{"id":13645929,"url":"https://github.com/aguinet/wannakey","last_synced_at":"2025-04-13T07:50:56.522Z","repository":{"id":38325224,"uuid":"91701793","full_name":"aguinet/wannakey","owner":"aguinet","description":"Wannacry in-memory key recovery","archived":false,"fork":false,"pushed_at":"2017-06-03T10:39:37.000Z","size":2033,"stargazers_count":1060,"open_issues_count":2,"forks_count":150,"subscribers_count":72,"default_branch":"master","last_synced_at":"2024-10-20T08:37:10.907Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aguinet.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-05-18T14:15:46.000Z","updated_at":"2024-10-18T01:08:32.000Z","dependencies_parsed_at":"2022-08-25T02:00:12.889Z","dependency_job_id":null,"html_url":"https://github.com/aguinet/wannakey","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aguinet%2Fwannakey","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aguinet%2Fwannakey/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aguinet%2Fwannakey/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aguinet%2Fwannakey/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aguinet","download_url":"https://codeload.github.com/aguinet/wannakey/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248681494,"owners_count":21144700,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T01:02:45.290Z","updated_at":"2025-04-13T07:50:56.497Z","avatar_url":"https://github.com/aguinet.png","language":"C++","funding_links":[],"categories":["C++","C++ (225)"],"sub_categories":[],"readme":"Wannakey\n========\n\nWARNING\n=======\n\nThis software has only been tested and known to work under Windows XP, 7 x86,\n2003, Vista and Windows Server 2008 (tests by @msuiche).\n\nPlease also note that you need some luck for this to work (see below), and so\nit might not work in every case!\n\nDISCLAMER\n=========\n\n- This code is and will always be GPLv3. See LICENSE file attached.\n\nUpdates\n=======\n\nv2.1\n----\n\n* optimization of the prime search process (see https://github.com/aguinet/wannakey/issues/2).\n* OpenMP version that uses as many core as available to speed-up the process\n* tool that finds whether wannakey's technique has chances to work on a running Windows OS\n\nv2.0\n----\n\n* automatically find the encryption process PID\n* write the private key so that the original malware's process can decrypt the files (using the Decrypt button)\n* code refactoring and cmake usage\n\nv0.2\n----\n\n* The generated private RSA key had invalid computed fields, which made the key\n  not importable with CryptImportKey under Windows XP (fixed). wanafork and/or wanadecrypt can\n  now be used directly from XP.\n\n* Updated the binary with this fix and a static build (no need for the MSVC\n  runtime anymore)\n\nv0.1\n----\n\n* Original version\n\nIntroduction\n============\n\nThis software allows to recover the prime numbers of the RSA private key that are used by Wanacry.\n\nIt does so by searching for them in the ``wcry.exe`` process. This is the\nprocess that generates the RSA private key. The main issue is that the\n``CryptDestroyKey`` and ``CryptReleaseContext`` does not erase the prime\nnumbers from memory before freeing the associated memory.\n\nThis is not really a mistake from the ransomware authors, as they properly use\nthe Windows Crypto API. Indeed, for what I've tested, under Windows 10,\n``CryptReleaseContext`` does cleanup the memory (and so this recovery technique\nwon't work). It can work under Windows XP because, in this version,\n``CryptReleaseContext`` does not do the cleanup. Moreover, MSDN states this,\nfor this function : \"After this function is called, the released CSP handle is\nno longer valid. This function does not destroy key containers or key pairs.\".\nSo, it seems that there are no clean and cross-platform ways under Windows to\nclean this memory.\n\nIf you are lucky (that is the associated memory hasn't been reallocated and\nerased), these prime numbers might still be in memory.\n\nThat's what this software tries to achieve.\n\nUsage\n=====\n\nYou can use the binary ``wannakey.exe`` in the bin/ folder. It will locate the\nencryption PID by itself. If it can't, you might need to search it by hand and\npass it as an argument of the ``wannakey.exe`` tool.\n\nIf you have multiple cores, you can use the ``wannakey_omp.exe`` binary. If you\ndon't have the ``vcomp140.dll`` on your system, you can copy alongside\n``wannakey_omp.exe`` the version that is present in the ``bin`` directory\n(extracted from the MSVC 2015 C++ runtime). Unfortunately, it doesn't seem\nstraightforward to statically link with this library. \n\nIf the key had been succeesfully generated, you will just need to use the\n\"Decrypt\" button of the malware to decrypt your files!\n\nWindows Crytp API leak check\n============================\n\nA tool named \"winapi_check\" (see the bin/ directory) checks whether the Windows\nCrypto API remove the private key's primes from memory or not. This allows to\nverify if wannakey has a small chance or not to work.\n\nPlease note that, even if this tool says wannakey stands a chance, it doesn't mean\nit will work!\n\nIf you have tried this tool, please report the results here: https://github.com/aguinet/wannakey/issues/5.\n\nCompile from source\n===================\n\nYou need at least Visual Studio 2015 express and CMake.\n\nLaunch a VS2015 Native Tools command line prompt and run:\n\n.. code::\n\n  \u003e cd /path/to/wannakey/wannakey/\n  \u003e mkdir build\n  \u003e cd build\n  \u003e cmake -G \"Visual Studio 14 2015\" -T \"v140_xp\" ..\n  \u003e cmake --build . --config \"release\"\n\nBinary will be in the src/Release directory.\n\nCredits\n=======\n\n* @wiskitki who spotted the ``CryptReleaseContext`` issue with Windows 10 (which actually wipe the primes in memory).\n* @hackerfantastic for releasing the sample I used\n* Miasm (https://github.com/cea-sec/miasm) for its help extracting the DLL and reversing the whole thing\n* Wine sources for the Windows RSA private key format.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faguinet%2Fwannakey","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faguinet%2Fwannakey","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faguinet%2Fwannakey/lists"}