ≤╟úKû•=┘╩☺§§.rΩP ≥↔?{♠àQ{╓◘≈┼╜╕|½ Q&f►∞Ü→▄σÖσû►↑¶4 ╜>e#TrÄ5 HòƒÑV▄║ ▬╤íΦDi╔)↑â←Ü─+┌∞ Kd(¢╚ñ╖¢MTac▪▌l± é«Cñ─=¿N_↨N►♫φÅε ╔o╧Y1Z$Σ▬╨h╬a¥¼j ↓M¬┐Y#°h≡¿?σ┬♀c| ▀;P,→k;Q^▄x▓α▌½┬ │7e9"⌡ÆΦ╬▓ⁿD²#Ç▼ ═«↓⌐☻┐Σü╘∟¼î¼╟ùI è╖$Aσ♣²=ß>└▀K∩τì 0►n#ƒ☼ⁿs@ ♫0-X▀☼ ₧w,ΓòR☻ù♠◦├ï☻s◦x ±Σ.hƒ9◄▒5w♣☼⌠◦▬â +ÑΣ≈↕▀┘τ╗ N¼ciâ% I╤l►éLóO8♣±Çs▀◦↨ ☺╔i╪.~¶Ge╢Ög╗█÷* ‼Vö▀%.í÷# 3éÑûÇ♦ δ═├CµO*$M▲ç5{Z?φ τΦL├{╗ùΦ▲²÷═ⁿW╗P /¼◙^←[│╣¡ xɵ1hF Headers of different TrueCrypt files.

  • TRUE ♣• Iî$B É ☻ É ☻ C¬α╔Ñ «ÑêI█⌠▬♀D╣▼xΦm↓¬0τzP°W5» ╣FcJl¼∙L¢▒9Oä°

    τEpó&←╠¿oµÆ☺▬ìä5Θä↨_◦¼I┐¡ ╟ü╪Gñö◙-•╢É}►f~+m←↓ü;·\$¿4σ╫áú≈₧ U'k~ù^▒H▄s₧╦êΘµ♦♠╔,Gδ;åa┤∙NßWπsδ »M\π◄=┌G]t +ßQ^l┴mí≡èτDz╜&╜⌠╨SOî Vg£ª}ù↓¢┘;4Γ╖á♠┘ñ▼ö►:♂╠L♦9♂╚╢ÆH( ô ª╛‼ß±ùH»S╪g)m'(7☻òá╡L'6G☺ÖÇ♠"î üLδ░╣»e╧¬ç╒"∞òα~░§§É↑â╜ærâp╥xε▲♣ ┌Uü╜╫l╪Ñ≥ôùRc∙╠Γ¡öàx₧╢₧╚f▌Z┘é♪!Ω L◄±Ä3╬╤ε}:ÇRu╒º¢=2ñ∩╝·└¬╝╣♀║æ╘Q╔ Aüµ{w{y◙ƃom¥↕ú±╣}k▄0◦◄↑Ä╪┌&D?í√ ╒Z█ jαÆ╙ë{/╗αô.*R←pr(b?▼◄&åÆ▲Θ[É bƵA▲ºßÑ∟Θ▀döòêî♪Ω&yá╔☼◘┌╧>▲╓M1* ╦*¡∟☺4Å)▼ôTαÉ÷↔+◙‼M« :▼GF[($nΘ÷Å ▌╣èTΦ▲Sσ▪ëOì#÷ô]+◄:f9ôτu╓█B▒♦▬█↕ ♫╪(Z⌡▬ñ[< G]≡ÇâΦ╗⌂█∟⌠í<|æ9oΣ║z!L A TrueCrypt header, before and after decryption.

  • Strategy 1. Modify the host to make free space near

    the beginning ◦ create a custom chunk to contain the volume 2. Copy the header and the volume’s content ◦ the decrypted header hasn’t changed, and the volume hasn’t either 3. Decrypt the header ◦ with the initial salt 4. Re-crypt the header ◦ with the salt from the start of the host 5. Adjust the CRC of the chunk ◦ optional, as the chunk is ancillary

  • ëPNG♪◙→◙ ♪IHDR ☻→ ╛◘♠ s½ª ≈ 6ìIDATX├∞┘╦z╙f☻╞q:¥C█òƒg:◦ÿ►L τ♠╝₧Æáp╩njB╚üC►▌╡Ñ┼ä╬^wα←h►9┴∞|♣ Eí7α⌡äâÆmí╚w≡═√╔û-┘Æ¡ôc[~▀τ∙»║¬∞ ∩╦☼∙ö►Γ¶cî1╞╪

