dislocker VS CyberChef

Linux can open bitlocker devices, there are tools for that, such as Dislocker, which works on Linux and Mac OS.

You won't be able to access your files unless you use a tool like dislocker and know the password for the bitlocker partition.

just a warning to anyone using this tool: it sometimes miscalculated the size of the bitlocker partition when mounting it, which caused my to corrupt my filesystem when trying to modify my windows filesystem size from linux. recompiling with https://github.com/Aorimn/dislocker/pull/252 merged fixed the issue for me

This is one, just FYI: https://github.com/Aorimn/dislocker

dislocker - Accessing bitlocker encrypted drives on Linux.

You could use dislocker (https://github.com/Aorimn/dislocker) but I do not consider it trustworthy. I would not let it write to a NTFS partition that actually contained important data. I just wondered, because Paragon likely delivered a product close to enterprise quality standards incl. testing, how they handled this.

Then we take the encrypted text and use CyberChef to decrypt it.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

When we did cargo run "/etc/passwd" on the file we got an image with code injected into it. When we upload it to the server and download the "shrunken" version of it we can run identify -verbose {image} to get the outputting hex values of our input. Inputting it to something like CyberChef and converting it from hex to ascii we get this output: