Port fixes from CFspitkey #3

@en4rab

Incorporate Changes from CFSPITkey Fork

Summary

This issue tracks the incorporation of improvements and changes made in the CFSPITkey fork (https://github.com/controlf/CFSPITkey) back into the original SPITkey project. The fork has implemented enhancements and bug fixes.

Proposed Changes

Incorporate the following changes into the SPITkey code.

Version 1.2.0 (2025年11月25日)

• Output directory argument - Added -o path/to/output/dir flag for specifying output location
• Log file writing - Capability to write log messages to file for better debugging and record-keeping

Version 1.1.1 (2025年10月29日)

Critical Bug Fixes:(削除) (削除ここまで)

(削除) (削除ここまで)

(削除) (削除ここまで)
• (削除) Fixed get_enc_fvek false positive bug - Previously matched "Datum entry type: 3" too broadly, causing false positives with "Datum entry type: 30" and resulting in missing nonce errors (削除ここまで)
  (削除)
  • Added context validation to ensure "ENTRY TYPE FVEK" appears near "Datum entry type: 3"
  (削除ここまで)
  • (削除) Prevents false matches and raises clear errors when no valid FVEK section is found (削除ここまで)
  • fixed in Commit 3e241c2

(削除) (削除ここまで)

(削除) (削除ここまで)
• (削除) Fixed get_enc_payload UnboundLocalError - Occurred when nonce/MAC/payload were not found due to log spacing or structure inconsistencies (削除ここまで)
  (削除)
  • Added default values for nonce, mac, and payload to prevent unbound errors
  • Extended scan range from 17 to 50 lines to accommodate spaced-out logs
  • Skips early "Header safe" lines until all components are found
  (削除ここまで)
  • (削除) Raises clear error if structure is incomplete (削除ここまで)
  • fixed in Commit 483d4e3

(削除)

Enhanced Error Handling:

(削除ここまで)

(削除) (削除ここまで)
• (削除) [ ] MAC verification - Added MAC check in decrypt function (削除ここまで)
  (削除)
  • Cleanly handles incorrect or corrupted VMK input
  (削除ここまで)
  • (削除) Replaces Python traceback with user-friendly error: "ERROR. MAC check failed. Are you sure you have the correct VMK?" (削除ここまで)
  • fixed in Commit a93770d

Version 1.0.0 (2025年08月22日)

• VMK input format flexibility - Enhanced to accept both plaintext and binary VMK formats:
  • Plaintext string from .txt file
  • Binary data from .dat file (e.g., VMK.dat from BitPixie)
• Incomplete encryption detection - Added granular error checking for incomplete BitLocker partitions
  • Detects when BitLocker encryption hasn't completed by checking for missing metadata in dislocker.log
  • Specifically flags missing [EOW_INFORMATION_OFFSET_GUID] entries
  • Prevents invalid recovery-key decryption attempts

Priority

The bug fixes in version 1.1.1 should be considered high priority as they address issues that cause the tool to fail or produce incorrect results in certain scenarios.

References

• CFSPITkey Repository: https://github.com/controlf/CFSPITkey
• CFSPITkey CHANGELOG: https://github.com/controlf/CFSPITkey/blob/main/CHANGELOG.md