    ΓC`î1╞╪`í1i¢yl)▓│e K│{dUæ!╦?▓jHtvµ'ºÅ₧N °╤Då½◙╥ª←)▓ S∟╟q∟7⌐╦24╬=╢◙¿ä4└┬@&↕N@FúGφ≥☺⌡Ç åo╙▪↓╙☼ ╨æå¶öπ7Éπ8Ä#4╞d│¢⌡┬∞ªU♠, ¬╚D┬i╞º▬4B`#%h◘αó3│ëÅ≥╘├☼E~#9Äπ8 Bcäv~│^☻0*╚DBµ♠F/lDüF←←⌐Cú§á!ª~° `!↔⌐êo<8Äπ8Bc◘╕PÉļ≤M\x♂•ìx?ƒ♀∟→ ¥U%:▪±=╤┴q▄Σφïτ▀ΩHx┌wzαm»G╗25|;≈ k|·‼♠ì┬ôz☺i╚ö╕p7Lh♦a#64ⁿ▒! ♪⌠╛èJ ⁿ╓r∟7◄╚x☺d╝ (:kíπü╖²▲┘αP╗≤çFφï↔ò ╕¢¶h ▬◙╥æpΩä╞∙‼àå5Lh8Y¿é◙ⁿ♠s∟ùI dⁿ7 ↓/:▐nñ☼ì→"2&☺→↨~«+╚p♥#<4Ω╛╨p a├D♠╥Ç♀Ö☻`┤╩•♦dáÅeñí◙2É↓ΘτôD╨≡`├ I╛σP°Mµ8.+√ⁿ┼╖:↕v╧♥┌wzαm/á]Ö┌▌ĺ ┌τ|ôæ}h|╒♦♠↕Nqá╤±Vúè44░?╚Çàé╩HGµ ◦BC|∙¥¥ü◘♫Äπ▓âîôà♠ææuh ↑Ed|σ☻F►4 ⁿ░╤☺♪♂╨╨☺ï╥░▪⌂Çè"*ú┌◦Aâαα8n2ɱ< ↓±íAdd↓→ÇE♫Θ↕↑N◦áQEÑQ{╞ Fíë♫≤♦áA pp∟7v√♀╚°∞┼♥ßΘy@√Njw{☺φ╩εw╖s┐åêî d/Γ↨jôù☺♫Ö▲b¶n0ï∟RKl♣╟┐l⌂QH┐▐φ♫ö ┬_φ┬Ió£ná→╖G∙♣Σ►-◄8╓ZX◙nb¶ìMÇx▄Ö ╟ü╪Gñö◙-•╢É}►f~+m←↓ü;·\$¿4σ╫áú≈₧ U'k~ù^▒H▄s₧╦êΘµ♦♠╔,Gδ;åa┤∙NßWπsδ »M\π◄=┌G]t +ßQ^l┴mí≡èτDz╜&╜⌠╨SOî Vg£ª}ù↓¢┘;4Γ╖á♠┘ñ▼ö►:♂╠L♦9♂╚╢ÆH( ô ª╛‼ß±ùH»S╪g)m'(7☻òá╡L'6G☺ÖÇ♠"î üLδ░╣»e╧¬ç╒"∞òα~░§§É↑â╜ærâp╥xε▲♣ ┌Uü╜╫l╪Ñ≥ôùRc∙╠Γ¡öàx₧╢₧╚f▌Z┘é♪!Ω L◄±Ä3╬╤ε}:ÇRu╒º¢=2ñ∩╝·└¬╝╣♀║æ╘Q╔ Aüµ{w{y◙ƃom¥↕ú±╣}k▄0◦◄↑Ä╪┌&D?í√ ╒Z█ jαÆ╙ë{/╗αô.*R←pr(b?▼◄&åÆ▲Θ[É bƵA▲ºßÑ∟Θ▀döòêî♪Ω&yá╔☼◘┌╧>▲╓M1* ╦*¡∟☺4Å)▼ôTαÉ÷↔+◙‼M« :▼GF[($nΘ÷Å ▌╣èTΦ▲Sσ▪ëOì#÷ô]+◄:f9ôτu╓█B▒♦▬█↕ ♫╪(Z⌡▬ñ[< G]≡ÇâΦ╗⌂█∟⌠í<|æ9oΣ║z!L Ö╚Sâìí°B'⌡♪♀┬Q1▪#┐[∟█╝╜x│I╨♦┌½c╪ ▬\è▄UYÆ/º·╝☻0£MP╔ê¿J♪_>╡∟╢εVRt╣i ª÷┘FÆ╬C╕µïc┘$☺ƒc»-7JÅï◦})ªj♪σ+Θê ↑(Ä╔•é░u_─◙Xm½8▬╫á≤≥╗▬à<↑GÄ≈4G߬ ↑µ^═Γu╩úC┐☻╟iÆ▀Ñ»FS∟≥▪♂╕WCÑ╨ê±²ñ äδ:ºék╡nÄw╩ßÆ▬!z∞♫ N½Φ╒┼C◘╬ÑÑ ?D ... TrueCrypt volume Image

