topic Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi in VMware Fusion Discussions

(VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machine??

alexchandel — Wed, 10 Aug 2022 00:22:17 GMT

I had a hardware failure and had to migrate machines. Booting from the old drive was not an option, but I recovered data including all VMs. However, I discovered to my horror that my Win11 VMs now prompt me for a password, claiming to be encrypted.

Destructively removing the vTPM as described in the article or this thread isn't an option. I need to know: where was the password stored on the old machine?!?!?

It's hard to speak politely, as binding a virtual machine to its host like this is such a phenomenally bad design choice. The WHOLE POINT of software emulation (i.e. managedvm.autoAddVTPM = “software”) is to ABSTRACT the host away, not lock it in. If I wanted actual VM encryption or security, I would've asked for that. I didn't.

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

ColoradoMarmot — Wed, 10 Aug 2022 04:09:20 GMT

I never used Windows 11 on Fusion 12 (support was rudimentary at best), but looking forward, on the tech preview, the password is now set by the user manually, and optionally stored in the system keychain. I know it doesn't help your current situation, but support is definitely better now.

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

wila — Wed, 10 Aug 2022 13:25:45 GMT

Hi,

As you're referring to two links in which I participate as help (I wrote the article at the vimalin site and I am /u/dfguidance at reddit), a few notes.

The data on the disk isn't encrypted so -at least in theory- you should be to get the VM(s?) back to work. The descriptor files describing those virtual disks however are.

How did you configure the virtual disk on the VM you need back?

Note that my article points to a few threads that describe how users recovered their VM. Not destructive, unless you mean it will drop the vTPM itself (yes it will, no way around that AFAIK).

PS: I don't know where the password was saved in the experimental vTPM feature. But even if it was in the keychain then I think it would still be inaccessible and you are still at the same stage unless you saved the keychain in iCloud.

--
Wil

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

alexchandel — Thu, 15 Sep 2022 20:08:08 GMT

That sounds like a great improvement over the current situation. I wish they'd help those of us who tried it in v12.

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

alexchandel — Thu, 15 Sep 2022 20:38:16 GMT

I have a backup of the keychains, and the Library folders. So if it was stored anywhere in either, I can retrieve it, and it must be possible somehow. However nothing looks promising. And copying over the Application Support folder was not sufficient.

I believe it was a lazily allocated disk (I see Virtual Disk-s001.vmdk, etc. files). The VM has no snapshots. But there was some data encrypted with the TPM I need back.

However for now, what's a step-by-step procedure for removing the vTPM? I tried removing the VMX lines mentioned in your post, but of course the VM becomes unbootable.

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

wila — Thu, 15 Sep 2022 22:16:19 GMT

Hi,

With the experimental vTPM feature there's not just .vmx lines that need to be removed.

There are other parts that also have been encrypted, like the vmdk descriptor file. The descriptor file is the vmdk file without the -s00nn.vmdk suffix.

If you don't have a backup copy of that one, then you'll have to recreate the descriptor file yourself by creating a dummy virtual disk of exactly the same size.

Then checking the contents of the descriptor file and drawing up one that matches your disk slice names. It should have the exact same amount of slices.

If you ever have resized your virtual disk, then you have to do that also for the dummy disk.

--
Wil

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

alexchandel — Fri, 16 Sep 2022 23:04:02 GMT

Is there a way to determine the size & specs? I can't recall the exact details it was created with. tbh I didn't expect VMWare to encrypt my files and throw away the password.

Are there any steps besides deleting the vmx lines and recreating the .vmdk descriptor?

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

wila — Sat, 17 Sep 2022 09:13:15 GMT

Hi,

The last time I played with this was probably a year ago, so somehow I don't have exact steps.

In order to be able to help we need more details.

1. a full file list of your VM. (eg. ls -al /foldername/of/vm > ~/Desktop/vm-filelist.txt )

2. a copy of the following files: the .vmx, vmsd, all vmdk files smaller than 4kB

3. all vmware.log files

In order to be able to attach those files to a reply down here, you need to zip/compress them.

An answer to the following questions:

Do you remember when you created this VM? Was this before VMware Fusion 7 or after?

Did you ever increase the size of the virtual disk?

I might have more questions after that.

--
Wil

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

alexchandel — Sat, 17 Sep 2022 22:29:51 GMT

It was created with Fusion 12, around 6/2/22, and the vTPM was added right after it was created to enable installing Windows 11. I never increased the size.

