4 ms·

It's only been tested on Windows XP? surprising they couldn't/didn't set up a 7/8/10 VM to try and replicate the results

genesee 9y ago
It looks like Microsoft's documentation suggests it will only work on older versions of Windows. From the README: > Indeed, for what I've tested, under Windows 10, CryptReleaseContext does cleanup the memory (and so this recovery technique won't work). It can work under Windows XP because, in this version, CryptReleaseContext does not do the cleanup. Moreover, MSDN states this, for this function : "After this function is called, the released CSP handle is no longer valid. This function does not destroy key containers or key pairs.". So, it seems that there are no clean and cross-platform ways under Windows to clean this memory. I'd be curious where the change happened between XP and 10.
- dafrankenstein2 9y ago
  .NET
dmitrygr 9y ago
From the TFA: This is not really a mistake from the ransomware authors, as they properly use the Windows Crypto API. Indeed, for what I've tested, under Windows 10, CryptReleaseContext does cleanup the memory (and so this recovery technique won't work). It can work under Windows XP because, in this version, CryptReleaseContext does not do the cleanup. Moreover, MSDN states this, for this function : "After this function is called, the released CSP handle is no longer valid. This function does not destroy key containers or key pairs.". So, it seems that there are no clean and cross-platform ways under Windows to clean this memory. If you are lucky (that is the associated memory hasn't been reallocated and erased), these prime numbers might still be in memory. That's what this software tries to achieve.
maxerickson 9y ago
The Twitter says that it has been adapted to work on 7. The readme points out that CryptReleaseContext works better in 10 and thus the recovery doesn't work.
- t3f 9y ago
  The variant for 7: https://github.com/gentilkiwi/wanakiwi https://github.com/gentilkiwi/wanakiwi
tty7 9y ago
You would be welcome to also give it a shot and publish your results
gpvos 9y ago
Cut them some slack, this was published a day ago or so. In a case like this, fast publication is more important: both to help people, and so other people can do things like replicating stuff on other OSs while you sleep.

genesee 9y ago

It looks like Microsoft's documentation suggests it will only work on older versions of Windows. From the README: > Indeed, for what I've tested, under Windows 10, CryptReleaseContext does cleanup the memory (and so this recovery technique won't work). It can work under Windows XP because, in this version, CryptReleaseContext does not do the cleanup. Moreover, MSDN states this, for this function : "After this function is called, the released CSP handle is no longer valid. This function does not destroy key containers or key pairs.". So, it seems that there are no clean and cross-platform ways under Windows to clean this memory. I'd be curious where the change happened between XP and 10.

dafrankenstein2 9y ago
.NET

dmitrygr 9y ago

From the TFA: This is not really a mistake from the ransomware authors, as they properly use the Windows Crypto API. Indeed, for what I've tested, under Windows 10, CryptReleaseContext does cleanup the memory (and so this recovery technique won't work). It can work under Windows XP because, in this version, CryptReleaseContext does not do the cleanup. Moreover, MSDN states this, for this function : "After this function is called, the released CSP handle is no longer valid. This function does not destroy key containers or key pairs.". So, it seems that there are no clean and cross-platform ways under Windows to clean this memory. If you are lucky (that is the associated memory hasn't been reallocated and erased), these prime numbers might still be in memory. That's what this software tries to achieve.

maxerickson 9y ago

The Twitter says that it has been adapted to work on 7. The readme points out that CryptReleaseContext works better in 10 and thus the recovery doesn't work.

t3f 9y ago
The variant for 7: https://github.com/gentilkiwi/wanakiwi https://github.com/gentilkiwi/wanakiwi

tty7 9y ago

You would be welcome to also give it a shot and publish your results

gpvos 9y ago

Cut them some slack, this was published a day ago or so. In a case like this, fast publication is more important: both to help people, and so other people can do things like replicating stuff on other OSs while you sleep.