VMware Communities
alexchandel
Contributor
Contributor

(VM Fusion 12.2) Where was the password stored to decrypt VM with vTPM after moving to new machine??

I had a hardware failure and had to migrate machines.  Booting from the old drive was not an option, but I recovered data including all VMs.  However, I discovered to my horror that my Win11 VMs now prompt me for a password, claiming to be encrypted.

Destructively removing the vTPM as described in the article or this thread isn't an option.  I need to know: where was the password stored on the old machine?!?!?

It's hard to speak politely, as binding a virtual machine to its host like this is such a phenomenally bad design choice.  The WHOLE POINT of software emulation (i.e. managedvm.autoAddVTPM = “software”) is to ABSTRACT the host away, not lock it in.  If I wanted actual VM encryption or security, I would've asked for that.  I didn't.

Labels (1)
0 Kudos
15 Replies
ColoradoMarmot
Champion
Champion

I never used Windows 11 on Fusion 12 (support was rudimentary at best), but looking forward, on the tech preview, the password is now set by the user manually, and optionally stored in the system keychain.   I know it doesn't help your current situation, but support is definitely better now.

0 Kudos
wila
Immortal
Immortal

Hi,

As you're referring to two links in which I participate as help (I wrote the article at the vimalin site and I am /u/dfguidance at reddit), a few notes.

The data on the disk isn't encrypted so -at least in theory- you should be to get the VM(s?) back to work. The descriptor files describing those virtual disks however are.

How did you configure the virtual disk on the VM you need back?

Note that my article points to a few threads that describe how users recovered their VM. Not destructive, unless you mean it will drop the vTPM itself (yes it will, no way around that AFAIK).

PS: I don't know where the password was saved in the experimental vTPM feature. But even if it was in the keychain then I think it would still be inaccessible and you are still at the same stage unless you saved the keychain in iCloud.

--
Wil

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
alexchandel
Contributor
Contributor

That sounds like a great improvement over the current situation.  I wish they'd help those of us who tried it in v12.

0 Kudos
alexchandel
Contributor
Contributor

I have a backup of the keychains, and the Library folders.  So if it was stored anywhere in either, I can retrieve it, and it must be possible somehow.  However nothing looks promising.  And copying over the Application Support folder was not sufficient.

I believe it was a lazily allocated disk (I see Virtual Disk-s001.vmdk, etc. files).  The VM has no snapshots.  But there was some data encrypted with the TPM I need back.

However for now, what's a step-by-step procedure for removing the vTPM?  I tried removing the VMX lines mentioned in your post, but of course the VM becomes unbootable.

0 Kudos
wila
Immortal
Immortal

Hi,

With the experimental vTPM feature there's not just .vmx lines that need to be removed.

There are other parts that also have been encrypted, like the vmdk descriptor file. The descriptor file is the vmdk file without the -s00nn.vmdk suffix.

If you don't have a backup copy of that one, then you'll have to recreate the descriptor file yourself by creating a dummy virtual disk of exactly the same size.

Then checking the contents of the descriptor file and drawing up one that matches your disk slice names. It should have the exact same amount of slices.

If you ever have resized your virtual disk, then you have to do that also for the dummy disk.

--
Wil

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
alexchandel
Contributor
Contributor

Is there a way to determine the size & specs?  I can't recall the exact details it was created with.  tbh I didn't expect VMWare to encrypt my files and throw away the password.

Are there any steps besides deleting the vmx lines and recreating the .vmdk descriptor?

0 Kudos
wila
Immortal
Immortal

Hi,

The last time I played with this was probably a year ago, so somehow I don't have exact steps.

In order to be able to help we need more details.

1. a full file list of your VM. (eg. ls -al /foldername/of/vm > ~/Desktop/vm-filelist.txt )

2. a copy of the following files: the .vmx, vmsd, all vmdk files smaller than 4kB

3. all vmware.log files

In order to be able to attach those files to a reply down here, you need to zip/compress them.

An answer to the following questions:

Do you remember when you created this VM? Was this before VMware Fusion 7 or after?

Did you ever increase the size of the virtual disk?

I might have more questions after that.

--
Wil

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
alexchandel
Contributor
Contributor

It was created with Fusion 12, around 6/2/22, and the vTPM was added right after it was created to enable installing Windows 11. I never increased the size.

Here's the file list:

Spoiler

.

..