  • ëPNG♪◙→◙ ♪IHDR ☻→ ╛◘♠ s½ª ≈ ♦Å╫true d/Γ↨jôù☺♫Ö▲b¶n0ï∟RKl♣╟┐l⌂QH┐▐φ♫ö ┬_φ┬Ió£ná→╖G∙♣Σ►-◄8╓ZX◙nb¶ìMÇx▄Ö ╟ü╪Gñö◙-•╢É}►f~+m←↓ü;·\$¿4σ╫áú≈₧

    U'k~ù^▒H▄s₧╦êΘµ♦♠╔,Gδ;åa┤∙NßWπsδ »M\π◄=┌G]t +ßQ^l┴mí≡èτDz╜&╜⌠╨SOî Vg£ª}ù↓¢┘;4Γ╖á♠┘ñ▼ö►:♂╠L♦9♂╚╢ÆH( ô ª╛‼ß±ùH»S╪g)m'(7☻òá╡L'6G☺ÖÇ♠"î üLδ░╣»e╧¬ç╒"∞òα~░§§É↑â╜ærâp╥xε▲♣ ┌Uü╜╫l╪Ñ≥ôùRc∙╠Γ¡öàx₧╢₧╚f▌Z┘é♪!Ω L◄±Ä3╬╤ε}:ÇRu╒º¢=2ñ∩╝·└¬╝╣♀║æ╘Q╔ Aüµ{w{y◙ƃom¥↕ú±╣}k▄0◦◄↑Ä╪┌&D?í√ ╒Z█ jαÆ╙ë{/╗αô.*R←pr(b?▼◄&åÆ▲Θ[É bƵA▲ºßÑ∟Θ▀döòêî♪Ω&yá╔☼◘┌╧>▲╓M1* ╦*¡∟☺4Å)▼ôTαÉ÷↔+◙‼M« :▼GF[($nΘ÷Å ▌╣èTΦ▲Sσ▪ëOì#÷ô]+◄:f9ôτu╓█B▒♦▬█↕ ♫╪(Z⌡▬ñ[< G]≡ÇâΦ╗⌂█∟⌠í<|æ9oΣ║z!L Ö╚Sâìí°B'⌡♪♀┬Q1▪#┐[∟█╝╜x│I╨♦┌½c╪ ▬\è▄UYÆ/º·╝☻0£MP╔ê¿J♪_>╡∟╢εVRt╣i ª÷┘FÆ╬C╕µïc┘$☺ƒc»-7JÅï◦})ªj♪σ+Θê ↑(Ä╔•é░u_─◙Xm½8▬╫á≤≥╗▬à<↑GÄ≈4G߬ ↑µ^═Γu╩úC┐☻╟iÆ▀Ñ»FS∟≥▪♂╕WCÑ╨ê±²ñ äδ:ºék╡nÄw╩ßÆ▬!z∞♫ N½Φ╒┼C◘╬ÑÑ ?D ... Create free space in the file to host the volume.

