TrueCrypt学习笔记(安全篇)

1、BootSector.asm代码分析（加载MBR数据，对BootLoader解压缩，进入BootLoader）：

;

; Copyright (c) 2008-2009 TrueCrypt Developers Association. All rights reserved.

;

; Governed by the TrueCrypt License 3.0 the full text of which is contained in

; the file License.txt included in TrueCrypt binary and source code distribution

; packages.

;

.MODEL tiny

.386

_TEXT SEGMENT USE16

INCLUDE BootDefs.i

ORG 7C00h ; Standard boot sector offset，开始代码执行

start:

; BIOS executes boot sector from 0:7C00 or 7C0:0000 (default CD boot loader address).

; Far jump to the next instruction sets IP to the standard offset 7C00.

db 0EAh ; jmp 0:main，跳转指令

dw main, 0 ;跳转的地址

loader_name_msg:

db ' TrueCrypt Boot Loader', 13, 10, 0

main:

cli

xor ax, ax

mov ds, ax

movss, ax

movsp, 7C00h

sti

; Display boot loader name

test byte ptr [start + TC_BOOT_SECTOR_USER_CONFIG_OFFSET],

TC_BOOT_USER_CFG_FLAG_SILENT_MODE

jnzskip_loader_name_msg

leasi, loader_name_msg

call print

skip_loader_name_msg:

; Determine boot loader segment

mov ax, TC_BOOT_LOADER_SEGMENT

; Check available memory

cmp word ptr [ds:413h], TC_BOOT_LOADER_SEGMENT / 1024 * 16 + TC_BOOT_MEMORY_REQUIRED

jgememory_ok

mov ax, TC_BOOT_LOADER_SEGMENT_LOW

cmp word ptr [ds:413h], TC_BOOT_LOADER_SEGMENT_LOW / 1024 * 16 + TC_BOOT_MEMORY_REQUIRED

jgememory_ok

; Insufficient memory

mov ax, TC_BOOT_LOADER_LOWMEM_SEGMENT

memory_ok:

moves, ax

; Clear BSS section

xor al, al

mov di, TC_COM_EXECUTABLE_OFFSET

mov cx, TC_BOOT_MEMORY_REQUIRED * 1024 - TC_COM_EXECUTABLE_OFFSET - 1

cld

repstosb

mov ax, es

sub ax, TC_BOOT_LOADER_DECOMPRESSOR_MEMORY_SIZE / 16 ; Decompressor segment

moves, ax

; Load decompressor，加载解码程序的代码到当前代码

mov cl, TC_BOOT_LOADER_DECOMPRESSOR_START_SECTOR

retry_backup:

mov al, TC_BOOT_LOADER_DECOMPRESSOR_SECTOR_COUNT

movbx, TC_COM_EXECUTABLE_OFFSET

callread_sectors

; Decompressor checksum

xorebx, ebx

movsi, TC_COM_EXECUTABLE_OFFSET

mov cx, TC_BOOT_LOADER_DECOMPRESSOR_SECTOR_COUNT * TC_LB_SIZE

call checksum

pushebx

; Load compressed boot loader

movbx, TC_BOOT_LOADER_COMPRESSED_BUFFER_OFFSET

mov cl, TC_BOOT_LOADER_START_SECTOR

mov al, TC_MAX_BOOT_LOADER_SECTOR_COUNT

testbackup_loader_used, 1

jznon_backup

mov al, TC_BOOT_LOADER_BACKUP_SECTOR_COUNT - TC_BOOT_LOADER_DECOMPRESSOR_SECTOR_COUNT

mov cl, TC_BOOT_LOADER_START_SECTOR + TC_BOOT_LOADER_BACKUP_SECTOR_COUNT

non_backup:

callread_sectors

; Boot loader checksum

popebx

movsi, TC_BOOT_LOADER_COMPRESSED_BUFFER_OFFSET

mov cx, word ptr [start + TC_BOOT_SECTOR_LOADER_LENGTH_OFFSET]

call checksum

; Verify checksum

cmpebx, dwordptr [start + TC_BOOT_SECTOR_LOADER_CHECKSUM_OFFSET]

jechecksum_ok

; Checksum incorrect - try using backup if available

testbackup_loader_used, 1

jnzloader_damaged

movbackup_loader_used, 1

mov cl, TC_BOOT_LOADER_DECOMPRESSOR_START_SECTOR + TC_BOOT_LOADER_BACKUP_SECTOR_COUNT

test TC_BOOT_CFG_FLAG_BACKUP_LOADER_AVAILABLE, byte ptr [start + TC_BOOT_SECTOR_CONFIG_OFFSET]

jnzretry_backup

loader_damaged:

leasi, loader_damaged_msg

call print

leasi, loader_name_msg

call print

jmp $

checksum_ok:

; Set up decompressor segment

mov ax, es

mov ds, ax

cli

movss, ax

movsp, TC_BOOT_LOADER_DECOMPRESSOR_MEMORY_SIZE

sti

push dx

; Decompress boot loader

push TC_BOOT_LOADER_COMPRESSED_BUFFER_OFFSET + TC_GZIP_HEADER_SIZE

; Compressed data

push TC_MAX_BOOT_LOADER_DECOMPRESSED_SIZE

; Output buffer size

push TC_BOOT_LOADER_DECOMPRESSOR_MEMORY_SIZE + TC_COM_EXECUTABLE_OFFSET ; Output buffer

pushcs

pushdecompressor_ret

pushes

push TC_COM_EXECUTABLE_OFFSET

retf

decompressor_ret:

addsp, 6

pop dx

; Restore boot sector segment

pushcs

pop ds

; Check decompression result

test ax, ax

jzdecompression_ok

leasi, loader_damaged_msg

call print

jmp $

decompression_ok:

; DH = boot sector flags

mov dh, byte ptr [start + TC_BOOT_SECTOR_CONFIG_OFFSET]

; Set up boot loader segment

mov ax, es

add ax, TC_BOOT_LOADER_DECOMPRESSOR_MEMORY_SIZE / 16 moves, ax

mov ds, ax

cli

movss, ax

movsp, TC_BOOT_LOADER_STACK_TOP

sti

; Execute boot loader

pushes

push TC_COM_EXECUTABLE_OFFSET

retf

; Print string

print:

xorbx, bx

mov ah, 0eh

cld

@@: lodsb

test al, al

jzprint_end

int 10h

jmp @B

print_end:

ret

; Read sectors of the first cylinder

read_sectors:

movch, 0 ; Cylinder

mov dh, 0 ; Head

; DL = drive number passed from BIOS mov ah, 2

int 13h

jncread_ok

leasi, disk_error_msg

call print

read_ok:

ret

; Calculate checksum

checksum:

push ds

pushes

pop ds

xoreax, eax

cld

@@: lodsb

addebx, eax

rolebx, 1

loop @B

pop ds

ret

backup_loader_used db 0

disk_error_msg db 'Disk error', 13, 10, 7, 0

loader_damaged_msg db 7, 'Loader damaged! Use Rescue Disk: Repair Options > Restore', 0

ORG 7C00h + 510

dw 0AA55h ; Boot sector signature

_TEXT ENDS

END start

反编译后的代码：

00000000 EA1E7C0000jmp word 0x0:0x7c1e 00000005 205472 and [si+0x72],dl 00000008 7565jnz 0x6f

0000000A 43incbx

0000000B 7279jc 0x86

0000000D 7074jo 0x83

0000000F 20426F and [bp+si+0x6f],al 00000012 6Foutsw

00000013 7420jz 0x35

00000015 4Cdecsp

00000016 6Foutsw

00000017 61popaw

00000018 6465720Dgsjc 0x29

0000001C 0A00 or al,[bx+si] 0000001E FA cli

0000001F 33C0xorax,ax

00000021 8ED8movds,ax

00000023 8ED0movss,ax

00000025 BC007Cmov sp,0x7c00

00000028 FBsti

00000029 F606B67D01 test byte [0x7db6],0x1

0000002E 7507jnz 0x37

00000030 8D36057C lea si,[0x7c05]

