Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by natch | Hacker News Reader

Parent Full thread

natch·

Sort of feel like such posts should link directly to the original repo the repo was forked from, if any.

https://github.com/mmozeiko/aes-finder

Unless there’s some newsworthy aspect to the child repo being a special different fork.

View on HN

This source file provides a better history for looking for AES keys. It looks like Sam Trenholme developed the technique originally but I know of it because of Jesse Kornblum’s subsequent work. Simson Garfinkel then embedded relevant code inside of bulk_extractor. The technique is over a decade old:

https://github.com/simsong/bulk_extractor/blob/master/src/sc...

It looks like this particular fork of this code has a few nice features that aren't in older versions, such as support for dumping memory and actually knowing about the other common formats of AES key schedule that are commonly found in the wild. It's really annoying to run a search over a dump that you suspect contains an AES key schedule and coming up with nothing because the encryption library used a slightly different way of storing it than the one expected by the tool.

The pull request https://github.com/mmozeiko/aes-finder/pull/11

Says "Improved cross platform capability, key dumping, memory dump search." but it's not even new code so nm to comment on it.

The pull request https://github.com/mmozeiko/aes-finder/pull/11

Says "Improved cross platform capability, key dumping, memory dump search." but it's not even new code so nm comment on it.

This fork has a "memdump" tool to dump the memory of a process and a "-f" option to search for keys in a file, which I assume is the dump from step 1.

Excellent and informative replies to parent here (the replies are peer comments to this one). Thank you!

Reply on news.ycombinator.com