  • d/Γ↨jôù☺♫Ö▲b¶n0ï∟RKl♣╟┐l⌂QH┐▐φ♫ö ┬_φ┬Ió£ná→╖G∙♣Σ►-◄8╓ZX◙nb¶ìMÇx▄Ö ╟ü╪Gñö◙-•╢É}►f~+m←↓ü;·\$¿4σ╫áú≈₧ U'k~ù^▒H▄s₧╦êΘµ♦♠╔,Gδ;åa┤∙NßWπsδ »M\π◄=┌G]t +ßQ^l┴mí≡èτDz╜&╜⌠╨SOî Vg£ª}ù↓¢┘;4Γ╖á♠┘ñ▼ö►:♂╠L♦9♂╚╢ÆH( ô ª╛‼ß±ùH»S╪g)m'(7☻òá╡L'6G☺ÖÇ♠"î üLδ░╣»e╧¬ç╒"∞òα~░§§É↑â╜ærâp╥xε▲♣

    ┌Uü╜╫l╪Ñ≥ôùRc∙╠Γ¡öàx₧╢₧╚f▌Z┘é♪!Ω L◄±Ä3╬╤ε}:ÇRu╒º¢=2ñ∩╝·└¬╝╣♀║æ╘Q╔ Aüµ{w{y◙ƃom¥↕ú±╣}k▄0◦◄↑Ä╪┌&D?í√ ╒Z█ jαÆ╙ë{/╗αô.*R←pr(b?▼◄&åÆ▲Θ[É bƵA▲ºßÑ∟Θ▀döòêî♪Ω&yá╔☼◘┌╧>▲╓M1* ╦*¡∟☺4Å)▼ôTαÉ÷↔+◙‼M« :▼GF[($nΘ÷Å ▌╣èTΦ▲Sσ▪ëOì#÷ô]+◄:f9ôτu╓█B▒♦▬█↕ ♫╪(Z⌡▬ñ[< G]≡ÇâΦ╗⌂█∟⌠í<|æ9oΣ║z!L Ö╚Sâìí°B'⌡♪♀┬Q1▪#┐[∟█╝╜x│I╨♦┌½c╪ ▬\è▄UYÆ/º·╝☻0£MP╔ê¿J♪_>╡∟╢εVRt╣i ª÷┘FÆ╬C╕µïc┘$☺ƒc»-7JÅï◦})ªj♪σ+Θê ↑(Ä╔•é░u_─◙Xm½8▬╫á≤≥╗▬à<↑GÄ≈4G߬ ↑µ^═Γu╩úC┐☻╟iÆ▀Ñ»FS∟≥▪♂╕WCÑ╨ê±²ñ äδ:ºék╡nÄw╩ßÆ▬!z∞♫ N½Φ╒┼C◘╬ÑÑ ?D ... ëPNG♪◙→◙ ♪IHDR ☻→ ╛◘♠ s½ª ≈ ♦Å╫true ╟ü╪Gñö◙-•╢É}►f~+m←↓ü;·\$¿4σ╫áú≈₧ U'k~ù^▒H▄s₧╦êΘµ♦♠╔,Gδ;åa┤∙NßWπsδ »M\π◄=┌G]t +ßQ^l┴mí≡èτDz╜&╜⌠╨SOî Vg£ª}ù↓¢┘;4Γ╖á♠┘ñ▼ö►:♂╠L♦9♂╚╢ÆH( ô ª╛‼ß±ùH»S╪g)m'(7☻òá╡L'6G☺ÖÇ♠"î üLδ░╣»e╧¬ç╒"∞òα~░§§É↑â╜ærâp╥xε▲♣ ┌Uü╜╫l╪Ñ≥ôùRc∙╠Γ¡öàx₧╢₧╚f▌Z┘é♪!Ω L◄±Ä3╬╤ε}:ÇRu╒º¢=2ñ∩╝·└¬╝╣♀║æ╘Q╔ Aüµ{w{y◙ƃom¥↕ú±╣}k▄0◦◄↑Ä╪┌&D?í√ ╒Z█ jαÆ╙ë{/╗αô.*R←pr(b?▼◄&åÆ▲Θ[É bƵA▲ºßÑ∟Θ▀döòêî♪Ω&yá╔☼◘┌╧>▲╓M1* ╦*¡∟☺4Å)▼ôTαÉ÷↔+◙‼M« :▼GF[($nΘ÷Å ▌╣èTΦ▲Sσ▪ëOì#÷ô]+◄:f9ôτu╓█B▒♦▬█↕ ♫╪(Z⌡▬ñ[< G]≡ÇâΦ╗⌂█∟⌠í<|æ9oΣ║z!L Ö╚Sâìí°B'⌡♪♀┬Q1▪#┐[∟█╝╜x│I╨♦┌½c╪ ▬\è▄UYÆ/º·╝☻0£MP╔ê¿J♪_>╡∟╢εVRt╣i ª÷┘FÆ╬C╕µïc┘$☺ƒc»-7JÅï◦})ªj♪σ+Θê ↑(Ä╔•é░u_─◙Xm½8▬╫á≤≥╗▬à<↑GÄ≈4G߬ ↑µ^═Γu╩úC┐☻╟iÆ▀Ñ»FS∟≥▪♂╕WCÑ╨ê±²ñ äδ:ºék╡nÄw╩ßÆ▬!z∞♫ N½Φ╒┼C◘╬ÑÑ ?D ... Copy the volume in the created space. ⇒

