{"action":"created","issue":{"url":"https://api.github.com/repos/mmozeiko/aes-finder/issues/14","repository_url":"https://api.github.com/repos/mmozeiko/aes-finder","labels_url":"https://api.github.com/repos/mmozeiko/aes-finder/issues/14/labels{/name}","comments_url":"https://api.github.com/repos/mmozeiko/aes-finder/issues/14/comments","events_url":"https://api.github.com/repos/mmozeiko/aes-finder/issues/14/events","html_url":"https://github.com/mmozeiko/aes-finder/issues/14","id":388951081,"node_id":"MDU6SXNzdWUzODg5NTEwODE=","number":14,"title":"Does not detect 8 byte AES keys","user":{"login":"ZirakC","id":10685608,"node_id":"MDQ6VXNlcjEwNjg1NjA4","avatar_url":"https://avatars3.githubusercontent.com/u/10685608?v=4","gravatar_id":"","url":"https://api.github.com/users/ZirakC","html_url":"https://github.com/ZirakC","followers_url":"https://api.github.com/users/ZirakC/followers","following_url":"https://api.github.com/users/ZirakC/following{/other_user}","gists_url":"https://api.github.com/users/ZirakC/gists{/gist_id}","starred_url":"https://api.github.com/users/ZirakC/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ZirakC/subscriptions","organizations_url":"https://api.github.com/users/ZirakC/orgs","repos_url":"https://api.github.com/users/ZirakC/repos","events_url":"https://api.github.com/users/ZirakC/events{/privacy}","received_events_url":"https://api.github.com/users/ZirakC/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-12-08T19:20:26Z","updated_at":"2018-12-15T20:35:00Z","closed_at":null,"author_association":"NONE","body":"Hello,\r\n\r\nI have noticed that the application only supports extracting AES Keys based on 4 bytes (x256) from the \"TE\" variable.\r\n\r\nIn the application I am trying to extract the keys from, it seems like it uses a slightly different table:\r\n0xc6636300, 0xc66363a5, 0xf87c7c00, 0xf87c7c84, 0xee777700, 0xee777799, 0xf67b7b00, 0xf67b7b8d,\r\n\t0xfff2f200, 0xfff2f20d, 0xd66b6b00, 0xd66b6bbd etc.\r\n\r\nAs you can see, it seems to be an 8 byte table (correct me if I'm wrong). You can see the entire table found here under \"aes$Te\"\r\n\r\nhttps://2ton.com.au/library_as_html/aes.inc.html\r\n\r\nIs it possible to incorporate this aes TD/TE tables in attempting to extract the keys? I believe that's why it may not be able to detect it.\r\n\r\nI've been trying to gather as much information as I could about this table, and based on this link, it seems to be an \"8 byte aligned 2048 table\":\r\nhttps://cr.yp.to/mac/aes_big_constants.c\r\n\r\nWould appreciate it if someone could guide me to the right direction, and could assist in what I may need to implement to support reading this table? Or if someone already have implemented this feature in their copy, if they could contribute it to this project?\r\n\r\nRegards,\r\nZirak"},"comment":{"url":"https://api.github.com/repos/mmozeiko/aes-finder/issues/comments/447596102","html_url":"https://github.com/mmozeiko/aes-finder/issues/14#issuecomment-447596102","issue_url":"https://api.github.com/repos/mmozeiko/aes-finder/issues/14","id":447596102,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NzU5NjEwMg==","user":{"login":"ZirakC","id":10685608,"node_id":"MDQ6VXNlcjEwNjg1NjA4","avatar_url":"https://avatars3.githubusercontent.com/u/10685608?v=4","gravatar_id":"","url":"https://api.github.com/users/ZirakC","html_url":"https://github.com/ZirakC","followers_url":"https://api.github.com/users/ZirakC/followers","following_url":"https://api.github.com/users/ZirakC/following{/other_user}","gists_url":"https://api.github.com/users/ZirakC/gists{/gist_id}","starred_url":"https://api.github.com/users/ZirakC/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ZirakC/subscriptions","organizations_url":"https://api.github.com/users/ZirakC/orgs","repos_url":"https://api.github.com/users/ZirakC/repos","events_url":"https://api.github.com/users/ZirakC/events{/privacy}","received_events_url":"https://api.github.com/users/ZirakC/received_events","type":"User","site_admin":false},"created_at":"2018-12-15T20:35:00Z","updated_at":"2018-12-15T20:35:00Z","author_association":"NONE","body":"Thinking outside the box now, what if I have the encrypted data, could I simply scan throughout the memory and for each 32 bytes I read, I pass it on to an AES Decryption function with the encrypted data, and see which set of 32 bytes decrypts to plaintext successfully? The only question in that case would be how to get the IV key.."}}
{"actor":{"display_login":"ZirakC"}}