LivingThePiLife
Posts: 5
Joined: Fri Aug 10, 2018 3:43 pm

Trouble duplicating raspbian with dd and possible hacked sd card

Fri Aug 10, 2018 3:49 pm

Hi, long term user here but first time posting, never had anything before I couldn’t fix with a quick google search but this has got me stumped.
So this is a bit of a two part question, here we go

I built a project that controls a water filtration system in my garage that switches relays and solenoids, it was written on a 2016 version of raspbian, I didn’t update because had no intention of connection to internet and everything worked just fine as I wanted before so didn’t want to risk updating and possibly breaking something so left it as it was, lately I’ve added a feature that emails me the logs so updated everything and went about securing the pi ready to go online.
So first of all I changed the password then set it running updates and came back later, after the updates I rebooted the pi but after reboot the password had reset to before, hmmm seems suspect to me so went ahead and formatted the card ready for a new installation of a brand new version of raspbian, used sd formatter and formatted the card and renamed it pi, when the card remounted it was still called boot and had files in it, if I manually delete the files then remove the sd card and put it back in again the files re appear, same every time it’s formatted.
It would seem to me this card has been compromised and has some type of persistence installed into a hidden partition that keeps putting the files back which are probably some type of backdoor, this must be what is causing the password to change back after every boot.
If anyone could give me some pointers on how I can learn how to dissect this sd card and remove what’s on it that would be great.

That leads us into the next part, so after that I swapped to a different sd card, formatted it and everything worked great, card is totally blank so I installed the newest version of raspbian using dd from the command line of my Mac, it copied the iso onto the card which I then put into the pi and went about installation and setting up new user with sudo rights, put my scripts on blah blah blah, so everything now is back to how it should be with a new installation of the newest version of raspbian, brilliant everything works fine, right so I’d better back up this card onto another card, back to the Mac and dd to copy the contents of the sd card to .img
Then using dd again to copy the image back onto a new card, everything seemed to work fine until I put it in the pi and get an error message on boot
Formatted card and tried again with the same result, made another image of the card and did it all over again onto another card and it did it again.
Downloaded the latest version again, installed to a fresh card made another .img and dd to sd card again, all went fine again, put it in the pi and the same error message
0.985817 kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(179,2)

I’ve looked into the error message and it seems there are people who have similar to me but not the same.
I just can’t get my head around this, it’s worked in the past no problem but for some reason now it just won’t play ball.
Is there something with raspbian now that doesn’t let you copy sd cards using dd on a Mac?
Any ideas?
Thanks

Ernst
Posts: 675
Joined: Sat Feb 04, 2017 9:39 am
Location: Germany

Re: Trouble duplicating raspbian with dd and possible hacked sd card

Fri Aug 10, 2018 4:39 pm

A lot of text and I have take the decision not to quote because it not needed.

You have a dead card, a card that has gone into a read-only state that will not retain any new information on a power cycle. The reason why it gives the impression that the card does accept new data is that the information is cached somewhere (in the OS, on the memory controller) but not written to the memory chips. When you pull the card it causes the data to be lost because you removed power, the same can happen when you reboot.

The only way to fix this problem is to take a new memory card.
My first computer was an ICT1500, my first "personal" computer was the Science of Cambridge Mk14, followed by a TRS-80 Model I later

LivingThePiLife
Posts: 5
Joined: Fri Aug 10, 2018 3:43 pm

Re: Trouble duplicating raspbian with dd and possible hacked sd card

Fri Aug 10, 2018 5:16 pm

Ok yes that makes perfect sense so that explains the faulty card, any ideas why dd won’t duplicate a good working card onto another good working card? Never had this problem before

Ernst
Posts: 675
Joined: Sat Feb 04, 2017 9:39 am
Location: Germany

Re: Trouble duplicating raspbian with dd and possible hacked sd card

Fri Aug 10, 2018 5:29 pm

LivingThePiLife wrote:
Fri Aug 10, 2018 5:16 pm
Ok yes that makes perfect sense so that explains the faulty card, any ideas why dd won’t duplicate a good working card onto another good working card? Never had this problem before
0.985817 kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(179,2)
This points to a corrupt data on the memory card, something may have gone wrong duplicating the card.
What it states is that there is a problem mounting the root file system which is second partition.

In you original post I picked up this:
Downloaded the latest version again, installed to a fresh card made another .img and dd to sd card again, all went fine again, put it in the pi and the same error message
Once installed on a fresh card it does make sense to do a dd roundtrip, this is where it could have gone wrong.
My first computer was an ICT1500, my first "personal" computer was the Science of Cambridge Mk14, followed by a TRS-80 Model I later

LivingThePiLife
Posts: 5
Joined: Fri Aug 10, 2018 3:43 pm

Re: Trouble duplicating raspbian with dd and possible hacked sd card

Fri Aug 10, 2018 6:32 pm

Sorry what do you mean by a dd round trip?

So do you mean there could be a corruption with the first memory card that I’m trying to clone and it’s not writing to the second card properly, that would make sense.
Might have to get a new card and start again

Ernst
Posts: 675
Joined: Sat Feb 04, 2017 9:39 am
Location: Germany

Re: Trouble duplicating raspbian with dd and possible hacked sd card

Fri Aug 10, 2018 6:49 pm

LivingThePiLife wrote:
Fri Aug 10, 2018 6:32 pm
Sorry what do you mean by a dd round trip?

So do you mean there could be a corruption with the first memory card that I’m trying to clone and it’s not writing to the second card properly, that would make sense.
Might have to get a new card and start again
This is what I meant with round trip:
Downloaded the latest version again, installed to a fresh card made another .img and dd to sd card again, all went fine again, put it in the pi and the same error message
This is how I interpreted your description: "Download and install (flash) to a fresh card, take image of card and dd to sd card."
My first computer was an ICT1500, my first "personal" computer was the Science of Cambridge Mk14, followed by a TRS-80 Model I later

LivingThePiLife
Posts: 5
Joined: Fri Aug 10, 2018 3:43 pm

Re: Trouble duplicating raspbian with dd and possible hacked sd card

Fri Aug 10, 2018 7:05 pm

Yes that’s right that’s exactly what I did, basically trying to make a duplicate of the os from a fresh installation.

Done it in the past no problem, either I’m doing something wrong or something is not right somewhere

drgeoff
Posts: 8497
Joined: Wed Jan 25, 2012 6:39 pm

Re: Trouble duplicating raspbian with dd and possible hacked sd card

Fri Aug 10, 2018 7:57 pm

Short version: Try restoring to a card of larger nominal size

.Long version:
dd reads the whole card. Every available byte is stored in the file it produces. dd writes that file, every byte of it, to the card being written. You must use a card that is at least as large as the one that was copied. Not the nominal size on the label or packaging but the actual available capacity. It is usual for cards of the same nominal size, even from the same manufacturer's batch, to have slightly different capacities. During testing faulty areas are mapped out as unavailable. So even if the silicon layout inside is identical, the capacities can be different.

LivingThePiLife
Posts: 5
Joined: Fri Aug 10, 2018 3:43 pm

Re: Trouble duplicating raspbian with dd and possible hacked sd card

Sun Aug 12, 2018 4:43 pm

drgeoff wrote:
Fri Aug 10, 2018 7:57 pm
Short version: Try restoring to a card of larger nominal size
Thanks for that worked a charm, put the same image using the same methods onto a 32gb card instead of 8 and it worked first time. I must have just got lucky in the past.

So the obvious answer now would be to try and shrink the file system before making an image, i will look into that now

Return to “Troubleshooting”

Who is online

Users browsing this forum: Bing [Bot], Ernst, klricks and 56 guests