  • d/Γ↨jôù☺♫Ö▲b¶n0ï∟RKl♣╟┐l⌂QH┐▐φ♫ö ┬_φ┬Ió£ná→╖G∙♣Σ►-◄8╓ZX◙nb¶ìMÇx▄Ö ╟ü╪Gñö◙-•╢É}►f~+m←↓ü;·\$¿4σ╫áú≈₧ U'k~ù^▒H▄s₧╦êΘµ♦♠╔,Gδ;åa┤∙NßWπsδ »M\π◄=┌G]t +ßQ^l┴mí≡èτDz╜&╜⌠╨SOî Vg£ª}ù↓¢┘;4Γ╖á♠┘ñ▼ö►:♂╠L♦9♂╚╢ÆH( ô ª╛‼ß±ùH»S╪g)m'(7☻òá╡L'6G☺ÖÇ♠"î üLδ░╣»e╧¬ç╒"∞òα~░§§É↑â╜ærâp╥xε▲♣

    ┌Uü╜╫l╪Ñ≥ôùRc∙╠Γ¡öàx₧╢₧╚f▌Z┘é♪!Ω L◄±Ä3╬╤ε}:ÇRu╒º¢=2ñ∩╝·└¬╝╣♀║æ╘Q╔ Aüµ{w{y◙ƃom¥↕ú±╣}k▄0◦◄↑Ä╪┌&D?í√ ╒Z█ jαÆ╙ë{/╗αô.*R←pr(b?▼◄&åÆ▲Θ[É bƵA▲ºßÑ∟Θ▀döòêî♪Ω&yá╔☼◘┌╧>▲╓M1* ╦*¡∟☺4Å)▼ôTαÉ÷↔+◙‼M« :▼GF[($nΘ÷Å ▌╣èTΦ▲Sσ▪ëOì#÷ô]+◄:f9ôτu╓█B▒♦▬█↕ ♫╪(Z⌡▬ñ[< G]≡ÇâΦ╗⌂█∟⌠í<|æ9oΣ║z!L Ö╚Sâìí°B'⌡♪♀┬Q1▪#┐[∟█╝╜x│I╨♦┌½c╪ ▬\è▄UYÆ/º·╝☻0£MP╔ê¿J♪_>╡∟╢εVRt╣i ª÷┘FÆ╬C╕µïc┘$☺ƒc»-7JÅï◦})ªj♪σ+Θê ↑(Ä╔•é░u_─◙Xm½8▬╫á≤≥╗▬à<↑GÄ≈4G߬ ↑µ^═Γu╩úC┐☻╟iÆ▀Ñ»FS∟≥▪♂╕WCÑ╨ê±²ñ äδ:ºék╡nÄw╩ßÆ▬!z∞♫ N½Φ╒┼C◘╬ÑÑ ?D ... ëPNG♪◙→◙ ♪IHDR ☻→ ╛◘♠ s½ª ≈ ♦Å╫true ┤♣▒εÜ┘$φ╗3☼»αG↔öÇ\═0₧:P╞!•▒áwó░« u∟╔AL╙J<►Φs L╣I▌è\αè3l?WÑû╠♠ìΣ}⌂ n°ôaîlö§╔ó¢i∞¬∩╦8≡)≤Çg╘╩┴3ëΓ%◄/( b☻▬↔‼⌐j☻♥dæ╧↔ä♪┘┬ì §(▒┌:╞ùxº╟║∞◄ á◄űn≤ó± ►¶Jp/♀α/♠P☼zz(≤ÿ╩↔ï┼§•ô ,∟+╙aµ─CΩ⌐‼÷α░s╕Å':òφw≡O»♀1▓z♣&ñ y╔╕à"IX≤▄ⁿJ♣║PÑnö¿╣τ┴7à&ªü>¬ï║Wx w^╚>à►mtûσf√•wâ╗╥²┼xÿáôùε▄ôτô≤█≥ ╩┌Aj≤⌐¢╟╬M┬ûí δτ╩~⌐Pl¶¼┌╢!zWÅuδ$ /≥Ñw╒V♀WR┤V╥°╔═√=¼7°²√▲┼kd√Fösùc █◘k├o¬åù♂\r╢§F╙◘≥|MÖP;@∞↑xäεù→æ½ r♦«▐R≥óå2♦ô&═τ'5$¼♫π╥÷èzef¥Uí`∙j ╪'¬├Rö`ÿ¶óB≤╪2⌠↑RmâÖ▐¡╝→‼pò[│k«╗ å;·L→pÜ│bzÖ=b¬S~û|¶¿î╩G╢ç╖¼ ‼«ö♠ Ö╚Sâìí°B'⌡♪♀┬Q1▪#┐[∟█╝╜x│I╨♦┌½c╪ ▬\è▄UYÆ/º·╝☻0£MP╔ê¿J♪_>╡∟╢εVRt╣i ª÷┘FÆ╬C╕µïc┘$☺ƒc»-7JÅï◦})ªj♪σ+Θê ↑(Ä╔•é░u_─◙Xm½8▬╫á≤≥╗▬à<↑GÄ≈4G߬ ↑µ^═Γu╩úC┐☻╟iÆ▀Ñ»FS∟≥▪♂╕WCÑ╨ê±²ñ äδ:ºék╡nÄw╩ßÆ▬!z∞♫ N½Φ╒┼C◘╬ÑÑ ?D ... Encrypt the header with the salt from the host.