00000034 E8DC00 call word 0x113

00000037 B80090mov ax,0x9000

0000003A 813E13046A02cmp word [0x413],0x26a

00000040 7D0Ejnl 0x50

00000042 B80080mov ax,0x8000

00000045 813E13042A02cmp word [0x413],0x22a

0000004B 7D03jnl 0x50

0000004D B80020mov ax,0x2000

00000050 8EC0moves,ax

00000052 32C0xoral,al

00000054 BF0001mov di,0x100

00000057 B9FFA6mov cx,0xa6ff

0000005A FCcld

0000005B F3AA rep stosb

0000005D 8CC0movax,es

0000005F 2D0008 sub ax,0x800；Decompressor segment

00000062 8EC0moves,ax

00000064 B102 mov cl,0x2；开始的扇区

00000066 B004 mov al,0x4；需要读取的扇区数

00000068 BB0001mov bx,0x100

0000006B E8B400 call word 0x122；通过int13读取Decompressor代码/*AH=2 （指定功能号）

AL=要读取的扇区数

DL=磁盘号（0、1-软盘；80、81-硬盘）

DH=磁头号

CL高2位+CH=柱面号

CL低6位=扇区号

CS:BX=存放读取数据的内存缓冲地址

出口参数：CS:BX=读取数据存放地址

*/

0000006E 6633DBxorebx,ebx

00000071 BE0001mov si,0x100

00000074 B90008mov cx,0x800

00000077 E8BA00 call word 0x134

0000007A 6653 push ebx

0000007C BB000Dmov bx,0xd00

0000007F B106mov cl,0x6

00000081 B039mov al,0x39

00000083 F606467D01 test byte [0x7d46],0x1

00000088 7404jz 0x8e

0000008A B01Amov al,0x1a

0000008C B124mov cl,0x24

0000008E E89100 call word 0x122

00000091 665B pop ebx

00000093 BE000Dmov si,0xd00

00000096 8B0EB07Dmov cx,[0x7db0]

0000009A E89700 call word 0x134

0000009D 663B1EB27Dcmpebx,[0x7db2]

000000A2 7425jz 0xc9

000000A4 F606467D01 test byte [0x7d46],0x1

000000A9 750Ejnz 0xb9

000000AB C606467D01mov byte [0x7d46],0x1

000000B0 B120mov cl,0x20

000000B2 F606B77D02 test byte [0x7db7],0x2

000000B7 75ADjnz 0x66

000000B9 8D36557D lea si,[0x7d55]

000000BD E85300 call word 0x113

000000C0 8D36057C lea si,[0x7c05]

000000C4 E84C00 call word 0x113

000000C7 EBFEjmp short 0xc7

000000C9 8CC0movax,es

000000CB 8ED8movds,ax

000000CD FA cli

000000CE 8ED0movss,ax

000000D0 BC0080mov sp,0x8000

000000D3 FBsti

000000D4 52 push dx

000000D5 680A0D push word 0xd0a

000000D8 68007A push word 0x7a00

000000DB 680081 push word 0x8100

000000DE 0E push cs

000000DF 68E77C push word 0x7ce7

000000E2 06 push es

000000E3 680001 push word 0x100

000000E6 CB retf；程序正常启动，执行BootLoader 000000E7 83C406 add sp,byte +0x6

000000EA 5A pop dx

000000EB 0E push cs

000000EC 1F pop ds

000000ED 85C0 test ax,ax

000000EF 7409jz 0xfa

000000F1 8D36557D lea si,[0x7d55]

000000F5 E81B00 call word 0x113

000000F8 EBFEjmp short 0xf8

000000FA 8A36B77Dmov dh,[0x7db7]

000000FE 8CC0movax,es

00000100 050008 add ax,0x800 00000103 8EC0moves,ax

00000105 8ED8movds,ax

00000107 FA cli

00000108 8ED0movss,ax

0000010A BCFCA7mov sp,0xa7fc

0000010D FBsti

0000010E 06 push es

0000010F 680001 push word 0x100 00000112 CBretf

00000113 33DBxorbx,bx

00000115 B40Emov ah,0xe

00000117 FCcld

00000118 AClodsb

00000119 84C0 test al,al

0000011B 7404jz 0x121

0000011D CD10int 0x10

0000011F EBF7jmp short 0x118

00000121 C3 ret

00000122 B500mov ch,0x0

00000124 B600mov dh,0x0

00000126 B402 mov ah,0x2；表示读00000128 CD13int 0x13

0000012A 7307jnc 0x133

0000012C 8D36477D lea si,[0x7d47] 00000130 E8E0FF call word 0x113 00000133 C3 ret

00000134 1E push ds 00000135 06 push es 00000136 1F pop ds

00000137 6633C0xoreax,eax

0000013A FCcld

0000013B AClodsb

0000013C 6603D8 add ebx,eax 0000013F 66D1C3rol ebx,1

00000142 E2F7 loop 0x13b 00000144 1F pop ds

00000145 C3 ret

00000146 004469 add [si+0x69],al 00000149 736Bjnc 0x1b6

0000014B 206572 and [di+0x72],ah

0000014E 726Fjc 0x1bf

00000150 720Djc 0x15f

00000152 0A07 or al,[bx]