Here's the file list:

.DS_Store

Virtual Disk-s001.vmdk

Virtual Disk-s002.vmdk

Virtual Disk-s003.vmdk

Virtual Disk-s004.vmdk

Virtual Disk-s005.vmdk

Virtual Disk-s006.vmdk

Virtual Disk-s007.vmdk

Virtual Disk-s008.vmdk

Virtual Disk-s009.vmdk

Virtual Disk-s010.vmdk

Virtual Disk-s011.vmdk

Virtual Disk-s012.vmdk

Virtual Disk-s013.vmdk

Virtual Disk-s014.vmdk

Virtual Disk-s015.vmdk

Virtual Disk-s016.vmdk

Virtual Disk-s017.vmdk

Virtual Disk.vmdk

Win11-cfd9a924.vmem

Win11-cfd9a924.vmss

Win11.nvram

Win11.plist

Win11.vmsd

Win11.vmx

Win11.vmx.old

Win11.vmxf

appListCache

caches

mksSandbox-0.log

mksSandbox-1.log

mksSandbox-2.log

mksSandbox.log

startMenu.plist

vm-10.scoreboard

vm-11.scoreboard

vm-9.scoreboard

vm.scoreboard

vmware-0.log

vmware-1.log

vmware-2.log

vmware.log

Working on the files… is the vTPM password / encryption key in the log anywhere? Or the location it's loaded from?

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

wila — Sat, 17 Sep 2022 22:55:12 GMT

That file list has no details on size & date.. as such that's not the output of "ls -al"

There are no details about the vTPM password in the log AFAIK, if it would be there than that would be a massive goof up.

I'm asking for those files to get an idea about the correct size of your disk.. nothing more.

--
Wil

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

wila — Sat, 17 Sep 2022 23:42:36 GMT

FWIW.. you can try the following for creating the virtual disk.vmdk descriptor file as I will be off to bed.

Step 1) Make a backup of the folder of the VM as you're experimenting and you don't want to loose more.

After that (and only after you have that backup) try the following experiment.

Create a new dummy VM with a disk of 68GB, also with a split disk scheme of course. So the file list of that new VM will look similar as what you have here.

Then replace the file "virtual Disk.vmdk" from your copy with the copy of the new dummy VM.

Also remove the lines from the vmx we talked about earlier.

Throw away (or if you want -rename) the .nvram and .vmxf files.

Boot the vm and see if it complains.

If that doesn't work.. then tell us the errors and attach the files I asked for.. get them from the backup please, not the experiment.

--
Wil

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

alexchandel — Sun, 18 Sep 2022 20:40:17 GMT

Ah sorry, I wasn't sure how much detail you needed. Here's ls -aln

total 34982920

drwxrwxrwx 44 501 20 1408 Sep 17 14:13 .

drwxrwxrwx 7 501 20 224 May 23 15:58 ..

-rw-r--r--@ 1 501 20 6148 Jul 21 20:00 .DS_Store

-rwxrwxrwx 1 501 20 4152950784 Jun 7 15:09 Virtual Disk-s001.vmdk

-rwxrwxrwx 1 501 20 4254924800 Jun 7 15:09 Virtual Disk-s002.vmdk

-rwxrwxrwx 1 501 20 3077308416 Jun 7 15:09 Virtual Disk-s003.vmdk

-rwxrwxrwx 1 501 20 3811180544 Jun 7 15:09 Virtual Disk-s004.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:02 Virtual Disk-s005.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:02 Virtual Disk-s006.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:02 Virtual Disk-s007.vmdk

-rwxrwxrwx 1 501 20 327680 May 23 16:02 Virtual Disk-s008.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:27 Virtual Disk-s009.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:27 Virtual Disk-s010.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:27 Virtual Disk-s011.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:27 Virtual Disk-s012.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:27 Virtual Disk-s013.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:27 Virtual Disk-s014.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:27 Virtual Disk-s015.vmdk