  • ëPNG♪◙→◙ ♪IHDR ☻→ ╛◘♠ s½ª ≈ ♦Å╫true ┤♣▒εÜ┘$φ╗3☼»αG↔öÇ\═0₧:P╞!•▒áwó░« u∟╔AL╙J<►Φs L╣I▌è\αè3l?WÑû╠♠ìΣ}⌂

    n°ôaîlö§╔ó¢i∞¬∩╦8≡)≤Çg╘╩┴3ëΓ%◄/( b☻▬↔‼⌐j☻♥dæ╧↔ä♪┘┬ì §(▒┌:╞ùxº╟║∞◄ á◄űn≤ó± ►¶Jp/♀α/♠P☼zz(≤ÿ╩↔ï┼§•ô ,∟+╙aµ─CΩ⌐‼÷α░s╕Å':òφw≡O»♀1▓z♣&ñ y╔╕à"IX≤▄ⁿJ♣║PÑnö¿╣τ┴7à&ªü>¬ï║Wx w^╚>à►mtûσf√•wâ╗╥²┼xÿáôùε▄ôτô≤█≥ ╩┌Aj≤⌐¢╟╬M┬ûí δτ╩~⌐Pl¶¼┌╢!zWÅuδ$ /≥Ñw╒V♀WR┤V╥°╔═√=¼7°²√▲┼kd√Fösùc █◘k├o¬åù♂\r╢§F╙◘≥|MÖP;@∞↑xäεù→æ½ r♦«▐R≥óå2♦ô&═τ'5$¼♫π╥÷èzef¥Uí`∙j ╪'¬├Rö`ÿ¶óB≤╪2⌠↑RmâÖ▐¡╝→‼pò[│k«╗ å;·L→pÜ│bzÖ=b¬S~û|¶¿î╩G╢ç╖¼ ‼«ö♠ Ö╚Sâìí°B'⌡♪♀┬Q1▪#┐[∟█╝╜x│I╨♦┌½c╪ ▬\è▄UYÆ/º·╝☻0£MP╔ê¿J♪_>╡∟╢εVRt╣i ª÷┘FÆ╬C╕µïc┘$☺ƒc»-7JÅï◦})ªj♪σ+Θê ↑(Ä╔•é░u_─◙Xm½8▬╫á≤≥╗▬à<↑GÄ≈4G߬ ↑µ^═Γu╩úC┐☻╟iÆ▀Ñ»FS∟≥▪♂╕WCÑ╨ê±²ñ äδ:ºék╡nÄw╩ßÆ▬!z∞♫ N½Φ╒┼C◘╬ÑÑ ?D ... Sal Header Volume’s content End of volume Image (ignored) TrueCrypt PNG Signature + header Chunk declaration Chunk data Chunk end Original chunks

  • TrueCrypt volumes in standard files (still useable and modifiable)