News for hackers. Stuff that matters.
Re:AES Finder – the utility to find AES keys in running proc... by jonstewart on Sunday September 06, 2020 @11:04AM (#24391803)
This source file provides a better history for looking for AES keys. It looks like Sam Trenholme developed the technique originally but I know of it because of Jesse Kornblum’s subsequent work. Simson Garfinkel then embedded relevant code inside of bulk_extractor. The technique is over a decade old:

https://github.com/simsong/bulk_extractor/blob/master/src/sc...

Re:AES Finder – the utility to find AES keys in running proc... by makomk on Sunday September 06, 2020 @12:40PM (#24392579)
It looks like this particular fork of this code has a few nice features that aren't in older versions, such as support for dumping memory and actually knowing about the other common formats of AES key schedule that are commonly found in the wild. It's really annoying to run a search over a dump that you suspect contains an AES key schedule and coming up with nothing because the encryption library used a slightly different way of storing it than the one expected by the tool.