|
|
194a3dc |
# aeskeyfind
|
|
|
d40c256 |
|
|
rpmbuild |
8f2b7a5 |
The aeskeyfind rpm package.
|
|
|
d40c256 |
|
|
rpmbuild |
8f2b7a5 |
This program illustrates automatic techniques for locating 128-bit and
|
|
rpmbuild |
8f2b7a5 |
256-bit AES keys in a captured memory image.
|
|
rpmbuild |
8f2b7a5 |
|
|
rpmbuild |
8f2b7a5 |
The program uses various algorithms and also performs a simple entropy
|
|
rpmbuild |
8f2b7a5 |
test to filter out blocks that are not keys. It counts the number of
|
|
rpmbuild |
8f2b7a5 |
repeated bytes and skips blocks that have too many repeats.
|
|
rpmbuild |
8f2b7a5 |
|
|
rpmbuild |
8f2b7a5 |
This method works even if several bits of the key schedule have been
|
|
rpmbuild |
8f2b7a5 |
corrupted due to memory decay.
|
|
rpmbuild |
8f2b7a5 |
|
|
rpmbuild |
8f2b7a5 |
This package is useful to several activities, as forensics investigations.
|
|
|
194a3dc |
|