This source file provides a better history for looking for AES keys. It looks like Sam Trenholme developed the technique originally but I know of it because of Jesse Kornblum’s subsequent work. Simson Garfinkel then embedded relevant code inside of bulk_extractor. The technique is over a decade old:

https://github.com/simsong/bulk_extractor/blob/master/src/sc...

It looks like this particular fork of this code has a few nice features that aren't in older versions, such as support for dumping memory and actually knowing about the other common formats of AES key schedule that are commonly found in the wild. It's really annoying to run a search over a dump that you suspect contains an AES key schedule and coming up with nothing because the encryption library used a slightly different way of storing it than the one expected by the tool.

The pull request https://github.com/mmozeiko/aes-finder/pull/11

Says "Improved cross platform capability, key dumping, memory dump search." but it's not even new code so nm to comment on it.

The pull request https://github.com/mmozeiko/aes-finder/pull/11

Says "Improved cross platform capability, key dumping, memory dump search." but it's not even new code so nm comment on it.

This fork has a "memdump" tool to dump the memory of a process and a "-f" option to search for keys in a file, which I assume is the dump from step 1.

<shrug emoji>

Excellent and informative replies to parent here (the replies are peer comments to this one). Thank you!