mdecrypt
CLI tool from mcrypt_2.6.8 debian package expects the specific file format with header. Search for write_file_head
function, it shows first 3 bytes of the mcrypt/mdecrypt tool format:
buf[0] = '\0';
buf[1] = 'm';
buf[2] = '\3';
Header should have special bit set, and the IV embedded into the file. It will be read here, in decrypt_general
function:
if (_mcrypt_iv_is_needed(td, mode, noiv) != 0) {
IV = read_iv(FROMF, mcrypt_enc_get_iv_size(td));
} else {
IV = _mcrypt_calloc(1, mcrypt_enc_get_iv_size(td));
}
and read_iv
is defined in extra.c as:
void *read_iv(FILE * fstream, int ivsize)
{
char *IV;
... // malloc
fread(IV, 1, ivsize, fstream);
return IV;
}
So, just check first N bytes of encrypted file (you can post them here after hexdump -C
) and check for mcrypt header (0x00 'm' 0x03) and for your IV. If yes - then mdecrypt
tool should get IV from file. If not - there is no support for setting IV via command-line in mdecrypt
, but you can hack into sources, add new option for iv, then modify decrypt_general
to read iv from option.