00000154 0007 add [bx],al

00000156 4Cdecsp

00000157 6Foutsw

00000158 61popaw

00000159 64657220gsjc 0x17d

0000015D 6461 fs popaw

0000015F 6Dinsw

00000160 61popaw

00000161 6765642120 and [fs:eax],sp

00000166 55 push bp

00000167 7365jnc 0x1ce

00000169 205265 and [bp+si+0x65],dl 0000016C 7363jnc 0x1d1

0000016E 7565jnz 0x1d5

00000170 204469 and [si+0x69],al 00000173 736Bjnc 0x1e0

00000175 3A20cmp ah,[bx+si]

00000177 52 push dx

00000178 657061gsjo 0x1dc

0000017B 6972204F70imulsi,[bp+si+0x20],word 0x704f 00000180 7469jz 0x1eb

00000182 6Foutsw

00000183 6Eoutsb

00000184 7320jnc 0x1a6

00000186 3E205265 and [ds:bp+si+0x65],dl 0000018A 7374jnc 0x200

0000018C 6Foutsw

0000018D 7265jc 0x1f4

2、主程序：https://www.360docs.net/doc/b85708118.html,

（1）R eadBootSectorUserConfiguration主要函数功能

该函数与磁盘加密标准中的XTS-AES-blockEnc(Key, P, i, j)函数对应，区别在于在TrueCrypt中structUnitNo为64位，nbrUnits为32位或64位，而标准中i，j的值均为128位，最终调用的函数为EncryptDecryptBufferXTS32 (buffer, length, startDataUnitNo, startCipherBlockNo, ks, ks2, cipher, FALSE);。

参数

buf：加密缓存。

structUnitNo：表示加密数据单元号，实际就是TrueCrypt中的磁盘扇区编号，对应i。

nbrUnits：针对每个数据文件加密的内部单元号，对每个数据文件来说，该值的初值均为0，对应j。

ci：XTS模式的话使用双密钥。

3、主程序：https://www.360docs.net/doc/b85708118.html,

该程序的主要功能是解压缩BootLoader代码，main函数的参数如下。

TrueCrypt命令行使用

创建一个新的TrueCrypt卷

Usage: truecrypt [--auto-mount ] [--backup-headers] [--background-task] [-C] [-c] [--create-keyfile] [--delete-token-keyfiles] [-d] [--display-password] [--encryption ] [--explore] [--export-token-keyfile] [--filesystem] [-f] [--fs-options ] [--hash ] [-h] [--import-token-keyfiles] [-k ] [-l] [--list-token-keyfiles] [--load-preferences] [--mount] [-m ] [--new-keyfiles] [--new-password ] [--non-interactive] [-p ] [--protect-hidden ] [--protection-keyfiles] [--protection-password ] [--random-source ] [--restore-headers] [--save-preferences] [--quick] [--size ] [--slot ] [--test] [-t] [--token-lib ] [-v] [--version] [--volume-properties] [--volume-type ] [Volume path] [Mount point]

--auto-mount= Auto mount device-hosted/favorite volumes

--backup-headers Backup volume headers

--background-task Start Background Task

-C, --change Change password or keyfiles

-c, --create Create new volume

--create-keyfile Create new keyfile

--delete-token-keyfiles Delete security token keyfiles

-d, --dismount Dismount volume

--display-password Display password while typing

--encryption= Encryption algorithm

--explore Open explorer window for mounted volume

--export-token-keyfile Export keyfile from security token

--filesystem= Filesystem type

-f, --force Force mount/dismount/overwrite

--fs-options= Filesystem mount options

--hash= Hash algorithm

-h, --help Display detailed command line help

--import-token-keyfiles Import keyfiles to security token

-k, --keyfiles= Keyfiles

-l, --list List mounted volumes

--list-token-keyfiles List security token keyfiles

--load-preferences Load user preferences

--mount Mount volume interactively

-m, --mount-options= TrueCrypt volume mount options

--new-keyfiles= New keyfiles

--new-password= New password

--non-interactive Do not interact with user

-p, --password= Password

--protect-hidden= Protect hidden volume

--protection-keyfiles= Keyfiles for protected hidden volume

--protection-password= Password for protected hidden volume

--random-source= Use file as source of random data

--restore-headers Restore volume headers

--save-preferences Save user preferences

--quick Enable quick format

--size= Size in bytes

--slot= Volume slot number

--test Test internal algorithms

-t, --text Use text user interface

--token-lib= Security token library

-v, --verbose Enable verbose output

--version Display version information

--volume-properties Display volume properties

--volume-type= Volume type

Synopsis:

truecrypt [OPTIONS] COMMAND

truecrypt [OPTIONS] VOLUME_PATH [MOUNT_DIRECTORY]

Commands:

--auto-mount=devices|favorites

Auto mount device-hosted or favorite volumes.

