mdadm 数组下的 md 分区是什么？

Question

所以这似乎是随机伪造分区表误检测的情况。

以下是 Atari / AHDI 分区表的示例（使用 parted 创建）：

# hexdump -C -n 512 /dev/loop0 
000001c0  00 00 00 03 20 00 01 4c  4e 58 00 00 08 00 00 00  |.... ..LNX......|
000001d0  08 00 01 4c 4e 58 00 00  18 00 00 00 60 00 00 50  |...LNX......`..P|
000001e0  41 52 54 45 44 41 54 41  52 49 00 50 41 52 54 45  |ARTEDATARI.PARTE|
000001f0  44 41 54 41 52 49 00 00  00 01 00 00 00 01 fa 70  |DATARI.........p|

因此，有趣的位是偏移量 0x1c0/0x1d0 行处的 GEM、BGM、LNX、SWP、RAW 之一，如 block/partitions/atari.c#L27-L32 中所示：

static inline int OK_id(char *s)
{
    return  memcmp (s, "GEM", 3) == 0 || memcmp (s, "BGM", 3) == 0 ||
        memcmp (s, "LNX", 3) == 0 || memcmp (s, "SWP", 3) == 0 ||
        memcmp (s, "RAW", 3) == 0 ;
}

以下是 LUKS2 标头的示例：

# hexdump -C -n 512 /dev/loop1
00000000  4c 55 4b 53 ba be 00 02  00 00 00 00 00 00 40 00  |LUKS..........@.|
00000010  00 00 00 00 00 00 00 03  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000040  00 00 00 00 00 00 00 00  73 68 61 32 35 36 00 00  |........sha256..|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  a4 43 6c 13 63 6b 33 da  |.........Cl.ck3.|
00000070  c8 f5 1d 7d 82 b3 9e dc  15 b2 ff 55 d2 4c 3e 8c  |...}.......U.L>.|
00000080  62 08 ec 0f 56 b2 bc 89  86 f0 e8 c0 e6 a2 d8 12  |b...V...........|
00000090  56 93 68 2f 83 82 e6 90  18 57 7b 23 34 d7 96 92  |V.h/.....W{#4...|
000000a0  ab ad 67 a5 d9 7d dd 6c  32 36 37 36 35 63 39 32  |..g..}.l26765c92|
000000b0  2d 34 34 37 34 2d 34 36  37 64 2d 62 39 62 62 2d  |-4474-467d-b9bb-|
000000c0  64 36 30 36 63 61 64 31  32 61 62 64 00 00 00 00  |d606cad12abd....|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001c0  55 85 e9 50 c2 46 1e 16  27 a7 ce a5 9d e9 46 17  |U..P.F..'.....F.|
000001d0  fb 30 9a ae 53 74 39 8a  c5 2c d2 21 4b 86 ad 20  |.0..St9..,.!K.. |
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200

因此，恰好在相同的 0x1c0 / 0x1d0 行处存在随机数据。

我的猜测是你随机滚动了 GEM、BGM、LNX、SWP、RAW 之一，所以它看起来像内核的分区表，因此你检测到了你的怪异分区。

好消息是，对于 LUKS2 标头，此偏移量似乎代表标头校验和。每次您更改 LUKS2 标头中的任何内容时，它都会完全更改，因此...例如，您可以仅添加另一个密码短语。（如果您实际上不需要它，请将其删除）。

# cryptsetup luksAddKey /dev/loop1
Enter any existing passphrase: 
Enter new passphrase for key slot: 
Verify passphrase:

运行后相同的 LUKS2 标头cryptsetup luksAddKey：

# hexdump -C -n 512 /dev/loop1
00000000  4c 55 4b 53 ba be 00 02  00 00 00 00 00 00 40 00  |LUKS..........@.|
00000010  00 00 00 00 00 00 00 05  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000040  00 00 00 00 00 00 00 00  73 68 61 32 35 36 00 00  |........sha256..|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  a4 43 6c 13 63 6b 33 da  |.........Cl.ck3.|
00000070  c8 f5 1d 7d 82 b3 9e dc  15 b2 ff 55 d2 4c 3e 8c  |...}.......U.L>.|
00000080  62 08 ec 0f 56 b2 bc 89  86 f0 e8 c0 e6 a2 d8 12  |b...V...........|
00000090  56 93 68 2f 83 82 e6 90  18 57 7b 23 34 d7 96 92  |V.h/.....W{#4...|
000000a0  ab ad 67 a5 d9 7d dd 6c  32 36 37 36 35 63 39 32  |..g..}.l26765c92|
000000b0  2d 34 34 37 34 2d 34 36  37 64 2d 62 39 62 62 2d  |-4474-467d-b9bb-|
000000c0  64 36 30 36 63 61 64 31  32 61 62 64 00 00 00 00  |d606cad12abd....|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001c0  2a 11 50 fd 0b 8a 05 b6  67 1a e5 2f 2b a7 de d5  |*.P.....g../+...|
000001d0  2c b3 17 7c a5 21 b5 a1  5a f3 86 5c 96 9e 16 c0  |,..|.!..Z..\....|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200

正如你所看到的，0x1c0/0x1d0 rowns 中的数据与之前完全不同，所以运气好的话，你的伪造分区表也将消失（在重新读取分区表之后）。同时，这是值得关注的事情，因为未来对标题的任何更改都可能将其恢复......

我假设您使用的是 LUKS2，因为旧的 LUKS1 标头不会在此偏移量处存储随机数据，并且luksFormat还会将其归零，如下所示：

000001c0  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00

因此，旧的 LUKS1 标头格式根本不应该出现此问题。

Answer 1