[Huawei Mate 9 Questions & Answers] zxy_xda:
Hi,

I’m using HUAWEI Mate 9 with a modified ROM EMUI 5.0 B173 (should be this one: https://xdaforums.com/mate-9/development/hrt-kangvip-b173-root-t3567881). I also modified its kernel so the userdada partition was unencrypted.

Recently I performed an upgrade using a higher version ROM made by the same author. After installation, I rebooted my device and it seemed stuck in boot animation. So about 10 minutes later I forced power off it. Then it could boot successfully but failed to unlock even if I use the correct password.

Entering TWRP recovery, I find that some files in userdata partition (especially /data/media/0) was encrypted. So, I realized I forgot to modify the kernel before first boot and the device started to encrypt my data. This process didn’t finish before I forced power off.

I notice that mate 9 uses f2fs with file based encryption and the key seems exist in /data/unencrypted/key. When trying to copy encrypted files in recovery I get “Required key not available”. I duplicate userdata partition and mount on ubuntu, I still can’t access the encrypted files, got “access is denied”.

I use dump.f2fs to dump one of the encrypted files:

zxy@lubuntu:/media/sf_D_DRIVE/winmnt/seagate_p0/hwbk_img$ dump.f2fs -i22540 -d5 sdd46
Info: Debug level = 5
Info: Segments per section = 1
Info: Sections per zone = 1
Info: sector size = 512
Info: total sectors = 112771072 (55064 MB)
Info: MKFS version
"Linux version 4.1.18-g9fc1632 (android@localhost) (gcc version 4.9 20150123 (prerelease) (GCC) ) #1 SMP PREEMPT Sun Nov 27 05:22:40 CST 2016"
Info: FSCK version
from "Linux version 4.13.0-16-generic (buildd@lcy01-02) (gcc version 7.2.0 (Ubuntu 7.2.0-8ubuntu2)) #19-Ubuntu SMP Wed Oct 11 18:35:14 UTC 2017"
to "Linux version 4.13.0-16-generic (buildd@lcy01-02) (gcc version 7.2.0 (Ubuntu 7.2.0-8ubuntu2)) #19-Ubuntu SMP Wed Oct 11 18:35:14 UTC 2017"
Info: superblock features = 0 :
Info: superblock encrypt level = 0, salt = 00000000000000000000000000000000

+--------------------------------------------------------+
| Super block |
+--------------------------------------------------------+
magic	[0xf2f52010 : 4076150800]
major_ver	[0x 1 : 1]
volum_name	[]
minor_ver	[0x 4 : 4]
log_sectorsize	[0x 9 : 9]
log_sectors_per_block	[0x 3 : 3]
log_blocksize	[0x c : 12]
log_blocks_per_seg	[0x 9 : 9]
segs_per_sec	[0x 1 : 1]
secs_per_zone	[0x 1 : 1]
checksum_offset	[0x 0 : 0]
block_count	[0x d71800 : 14096384]
section_count	[0x 6adb : 27355]
segment_count	[0x 6b8b : 27531]
segment_count_ckpt	[0x 2 : 2]
segment_count_sit	[0x 2 : 2]
segment_count_nat	[0x 76 : 118]
segment_count_ssa	[0x 36 : 54]
segment_count_main	[0x 6adb : 27355]
segment0_blkaddr	[0x 200 : 512]
cp_blkaddr	[0x 200 : 512]
sit_blkaddr	[0x 600 : 1536]
nat_blkaddr	[0x a00 : 2560]
ssa_blkaddr	[0x f600 : 62976]
main_blkaddr	[0x 16200 : 90624]
root_ino	[0x 3 : 3]
node_ino	[0x 1 : 1]
meta_ino	[0x 2 : 2]
cp_payload	[0x 0 : 0]
version Linux version 4.13.0-16-generic (buildd@lcy01-02) (gcc version 7.2.0 (Ubuntu 7.2.0-8ubuntu2)) #19-Ubuntu SMP Wed Oct 11 18:35:14 UTC 2017
Info: total FS sectors = 112771072 (55064 MB)
Info: CKPT version = 54f0f3