--backup-headers[=VOLUME_PATH]

Backup volume headers to a file. All required options are requested from the user.

-c, --create[=VOLUME_PATH]

Create a new volume. Most options are requested from the user if not specified on command line. See also options --encryption, -k, --filesystem, --hash, -p,

--random-source, --quick, --size, --volume-type. Note that passing some of the options may affect security of the volume (see option -p for more information).

Inexperienced users should use the graphical user interface to create a hidden volume. When using the text user interface, the following procedure must be followed to create a hidden volume:

1) Create an outer volume with no filesystem.

2) Create a hidden volume within the outer volume.

3) Mount the outer volume using hidden volume protection.

4) Create a filesystem on the virtual device of the outer volume.

5) Mount the new filesystem and fill it with data.

6) Dismount the outer volume.

If at any step the hidden volume protection is triggered, start again from 1).

--create-keyfile[=FILE_PATH]

Create a new keyfile containing pseudo-random data.

-C, --change[=VOLUME_PATH]

Change a password and/or keyfile(s) of a volume. Most options are requested from the user if not specified on command line. PKCS-5 PRF HMAC hash algorithm can be changed with option --hash. See also options -k,

--new-keyfiles, --new-password, -p, --random-source.

-d, --dismount[=MOUNTED_VOLUME]

Dismount a mounted volume. If MOUNTED_VOLUME is not specified, all volumes are dismounted. See below for description of MOUNTED_VOLUME.

--delete-token-keyfiles

Delete keyfiles from security tokens. See also command --list-token-keyfiles.

--export-token-keyfile

Export a keyfile from a security token. See also command --list-token-keyfiles.

--import-token-keyfiles

Import keyfiles to a security token. See also option --token-lib.

-l, --list[=MOUNTED_VOLUME]

Display a list of mounted volumes. If MOUNTED_VOLUME is not specified, all volumes are listed. By default, the list contains only volume path, virtual device, and mount point. A more detailed list can be enabled by verbose

output option (-v). See below for description of MOUNTED_VOLUME.

--list-token-keyfiles

Display a list of all available security token keyfiles. See also command

--import-token-keyfiles.

--mount[=VOLUME_PATH]

Mount a volume. Volume path and other options are requested from the user if not specified on command line.

--restore-headers[=VOLUME_PATH]

Restore volume headers from the embedded or an external backup. All required

options are requested from the user.

--save-preferences

Save user preferences.

--test

Test internal algorithms used in the process of encryption and decryption.

--version

Display program version.

--volume-properties[=MOUNTED_VOLUME]

Display properties of a mounted volume. See below for description of MOUNTED_VOLUME.

MOUNTED_VOLUME:

Specifies a mounted volume. One of the following forms can be used:

1) Path to the encrypted TrueCrypt volume.

2) Mount directory of the volume's filesystem (if mounted).

3) Slot number of the mounted volume (requires --slot).

Options:

--display-password

Display password characters while typing.

--encryption=ENCRYPTION_ALGORITHM

Use specified encryption algorithm when creating a new volume.

--filesystem=TYPE

Filesystem type to mount. The TYPE argument is passed to mount(8) command with option -t. Default type is 'auto'. When creating a new volume, this option specifies the filesystem to be created on the new volume (only 'FAT' and 'none' TYPE is allowed). Filesystem type 'none' disables mounting or creating a filesystem.

--force

Force mounting of a volume in use, dismounting of a volume in use, or overwriting a file. Note that this option has no effect on some platforms.

--fs-options=OPTIONS

Filesystem mount options. The OPTIONS argument is passed to mount(8) command with option -o when a filesystem on a TrueCrypt volume is mounted.

This option is not available on some platforms.

--hash=HASH

Use specified hash algorithm when creating a new volume or changing password and/orkeyfiles. This option also specifies the mixing PRF of the random

number generator.

