{"record":{"id":"18fc5518a4e082ad","repo":"NationalSecurityAgency/ghidra","slug":"no-system-partitions-found-perhaps-the-decryption","errorCode":null,"errorMessage":"No system partitions found. Perhaps the decryption failed?","messagePattern":"No system partitions found\\. Perhaps the decryption failed\\?","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"GPL/DMG/src/dmg/java/mobiledevices/dmg/reader/DmgFileReader.java","lineNumber":79,"sourceCode":"\t\tSystem.err.println(\"Trying to detect UDIF structure...\");\n\t\tif (UDIFRecognizer.isUDIF(rras)) {\n\t\t\tSystem.err.println(\"UDIF structure found! Creating filter stream...\");\n\n\t\t\tUDIFFile udifFile = new UDIFFile(new ReadableFileStream(file.getAbsolutePath()));\n\t\t\tdebug(udifFile.getView().getPlistData(), \"dmg-xml\");\n\n\t\t\tUDIFRandomAccessStream stream = new UDIFRandomAccessStream(rras);\n\t\t\trras = stream;\n\t\t}\n\t\telse {\n\t\t\tSystem.err.println(\"UDIF structure not found. Proceeding...\");\n\t\t}\n\n\t\tPartitionSystemRecognizer partitionSystemRecognizer = new PartitionSystemRecognizer(rras);\n\t\tPartitionSystem partitionSystem = partitionSystemRecognizer.getPartitionSystem();\n\n\t\tif (partitionSystem == null) {\n\t\t\tthrow new IOException(\"No system partitions found. Perhaps the decryption failed?\");\n\t\t}\n\n\t\tPartition[] partitions = partitionSystem.getUsedPartitionEntries();\n\t\tfor (Partition partition : partitions) {\n\t\t\topenPartition(partition);\n\t\t}\n\t}\n\n\tprivate void debug(byte[] plistData, String fileName) {\n\t\t// TODO Auto-generated method stub\n\t}\n\n\tprivate void openPartition(Partition selectedPartition) throws IOException {\n\t\tlong fsOffset = selectedPartition.getStartOffset();//getPmPyPartStart()+selectedPartition.getPmLgDataStart())*blockSize;\n\t\tlong fsLength = selectedPartition.getLength();//getPmDataCnt()*blockSize;\n\n\t\tFileSystemRecognizer fsr = new FileSystemRecognizer(rras, fsOffset);\n\t\tFileSystemRecognizer.FileSystemType fsType = fsr.detectFileSystem();","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/GPL/DMG/src/dmg/java/mobiledevices/dmg/reader/DmgFileReader.java#L61-L97","documentation":"DmgFileReader drives a PartitionSystemRecognizer over the (possibly decrypted) random-access stream; if no recognizable partition scheme (MBR/GPT/APM/etc.) is detected, getPartitionSystem() returns null and this IOException is thrown. The message explicitly suggests decryption failure, because the most common cause is a silently-bad decryption producing bytes that no partition recognizer accepts.","triggerScenarios":"PartitionSystemRecognizer.getPartitionSystem() returns null after probing the stream. This happens when the stream does not begin with a valid partition map signature, e.g. because the DMG was encrypted and the decryption step was skipped/failed, or the image is not a partitioned disk image.","commonSituations":"Encrypted DMG processed without the correct key or with the decryption step omitted (most common, per the message); a DMG that is a raw filesystem image rather than a partitioned disk; a truncated/corrupt image missing the partition map; wrong file passed (not a DMG at all).","solutions":["Confirm the DMG is encrypted and, if so, that the decryption key and decryption step ran successfully before partition recognition.","Verify the input is actually a DMG disk image (check the koly/trailer UDIF signature) and is not truncated.","If the image is a raw filesystem (no partition table), route it directly to the filesystem reader instead of the partition recognizer.","Re-download / re-extract the DMG and confirm checksums."],"exampleFix":"// before\nPartitionSystem ps = new PartitionSystemRecognizer(rras).getPartitionSystem();\nif (ps == null) throw new IOException(\"No system partitions found...\");\n\n// after - distinguish encryption vs. raw-image cases\nif (!decryptedSuccessfully) {\n    throw new IOException(\"DMG decryption did not complete; cannot recognize partitions\");\n}\nPartitionSystem ps = new PartitionSystemRecognizer(rras).getPartitionSystem();\nif (ps == null) {\n    throw new IOException(\"No partition table recognized; if this is a raw filesystem image, open it directly\");\n}","handlingStrategy":"validation","validationCode":"// Before partition recognition, confirm the stream is plausibly a decrypted, partitioned image\nif (!decryptedSuccessfully) {\n    throw new IOException(\"Cannot recognize partitions: DMG decryption not completed successfully\");\n}\n// Optionally probe the first sector for known partition-map signatures\nbyte[] head = new byte[512];\nrras.readFully(0, head);\nboolean looksPartitioned = (head[510] == 0x55 && head[511] == (byte) 0xAA) /* MBR */\n    || (head[0] == 'E' && head[1] == 'R') /* APM */\n    || \"EFI PART\".equals(new String(head, 512, 8)); /* GPT - would need offset 512 */\nif (!looksPartitioned) {\n    throw new IOException(\"No partition-map signature found; image may be raw or undecrypted\");\n}","typeGuard":"boolean isLikelyPartitioned(byte[] firstSector) {\n    return (firstSector[510] & 0xFF) == 0x55 && (firstSector[511] & 0xFF) == 0xAA;\n}","tryCatchPattern":"try {\n    new DmgFileReader(...); // or the partition-recognition step\n} catch (IOException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"No system partitions found\")) {\n        // Distinguish decryption failure from raw-image case before surfacing\n        throw new IOException(\"Partition recognition failed: verify decryption and that the image has a partition table\", e);\n    }\n    throw e;\n}","preventionTips":["Ensure encrypted-DMG decryption runs and succeeds before partition recognition.","Confirm the input is a partitioned disk image (vs. a raw filesystem image).","Verify DMG integrity (koly/UDIF trailer, checksum) before parsing.","If working with raw filesystem images, bypass the partition recognizer and open the filesystem directly."],"tags":["dmg","partitions","decryption","parsing","corrupt-file"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}