+--------------------------------------------------------+
| Checkpoint |
+--------------------------------------------------------+
checkpoint_ver	[0x 54f0f3 : 5566707]
user_block_count	[0x caac00 : 13282304]
valid_block_count	[0x ad9b43 : 11377475]
rsvd_segment_count	[0x 30 : 48]
overprov_segment_count	[0x 585 : 1413]
free_segment_count	[0x 5b5 : 1461]
alloc_type[CURSEG_HOT_NODE]	[0x 0 : 0]
alloc_type[CURSEG_WARM_NODE]	[0x 0 : 0]
alloc_type[CURSEG_COLD_NODE]	[0x 0 : 0]
cur_node_segno[0]	[0x 731 : 1841]
cur_node_segno[1]	[0x 1ce : 462]
cur_node_segno[2]	[0x 47f2 : 18418]
cur_node_blkoff[0]	[0x 150 : 336]
cur_node_blkoff[1]	[0x 18f : 399]
cur_node_blkoff[2]	[0x 1d9 : 473]
alloc_type[CURSEG_HOT_DATA]	[0x 0 : 0]
alloc_type[CURSEG_WARM_DATA]	[0x 0 : 0]
alloc_type[CURSEG_COLD_DATA]	[0x 0 : 0]
cur_data_segno[0]	[0x 5e29 : 24105]
cur_data_segno[1]	[0x 57f3 : 22515]
cur_data_segno[2]	[0x 69d8 : 27096]
cur_data_blkoff[0]	[0x 10d : 269]
cur_data_blkoff[1]	[0x ec : 236]
cur_data_blkoff[2]	[0x 143 : 323]
ckpt_flags	[0x 45 : 69]
cp_pack_total_block_count	[0x 7 : 7]
cp_pack_start_sum	[0x 1 : 1]
valid_node_count	[0x 5ba5f : 375391]
valid_inode_count	[0x 52e43 : 339523]
next_free_nid	[0x 677fb : 423931]
sit_ver_bitmap_bytesize	[0x 40 : 64]
nat_ver_bitmap_bytesize	[0x ec0 : 3776]
checksum_offset	[0x ffc : 4092]
elapsed_time	[0x 180674a : 25192266]
sit_nat_version_bitmap[0]	[0x aa : 170]

[dump_node: 487] Node ID [0x580c]
[dump_node: 488] nat_entry.block_addr [0xb8c0da]
[dump_node: 489] nat_entry.version [0x3c]
[dump_node: 490] nat_entry.ino [0x580c]
[dump_node: 495] node_blk.footer.ino [0x580c]
[dump_node: 496] node_blk.footer.nid [0x580c]
[print_node_info: 272] Node ID [0x580c:22540] is inode
i_mode	[0x 81b4 : 33204]
i_advise	[0x 8c : 140]
i_uid	[0x 3ff : 1023]
i_gid	[0x 3ff : 1023]
i_links	[0x 1 : 1]
i_size	[0x 846f : 33903]
i_blocks	[0x a : 10]
i_atime	[0x5a426cab : 1514302635]
i_atime_nsec	[0x148105ff : 343999999]
i_ctime	[0x5a426cab : 1514302635]
i_ctime_nsec	[0x1443fd00 : 340000000]
i_mtime	[0x5a426cab : 1514302635]
i_mtime_nsec	[0x1443fd00 : 340000000]
i_generation	[0x2994fc72 : 697629810]
i_current_depth	[0x 1 : 1]
i_xattr_nid	[0x 0 : 0]
i_flags	[0x 0 : 0]
i_inline	[0x 1 : 1]
i_pino	[0x 57f8 : 22520]
i_dir_level	[0x 0 : 0]
i_namelen	[0x 10 : 16]
i_name	[_tFCOBeqt18rfIvqv,bWVYCAAAAAAAAA]
i_ext: fofs:0 blkaddr:70c345 len:9
i_addr[ofs]	[0x 70c345 : 7390021]
i_addr[ofs + 1]	[0x 70c346 : 7390022]
i_addr[ofs + 2]	[0x 70c347 : 7390023]
i_addr[ofs + 3]	[0x 70c348 : 7390024]
i_addr[0x3] points data block	[0x70c348]
i_addr[0x4] points data block	[0x70c349]
i_addr[0x5] points data block	[0x70c34a]
i_addr[0x6] points data block	[0x70c34b]
i_addr[0x7] points data block	[0x70c34c]
i_addr[0x8] points data block	[0x70c34d]
i_nid[0]	[0x 0 : 0]
i_nid[1]	[0x 0 : 0]
i_nid[2]	[0x 0 : 0]
i_nid[3]	[0x 0 : 0]
i_nid[4]	[0x 0 : 0]

xattr: e_name_index:6 e_name:selinux e_name_len:7 e_value_size:33 e_value:
753A6F626A6563745F723A6D656469615F72775F646174615F66696C653A733000

xattr: e_name_index:9 e_name:c e_name_len:1 e_value_size:108 e_value:
format: 2
contents_encryption_mode: 0x1
filenames_encryption_mode: 0x4
flags: 0x0
master_key_descriptor: E1294EA7636FEEE7
nonce: 9D116EADE49818CF9C86693F0F7779A4

File is encrypted
Info: checkpoint state = 45 : compacted_summary unmount

Done.

Now I'm trying to get my files back.

Any idea how to decrypt these files?

Thanks.