.DS_Store

Virtual Disk-s001.vmdk

Virtual Disk-s002.vmdk

Virtual Disk-s003.vmdk

Virtual Disk-s004.vmdk

Virtual Disk-s005.vmdk

Virtual Disk-s006.vmdk

Virtual Disk-s007.vmdk

Virtual Disk-s008.vmdk

Virtual Disk-s009.vmdk

Virtual Disk-s010.vmdk

Virtual Disk-s011.vmdk

Virtual Disk-s012.vmdk

Virtual Disk-s013.vmdk

Virtual Disk-s014.vmdk

Virtual Disk-s015.vmdk

Virtual Disk-s016.vmdk

Virtual Disk-s017.vmdk

Virtual Disk.vmdk

Win11-cfd9a924.vmem

Win11-cfd9a924.vmss

Win11.nvram

Win11.plist

Win11.vmsd

Win11.vmx

Win11.vmx.old

Win11.vmxf

appListCache

caches

mksSandbox-0.log

mksSandbox-1.log

mksSandbox-2.log

mksSandbox.log

startMenu.plist

vm-10.scoreboard

vm-11.scoreboard

vm-9.scoreboard

vm.scoreboard

vmware-0.log

vmware-1.log

vmware-2.log

vmware.log

Working on the files… is the vTPM password / encryption key in the log anywhere?  Or the location it's loaded from?

0 Kudos
wila
Immortal
Immortal

That file list has no details on size & date.. as such that's not the output of "ls -al"

There are no details about the vTPM password in the log AFAIK, if it would be there than that would be a massive goof up.

I'm asking for those files to get an idea about the correct size of your disk.. nothing more.

--
Wil

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
wila
Immortal
Immortal

FWIW.. you can try the following for creating the virtual disk.vmdk descriptor file as I will be off to bed.

Step 1) Make a backup of the folder of the VM as you're experimenting and you don't want to loose more.

After that (and only after you have that backup) try the following experiment.

Create a new dummy VM with a disk of 68GB, also with a split disk scheme of course. So the file list of that new VM will look similar as what you have here.

Then replace the file "virtual Disk.vmdk" from your copy with the copy of the new dummy VM.

Also remove the lines from the vmx we talked about earlier.

Throw away (or if you want -rename) the .nvram and .vmxf files.

Boot the vm and see if it complains.

If that doesn't work.. then tell us the errors and attach the files I asked for.. get them from the backup please, not the experiment.

--
Wil

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
alexchandel
Contributor
Contributor

Ah sorry, I wasn't sure how much detail you needed.  Here's ls -aln

Spoiler

total 34982920

drwxrwxrwx  44 501  20        1408 Sep 17 14:13 .

drwxrwxrwx   7 501  20         224 May 23 15:58 ..

-rw-r--r--@  1 501  20        6148 Jul 21 20:00 .DS_Store

-rwxrwxrwx   1 501  20  4152950784 Jun  7 15:09 Virtual Disk-s001.vmdk

-rwxrwxrwx   1 501  20  4254924800 Jun  7 15:09 Virtual Disk-s002.vmdk

-rwxrwxrwx   1 501  20  3077308416 Jun  7 15:09 Virtual Disk-s003.vmdk

-rwxrwxrwx   1 501  20  3811180544 Jun  7 15:09 Virtual Disk-s004.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:02 Virtual Disk-s005.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:02 Virtual Disk-s006.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:02 Virtual Disk-s007.vmdk

-rwxrwxrwx   1 501  20      327680 May 23 16:02 Virtual Disk-s008.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:27 Virtual Disk-s009.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:27 Virtual Disk-s010.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:27 Virtual Disk-s011.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:27 Virtual Disk-s012.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:27 Virtual Disk-s013.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:27 Virtual Disk-s014.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:27 Virtual Disk-s015.vmdk

-rwxrwxrwx   1 501  20      524288 May 23 16:27 Virtual Disk-s016.vmdk

-rwxrwxrwx   1 501  20   586088448 Jun  7 14:21 Virtual Disk-s017.vmdk

-rwxrwxrwx   1 501  20        1527 Jun  7 14:11 Virtual Disk.vmdk

-rwxrwxrwx   1 501  20  2015748096 Jun  7 15:10 Win11-cfd9a924.vmem

-rwxrwxrwx   1 501  20     3969024 Jun  7 15:10 Win11-cfd9a924.vmss

-rwxrwxrwx   1 501  20      294912 Jun  7 15:09 Win11.nvram

-rwxrwxrwx   1 501  20         863 Jun  2 16:28 Win11.plist

-rwxrwxrwx   1 501  20         371 May 23 16:26 Win11.vmsd

-rwxrwxrwx   1 501  20       10396 Jun  7 15:10 Win11.vmx

-rwxr-xr-x   1 501  20       10396 Jul 27 14:37 Win11.vmx.old

-rwxrwxrwx   1 501  20        4257 May 23 16:54 Win11.vmxf

drwxrwxrwx   7 501  20         224 May 23 16:50 appListCache

drwxrwxrwx   3 501  20          96 May 23 16:13 caches

-rwxrwxrwx   1 501  20       89905 Jun  6 17:27 mksSandbox-0.log

-rwxrwxrwx   1 501  20       89925 Jun  3 14:50 mksSandbox-1.log

-rwxrwxrwx   1 501  20       93088 Jun  2 18:41 mksSandbox-2.log

-rwxrwxrwx   1 501  20       89771 Jun  7 15:10 mksSandbox.log

-rwxrwxrwx   1 501  20      554869 Jun  7 15:10 startMenu.plist

-rwxrwxrwx   1 501  20        8192 Jun  3 11:48 vm-10.scoreboard

-rwxrwxrwx   1 501  20        8192 Jun  6 14:11 vm-11.scoreboard

-rwxrwxrwx   1 501  20        8192 Jun  2 13:52 vm-9.scoreboard

-rwxrwxrwx   1 501  20        8192 Jun  7 14:11 vm.scoreboard

-rwxrwxrwx   1 501  20      331931 Jun  6 17:27 vmware-0.log

-rwxrwxrwx   1 501  20      372589 Jun  3 14:50 vmware-1.log

-rwxrwxrwx   1 501  20      657037 Jun  2 18:41 vmware-2.log

-rwxrwxrwx   1 501  20      315788 Jun  7 15:10 vmware.log

0 Kudos
wila
Immortal
Immortal

Without more details I'll stick to my guess of a 68GB sized virtual disk.

edit:

Let me explain the reasoning. There's 17 disk slices and you're using a VMware Fusion later than Fusion 7.
Because of that I already know the disk is under 128GB. As the disk is under 128GB each slice can only take up 4GB. The rules change once a disk is over 128GB, in that case a disk slice might be bigger, but that is not the case here.
17*4=68. So that is the absolute maximum size your virtual disk could be.

Now that last slice might be less than 4GB in size.

So your disk will be between 64GB and 68GB. Normally you'd type in a round number when creating a virtual disk (that's not a must)
A hint for the real size might be in one of the logs, but as I don't have the logs.. your guess will be as good as mine.

Good luck!

--
Wil

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
alexchandel
Contributor
Contributor

Okay I can try 68GB, but I would've thought it would be 64GB.  Here are the logs btw.

Is there any indication in them as to where the password/key is loaded from?

0 Kudos
wila
Immortal
Immortal

Hi,

I just played a bit with a few dummy VMs.

If you keep the default of 60GB then it creates 16 disk slices.
if you use the 60 GB as default and then resize the disk to 64GB before booting, you already get 18 disk slices.
However if you delete the 60GB disk.. then add back a new disk at 64GB.. it is indeed 17 disk slices.

The log file is useful as it has this line:

2022-06-07T19:11:10.310Z In(05) vmx DISK: OPEN '/Users/alex/Virtual Machines.localized/Win11.vmwarevm/Virtual Disk.vmdk' Geo (8354/255/63) BIOS Geo (0/0/0)

The geometrics there tell me the size of the disk.

When looking at the 64GB disk I just created, then it has the following lines in the descriptor file:

ddb.geometry.cylinders = "8354"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"

Looks like that matched!

I'll attach the descriptor file for you so you can use that.

With a tiny bit of luck it is what was needed.

Then you'll only have to take care of the .vmx (& remove the other files I mentioned)

--
Wil

 

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
alexchandel
Contributor
Contributor

When I try this, I get the error "Dictionary problem" and nothing happens.

It may be worth noting that the VM is still called "Locked" in VMWare Fusion, and has a lock icon.

Edit: it appears this was caused by missing the dummy VM.

0 Kudos