-rwxrwxrwx 1 501 20 524288 May 23 16:27 Virtual Disk-s016.vmdk

-rwxrwxrwx 1 501 20 586088448 Jun 7 14:21 Virtual Disk-s017.vmdk

-rwxrwxrwx 1 501 20 1527 Jun 7 14:11 Virtual Disk.vmdk

-rwxrwxrwx 1 501 20 2015748096 Jun 7 15:10 Win11-cfd9a924.vmem

-rwxrwxrwx 1 501 20 3969024 Jun 7 15:10 Win11-cfd9a924.vmss

-rwxrwxrwx 1 501 20 294912 Jun 7 15:09 Win11.nvram

-rwxrwxrwx 1 501 20 863 Jun 2 16:28 Win11.plist

-rwxrwxrwx 1 501 20 371 May 23 16:26 Win11.vmsd

-rwxrwxrwx 1 501 20 10396 Jun 7 15:10 Win11.vmx

-rwxr-xr-x 1 501 20 10396 Jul 27 14:37 Win11.vmx.old

-rwxrwxrwx 1 501 20 4257 May 23 16:54 Win11.vmxf

drwxrwxrwx 7 501 20 224 May 23 16:50 appListCache

drwxrwxrwx 3 501 20 96 May 23 16:13 caches

-rwxrwxrwx 1 501 20 89905 Jun 6 17:27 mksSandbox-0.log

-rwxrwxrwx 1 501 20 89925 Jun 3 14:50 mksSandbox-1.log

-rwxrwxrwx 1 501 20 93088 Jun 2 18:41 mksSandbox-2.log

-rwxrwxrwx 1 501 20 89771 Jun 7 15:10 mksSandbox.log

-rwxrwxrwx 1 501 20 554869 Jun 7 15:10 startMenu.plist

-rwxrwxrwx 1 501 20 8192 Jun 3 11:48 vm-10.scoreboard

-rwxrwxrwx 1 501 20 8192 Jun 6 14:11 vm-11.scoreboard

-rwxrwxrwx 1 501 20 8192 Jun 2 13:52 vm-9.scoreboard

-rwxrwxrwx 1 501 20 8192 Jun 7 14:11 vm.scoreboard

-rwxrwxrwx 1 501 20 331931 Jun 6 17:27 vmware-0.log

-rwxrwxrwx 1 501 20 372589 Jun 3 14:50 vmware-1.log

-rwxrwxrwx 1 501 20 657037 Jun 2 18:41 vmware-2.log

-rwxrwxrwx 1 501 20 315788 Jun 7 15:10 vmware.log

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

wila — Sun, 18 Sep 2022 23:34:07 GMT

Without more details I'll stick to my guess of a 68GB sized virtual disk.

edit:

Let me explain the reasoning. There's 17 disk slices and you're using a VMware Fusion later than Fusion 7.
Because of that I already know the disk is under 128GB. As the disk is under 128GB each slice can only take up 4GB. The rules change once a disk is over 128GB, in that case a disk slice might be bigger, but that is not the case here.
17*4=68. So that is the absolute maximum size your virtual disk could be.

Now that last slice might be less than 4GB in size.

So your disk will be between 64GB and 68GB. Normally you'd type in a round number when creating a virtual disk (that's not a must)
A hint for the real size might be in one of the logs, but as I don't have the logs.. your guess will be as good as mine.

Good luck!

--
Wil

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

alexchandel — Mon, 19 Sep 2022 17:25:28 GMT

Okay I can try 68GB, but I would've thought it would be 64GB. Here are the logs btw.

Is there any indication in them as to where the password/key is loaded from?

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

wila — Mon, 19 Sep 2022 21:59:04 GMT

Hi,

I just played a bit with a few dummy VMs.

If you keep the default of 60GB then it creates 16 disk slices.
if you use the 60 GB as default and then resize the disk to 64GB before booting, you already get 18 disk slices.
However if you delete the 60GB disk.. then add back a new disk at 64GB.. it is indeed 17 disk slices.

The log file is useful as it has this line:

2022-06-07T19:11:10.310Z In(05) vmx DISK: OPEN '/Users/alex/Virtual Machines.localized/Win11.vmwarevm/Virtual Disk.vmdk' Geo (8354/255/63) BIOS Geo (0/0/0)

The geometrics there tell me the size of the disk.

When looking at the 64GB disk I just created, then it has the following lines in the descriptor file:

ddb.geometry.cylinders = "8354"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"

Looks like that matched!

I'll attach the descriptor file for you so you can use that.

With a tiny bit of luck it is what was needed.

Then you'll only have to take care of the .vmx (& remove the other files I mentioned)

--
Wil

Re: (VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machi

alexchandel — Thu, 15 Dec 2022 02:46:40 GMT

When I try this, I get the error "Dictionary problem" and nothing happens.

It may be worth noting that the VM is still called "Locked" in VMWare Fusion, and has a lock icon.

Edit: it appears this was caused by missing the dummy VM.