3 ms·

Sort of feel like such posts should link directly to the original repo the repo was forked from, if any. https://github.com/mmozeiko/aes-finder https://github.

• Popcorn_Butter 6y ago
  The pull request https://github.com/mmozeiko/aes-finder/pull/11 https://github.com/mmozeiko/aes-finder/pull/11 Says "Improved cross platform capability, key dumping, memory dump search." but it's not even new code so nm comment on it.
• Popcorn_Butter 6y ago
  The pull request https://github.com/mmozeiko/aes-finder/pull/11 https://github.com/mmozeiko/aes-finder/pull/11 Says "Improved cross platform capability, key dumping, memory dump search." but it's not even new code so nm to comment on it.
• muststopmyths 6y ago
  This fork has a "memdump" tool to dump the memory of a process and a "-f" option to search for keys in a file, which I assume is the dump from step 1. <shrug emoji>
• jonstewart 6y ago
  This source file provides a better history for looking for AES keys. It looks like Sam Trenholme developed the technique originally but I know of it because of Jesse Kornblum’s subsequent work. Simson Garfinkel then embedded relevant code inside of bulk_extractor. The technique is over a decade old: https://github.com/simsong/bulk_extractor/blob/master/src/scan_aes.cpp https://github.com/simsong/bulk_extractor/blob/master/src/sc...
  • makomk 6y ago
    It looks like this particular fork of this code has a few nice features that aren't in older versions, such as support for dumping memory and actually knowing about the other common formats of AES key schedule that are commonly found in the wild. It's really annoying to run a search over a dump that you suspect contains an AES key schedule and coming up with nothing because the encryption library used a slightly different way of storing it than the one expected by the tool.
• natch 6y ago
  Excellent and informative replies to parent here (the replies are peer comments to this one). Thank you!