-k, --keyfiles=KEYFILE1[,KEYFILE2,KEYFILE3,...]

Use specified keyfiles when mounting a volume or when changing password

and/orkeyfiles. When a directory is specified, all files inside it will be

used (non-recursively). Multiple keyfiles must be separated by comma.

Use double comma (,,) to specify a comma contained in keyfile's name.

Keyfile stored on a security token must be specified as

token://slot/SLOT_NUMBER/file/FILENAME. An empty keyfile (-k "") disables interactive requests for keyfiles. See also options --import-token-keyfiles,

--list-token-keyfiles, --new-keyfiles, --protection-keyfiles.

--load-preferences

Load user preferences.

-m, --mount-options=OPTION1[,OPTION2,OPTION3,...]

Specifies comma-separated mount options for a TrueCrypt volume: headerbak: Use backup headers when mounting a volume.

nokernelcrypto: Do not use kernel cryptographic services.

readonly|ro: Mount volume as read-only.

system: Mount partition using system encryption.

timestamp|ts: Do not restore host-file modification timestamp when a volume

is dismounted (note that the operating system under certain circumstances

does not alter host-file timestamps, which may be mistakenly interpreted

to mean that this option does not work).

See also option --fs-options.

--new-keyfiles=KEYFILE1[,KEYFILE2,KEYFILE3,...]

Add specified keyfiles to a volume. This option can only be used with command -C.

--new-password=PASSWORD

Specifies a new password. This option can only be used with command -C.

-p, --password=PASSWORD

Use specified password to mount/open a volume. An empty password can also be specified (-p ""). Note that passing a password on the command line is potentially insecure as the password may be visible in the process list

(seeps(1)) and/or stored in a command history file or system logs.

--protect-hidden=yes|no

Write-protect a hidden volume when mounting an outer volume. Before mounting the outer volume, the user will be prompted for a password to open the hidden volume. The size and position of the hidden volume is then determined and the outer volume is mounted with all sectors belonging to the hidden volume protected against write operations. When a write to the protected area is prevented, the whole volume is switched to read-only mode. Verbose list

(-v -l) can be used to query the state of the hidden volume protection.

Warning message is displayed when a volume switched to read-only is being dismounted.

--protection-keyfiles=KEYFILE1[,KEYFILE2,KEYFILE3,...]

Use specified keyfiles to open a hidden volume to be protected. This option

may be used only when mounting an outer volume with hidden volume protected. See also options -k and --protect-hidden.

--protection-password=PASSWORD

Use specified password to open a hidden volume to be protected. This option may be used only when mounting an outer volume with hidden volume protected. See also options -p and --protect-hidden.

--quick

Do not encrypt free space when creating a device-hosted volume. This option must not be used when creating an outer volume.

--random-source=FILE

Use FILE as a source of random data (e.g., when creating a volume) instead

of requiring the user to type random characters.

--slot=SLOT

Use specified slot number when mounting, dismounting, or listing a volume.

--size=SIZE

Use specified size in bytes when creating a new volume.

-t, --text

Use text user interface. Graphical user interface is used by default if available. This option must be specified as the first argument.

--token-lib=LIB_PATH

Use specified PKCS #11 security token library.

--volume-type=TYPE

Use specified volume type when creating a new volume. TYPE can be 'normal' or 'hidden'. See option -c for more information on creating hidden volumes.

-v, --verbose

Enable verbose output.

IMPORTANT:

If you want to use TrueCrypt, you must follow the security requirements and security precautions listed in chapter 'Security Requirements and Precautions' in the TrueCrypt documentation (file 'TrueCrypt User Guide.pdf').

Examples:

Create a new volume:

truecrypt -t -c

Mount a volume:

truecrypt volume.tc /media/truecrypt1

Mount a volume as read-only, using keyfiles:

truecrypt -m ro -k keyfile1,keyfile2 volume.tc

Mount a volume without mounting its filesystem:

truecrypt --filesystem=none volume.tc

Mount a volume prompting only for its password:

truecrypt -t -k "" --protect-hidden=no volume.tc /media/truecrypt1

Dismount a volume:

truecrypt -d volume.tc

Dismount all mounted volumes:

truecrypt–d

交互式的命令：

wh@wh-virtual-machine:~$ truecrypt -c

Volume type:

1) Normal

2) Hidden

Select [1]: 1

Enter volume path: /home/wh/123.tc

Enter volume size (sizeK/size[M]/sizeG): 100M

Encryption algorithm: