1.\" Copyright (c) 2016 Konrad Witaszczyk <def@FreeBSD.org> 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD$ 26.\" 27.Dd December 13, 2016 28.Dt DECRYPTCORE 8 29.Os 30.Sh NAME 31.Nm decryptcore 32.Nd "decrypt a core dump of the operating system" 33.Sh SYNOPSIS 34.Nm 35.Op Fl Lv 36.Fl p Ar privatekeyfile 37.Fl k Ar keyfile 38.Fl e Ar encryptedcore 39.Fl c Ar core 40.Nm 41.Op Fl Lv 42.Op Fl d Ar crashdir 43.Fl p Ar privatekeyfile 44.Fl n Ar dumpnr 45.Sh DESCRIPTION 46The 47.Nm 48utility first decrypts 49.Ar keyfile 50using 51.Ar privatekeyfile 52and then uses the resulting key to decrypt 53.Ar encryptedcore 54saved by 55.Xr savecore 8 . 56The result is saved in 57.Ar core . 58.Pp 59Alternatively a user can decrypt a core dump numbered 60.Ar dumpnr 61from the 62.Ar crashdir 63directory. 64In this case a dump key from the 65.Pa key.# 66file is used and the result is saved in the 67.Pa vmcore.# 68file where 69.Dq # 70corresponds to 71.Ar dumpnr . 72.Pp 73The 74.Nm 75utility can be started with the following command line arguments: 76.Bl -tag -width ".Fl e Ar encryptedcore" 77.It Fl L 78Write log messages to 79.Xr syslogd 8 . 80.It Fl v 81Print or log verbose/debugging information. 82This option can be specified multiple times to raise the verbosity 83level. 84.It Fl p Ar privatekeyfile 85Specify location of a private key file which will be used to decrypt a dump key 86file. 87.It Fl k Ar keyfile 88Specify location of a dump key file. 89.It Fl e Ar encrytpedcore 90Specify location of an encrypted core. 91.It Fl c Ar core 92Specify location of a resulting decrypted core dump. 93.It Fl d Ar crashdir 94Specify an alternative crash dump directory. 95The default crash dump directory is 96.Pa /var/crash . 97.It Fl n Ar dumpnr 98Specify a number of a crash dump to be decrypted. 99.El 100.Sh EXIT STATUS 101.Ex -std 102.Sh SEE ALSO 103.Xr kgdb 1 , 104.Xr capsicum 4 , 105.Xr dumpon 8 , 106.Xr savecore 8 , 107.Xr syslogd 8 108.Sh AUTHORS 109The 110.Nm 111utility was implemented by 112.An Konrad Witaszczyk Aq Mt def@FreeBSD.org . 113