Menu

Hidden OS in EFI mode

DJ Bonez
2017-06-07
2025-03-29
<< < 1 2 3 4 5 > >> (Page 4 of 5)
  • Alex

    Alex - 2018-11-13

    Almost done. To locate block device with keys special mark is used. The mark is in 61 sector of the block device with keys (SR). The mark is unique for the computer (based on BIOS serial etc)
    I guess - wrong mark or multiple marks are present.

     
  • Alex

    Alex - 2018-12-03

    there are special keys
    f2 - change password. enter old pwd and press f2(instead of enter)
    f5 - show pwd
    f7 - pwd platform locked. pwd mixed with serial of BIOS, MB etc
    f8 - TPM locked. pwd mixed with key from TPM if configured
    f9 - smart card locked. todo :)

    Note: it is possible to change via picture pwd.

     
    • coolice

      coolice - 2018-12-04

      Does not work. After entering the old passwords and clicking F2 - loading hidden OS

       
      • Alex

        Alex - 2018-12-04
        <your pwd><F2> - (without <enter>). It has to ask new pwd.
        
         

        Last edit: Alex 2018-12-04
      • Alex

        Alex - 2018-12-04

        version of VC do you use? The latest I did not test.

         
        • coolice

          coolice - 2018-12-05

          VeraCrypt 1.21 - <your pwd=""><f2> - (without <enter>) , does not work</enter></f2></your>

           
          • Alex

            Alex - 2018-12-05

            do f5, f9, or f7 work? (f2 - it might be kbd problem)
            can touch screen be configured?

             
  • coolice

    coolice - 2018-12-06

    It f5, f9, or f7 - works. I did not quite understand the question regarding "can touch screen be configured?". I also did not understand "(f2 - it might be kbd problem)".
    I apologize for my English, I am from Ukraine and I am speaking for help google translate.

     
  • Oleg

    Oleg - 2018-12-16

    Hi everyone!
    I tried all the options.
    DecoyOS is loading.
    When I try to load HiddenOS, it displays that the password is accepted.
    success
    start 0 {s} len {n}
    .... and again asks for a password.
    When I re-enter the password:
    Can't open start partition {pID}
    Status - Unsupported.
    In some cases, I received an endless login prompt without any errors.
    I tried to add <config key="ActionSuccess">postexec file(EFI\Microsoft\Boot\bootmgfw_ms.vc)</config> to DcsProp , but this solution give me a blue screen.
    VeraCrypt 1.23-Hotfix-2. OS Windows 10 Build 1809. HP Laptop !
    What could be wrong?

     

    Last edit: Oleg 2018-12-17
    • coolice

      coolice - 2018-12-17

      Yes, there is such a problem in version 1.23. Use version not higher than 1.22

       
      • Oleg

        Oleg - 2018-12-18

        OK, coolice, thanks you.
        On HP laptops with versions below 1.23 have a lot of problems. VeraCrypt bootloader does not automatically load until replace bootmgfw.efi with veracrypt bootloader and add <config key="ActionSuccess">postexec file(EFI\Microsoft\Boot\bootmgfw_ms.efi)</config> to DcsProp. If I replace it in H_ESP during HiddenOS preparation then can't boot again H_OS, isn't it? Maybe not change and load from Rescue USB?

         

        Last edit: Oleg 2018-12-18
  • Oleg

    Oleg - 2018-12-18

    Just made with VeraCrypt version 1.22. H_EPP did not touch. Result in H_OS - BSOD.
    I don't know, what else can I do.
    Maybe this is HP Laptop problem.
    ...
    I forgot to put bootmgfw_ms.efi in H_ESP.
    When I remove <config key="ActionSuccess">postexec file(EFI\Microsoft\Boot\bootmgfw_ms.efi)</config> from DcsProp HiddenOS is started up.
    Now I know what to do.

     

    Last edit: Oleg 2018-12-18
  • Manfred Jonsson

    Manfred Jonsson - 2019-01-11

    I am having trouble with the device containing the SR failing to be detected. I turned on SecRegionSearch and SecRegionInfoDelay but the Veracrypt loader doesn't even acknowledge a SR. I tried creating security regions with the -srw, -srm, -sra command sequence on zero wiped partitions on multiple thumb drives but no luck --- SecRegionInfoDelay doesn't show SR and auth failure when I enter H_OS password. I checked sector 61 on the auth device and it looks like it contains a SR mark i.e. all zeros except for a few bytes at the beginning of the sector. Crazy thing is, I got a H_OS working on this same HP laptop previously with the auth device being detected normally. But now I've twice wiped the partition table and followed every step in the manuals through to the end and both times the auth device is ignored by the boot loader. I've checked DcsProp on the D_OS ESP and it contains the SecRegionSearch key turned on.

     
  • Sascha

    Sascha - 2019-04-27

    Hi folks,
    Hi Alex,

    first of all - many thanks for all your effort and work to make this work, especially Alex :-)
    I posted the this question and was redirected here by Alex, thanks!

    Since I:
    - am only minimal experienced in general Encryption
    - have no real experience with Veracrypt, and only basic experience with truecrypt
    - am an absolute NOOB regarding EFI
    - have only average experience regarding disk and partition manipulation, with no GPT experience...

    ... I must say: Well i have mostly no clue what this thread is talking about :-))

    So I am summarizing all Infos i gathered in this Thread:
    1. EFI Shell referred to by Alex here
    This Link dos not work anymore: (EFI shell is possible to download from tianocore:
    https://github.com/tianocore/edk2/raw/master/ShellBinPkg/UefiShell/X64/Shell.efi)
    2. "disk_encryption_v1_2.pdf" refered to by "DJ Bonez" here
    I found this file in the "VeraCrypt_1.23-Hotfix-2_Source.zip" and a link here
    3. 1st Manual for dummies by Felis here, based on DJ Bonez 1st Version - thanx Felis! Thanx DJ Bonez!
    manual for Dummies by "Felis"
    4, This threat mentioned by Felism regarding "Hidden OS"
    5. This Tool DcsProp mentioned by Alex here
    But i am not sure: Do we need it, is the version still working with current Verycrypt?
    6. alfie mr mentions a "V2 tutorial" here
    I cant find any such tutorial, could please provide a link or where to find it?
    7. Manual v1.0 by Felis here - thanx Felis!
    Manual 1.0 by Felis
    8. Manual v2.0 by DJ Bonez here - thanx DJ Bonez!
    Manual v2.0
    9. These Video-Instruction by coolice here
    https://www.youtube.com/watch?v=DXuVCagU9oY
    https://www.youtube.com/watch?v=ywOJj7GmfsQ
    https://www.youtube.com/watch?v=gI2u1horLtg
    10. Feature-Infos by Alex here

    *there are special keys
    f2 - change password. enter old pwd and press f2(instead of enter)
    f5 - show pwd
    f7 - pwd platform locked. pwd mixed with serial of BIOS, MB etc
    f8 - TPM locked. pwd mixed with key from TPM if configured
    f9 - smart card locked. todo :)
    Note: it is possible to change via picture pwd.
    *

    So i have still some beginner-questions:
    1. EFI-Shell: The Link from Alex / manual v2.0 is not working anymore
    Can you maybe add a working link? Or place it e.g. in Files/Contributions ?
    2. if i have the EFI-Shell, is there a howto or manual on how to use it? Doas it alter my Bios? If yes - what precautions should i take to not crash my bios?
    3. What is the "V2 tutorial" mentioned by alfie mr here
    4. Is it possible to add multiple hidden OS-Versions/Multiboot?
    5. manual v2.0 clear up most intermediate questions, CHEERS DJ BONEZ & FELIS!

    I am pretty sure i will have more questions :-)

    Thanks in advance
    greetings from Hamburg
    Sascha

     

    Last edit: Sascha 2019-04-27
  • Sascha

    Sascha - 2019-04-27

    ok, i did some searching.
    shell.efi belongs to the "EDK II" by tianocore
    EDK II was updated 03.2019, and it seems the old version was moved to a diffeent path.

    edk2-stable201903: Source code (zip)

    shell.efi is in the "Source code (zip)" under "\ShellBinPkg\UefiShell\X64\shell.efi"

    At the moment there seems to be no "ShellBinPkg"-Folder directly accessable at github.
    Question: Which version is the one previously linked at "https://github.com/tianocore/edk2/raw/master/ShellBinPkg/UefiShell/X64/Shell.efi"?

    And should the new version be compatible?

     
  • Aleksey

    Aleksey - 2020-03-23

    Hi.
    I follow the instructions provided by coolice in his videos for setup Windows 10 hidden OS in the UEFI and GPT envirement:
    https://www.youtube.com/watch?v=DXuVCagU9oY
    https://www.youtube.com/watch?v=ywOJj7GmfsQ
    https://www.youtube.com/watch?v=gI2u1horLtg
    The decoy and hidden OS works as expected, but one thing I don't know how to do.
    When I logged in decoy OS and try to mount outer volume, it's mounts, but VeraCrypt doesn't see it's inner structure (partitions, etc), so, I can't upload data to outer volume. When I provide the hidden OS password ("protect hidden volume" check box from "mount options" dialogue) mounting doesn't work (error message).
    So, is there a method for mounting outer volume?

     
  • adam johnson

    adam johnson - 2024-03-17
    edit: solved
    

    i just have another issue now when i shut down HOS and boot it again it always removes the dcsboot from boot menu and after successful auth get into windows recovery.

    if anyone encounters this issue, just launch veracrypt on HOS and uncheck the box in settings > system encryption > the first of the last ones regarding dcsboot fix

     

    Last edit: adam johnson 2024-03-18
  • Hogo Fogo

    Hogo Fogo - 2025-01-11

    Hi all
    first of all i have to say that i really appreciate your work. thank you very much for the exhaustive instructions and procedures.
    i tried about 6 several attempts before i got any result, at that time i only used pdf version of ecryption disk v1.2 by kavsrf, dj bonez first step by step guide and feliz first version.
    and my final result now is that i always ended up with a working decoy system, but i never started hidden system after encrypting hidden os and application of command
    EFI\VeraCrypt\DcsCfg.dcs -pf gpt_hos -ds <driven> -pa
    .
    after completing the whole procedure this is my still same result:
    I enter the password for the hidden system:
    authorizing ...
    success
    start 1 57xxxxx Ien 582xxxxx</driven>

    can`t find start partition 3ca8247d- xxxx-xxx-xxx-

    Status - not found

    I got to the same place about 4 times with the same result..

    then I discovered new manuals:
    VeraCrypt Hidden OS on EFI/GPT system (v1.0) felis
    Creating hidden OS in UEFI mode (v2.0) djbonez
    respect to you sir
    i was hoping i could find where i was making a mistake
    but unfortunately the result of the 10th attempt is still the same (which really irritates me unbelievably)
    I have absolutely no idea where the problem could be, I do everything according to the instructions and everything looks completely fine the whole time, until the moment of encrypting the hidden OS both systems are functional and accessible, encryption pretest also successful ..

    any ideas what could be causing this?

    Partition 1 Recovery 100 MB 1024 KB decoy esp (asctually protected)
    Partition 2 Reserved 16 MB 101 MB decoy reserved
    Partition 3 Primary 45 GB 117 MB decoy system partition C:
    Partition 4 Primary 9 GB 45 GB Outer_Start
    Partition 5 System 486 MB 54 GB H_ESP hidden esp
    Partition 6 Primary 53 GB 55 GB H_OS hidden system partition C:
    Partition 7 Primary 9 GB 108 GB Outer_End
    Partition 8 Recovery 523 MB 118 GB decoy recovery

    veracrypt 1.26.7
    windows 10 22h1
    lenovo legion
    120gb nvme for testing

    thanks anyone for ANY ideas... i'm starting to get completely lost

     
    • minimaxxximus

      minimaxxximus - 2025-01-13

      hi! maybe you make a mistake on formatting step ( when you formatting D drive )
      also don't make so big partitions on test issue, make 20 GB for windows installation and 10 mb for fake partitions. Also where you store GPT tables? on your NVME or on USB?

       
      • Hogo Fogo

        Hogo Fogo - 2025-01-14

        Hi
        thanks for the reply.
        formatting: I assume that drive D: you mean the partition for Hidden OS.
        first Decoy OS Win 10 is installed on the entire disk, then disk C is shrunk and on the resulting space Outer_Start (fat32), H_ESP (fat32), H_OS (ntfs) and Outer_End (fat32) partitions are created using paragon partition manager.. I think everything is simple and in order.
        the only thing that occurred to me now is that maybe I shouldn't have prepared the esp partition for Hidden OS by myself, but I should have protected the esp partition of Decoy OS and let the windows installation of Hidden OS on the free space between outer_start and outer_end automatically create the ESP partition for Hidden OS and its own system partition?? .. that's maybe a good point to test. But from what I understood from the instructions, it is possible to manually create these partitions and use the diskpart command to change the partition to esp, which is what I did..

        gpt tables: that is a question, I admit that for me it is still a very vague area :/ so I strictly follow the instructions of felis and dj bonez.
        this gives me:
        DcsCfg.dcs -srw 5 -ds 13 -rnd 2 - clear 5 security regions on flashdisk
        DcsCfg.dcs -srm 5 -ds 13 - mark five SRs for writing/reading
        DcsCfg.dcs -pf gpt_enc -aa -pe -ps - encrypt GPT_ENC
        DcsCfg.dcs -pf gpt_enc -sra 1 -ds 13 - load GPT_ENC on flashdisk, while gpt_enc is a "map" for orientation in "hidden" partitions when starting hidden os, ok? that means that gpt_enc is on flashdisk.
        on the other hand gpt_hidden (or gpt_hos) is at nvme:
        DcsCfg.dcs -pf gpt_hos -ds 0 -pa (0 is the number of the nvme itself)
        which makes the entire area between outer_start and outer_end visible as one unformatted/encrypted partition, right?
        I think it's as it should be.
        I'm very confused whether, when working with a flashdisk and nvme, I should use number 0 (nvme itself) or number 1 (first partition on nvme), the same applies to working with a flashdisk - number 13 (flashdisk itself) or 14 (first partition on the device) ..
        thanks for the help and comments, I'll try using smaller partitions for systems and outers

         

        Last edit: Hogo Fogo 2025-01-14
        • coolice

          coolice - 2025-01-14

          Напиши свою електронку, відправлю тобі детальну інструкцію з картинками.

          MOD EDIT: Removed over quoting.

           

          Last edit: Enigma2Illusion 2025-01-14
          • Hogo Fogo

            Hogo Fogo - 2025-01-14

            дякую
            моя електронна адреса hogofog@gmail.com
            Українська мова не має значення - сьогодні у нас купа онлайн-перекладачів :)
            сподіваюся, що це допоможе :)

             
  • Hogo Fogo

    Hogo Fogo - 2025-02-09

    OK, so today I tried another attempt in vmware using coolice's videos (thanks a lot - it was very helpful) and I made some progress, at least I can boot DecoyOS until I put SecRegionSearch=1 & DcsBootForce=1 in the DecoyOS bootloader. After that I can boot only HiddenOS.

    progress, great!

    I appreciated the use of a small partition for SR instead of a flash drive in the video.

    If I understand the problem, during the process on some other partition some SR regions were created (automatically? because I didn't make them) on some partition that I can't see (I understand - that's the intention), which I can't manage and above all I can't simply delete and which conflict with partition 9 that I want to use for DecoyOS and HiddenOS SRs, right?
    Is it possible that these SRs were created by accident and if I try again, it won't happen? or is it a feature?

    ahhh that's crazy .. i think it's not worth the time invested (well, there's a LOT of time invested in it now :D :D) .. but modern laptops with nvme drives just don't boot from legacy bios anymore :/ and on the road with all the work and private data ..

    i'll try to burn some time again.. sometime..
    anyway thanks for the support

     
    • minimaxxximus

      minimaxxximus - 2025-02-09

      if you think that its impossible to run this on laptop with UEFI - you re wrong. you write that you can run hidden os, ok, but you dont write what you made before this... in that case it's impossible to help you. i can find some time and make this with you step by step

       
<< < 1 2 3 4 5 > >> (Page 4 of 5)

Log in to post a comment.