{"id":51595154,"url":"https://github.com/securityronin/dpapi-forensic","last_synced_at":"2026-07-11T18:01:36.442Z","repository":{"id":367020606,"uuid":"1278798327","full_name":"SecurityRonin/dpapi-forensic","owner":"SecurityRonin","description":"Forensic DPAPI toolkit — parse + decrypt DPAPI blobs, unwrap Chrome/Edge v10/v20 cookies (dpapi-core); on-disk credential auditor (WIP)","archived":false,"fork":false,"pushed_at":"2026-06-24T07:30:37.000Z","size":47,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-24T10:17:20.834Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-24T05:32:55.000Z","updated_at":"2026-06-24T07:30:43.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/dpapi-forensic","commit_stats":null,"previous_names":["securityronin/dpapi-forensic"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/dpapi-forensic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdpapi-forensic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdpapi-forensic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdpapi-forensic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdpapi-forensic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/dpapi-forensic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdpapi-forensic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35370428,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-11T18:01:34.944Z","updated_at":"2026-07-11T18:01:36.432Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"# dpapi-forensic\n\n[![Crates.io](https://img.shields.io/crates/v/dpapi-core.svg)](https://crates.io/crates/dpapi-core)\n[![Docs.rs](https://docs.rs/dpapi-core/badge.svg)](https://docs.rs/dpapi-core)\n[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n[![CI](https://github.com/SecurityRonin/dpapi-forensic/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/dpapi-forensic/actions/workflows/ci.yml)\n[![Sponsor](https://img.shields.io/badge/sponsor-%E2%9D%A4-db61a2.svg)](https://github.com/sponsors/h4x0r)\n\n**Parse and decrypt Windows DPAPI from raw bytes — `DPAPI_BLOB`, AES/3DES blob decryption given a master key, and Chrome/Edge `v10`/`v20` cookie unwrap — with audited crypto and zero I/O.**\n\nDPAPI is one of the largest Windows credential-protection surfaces: Chrome/Edge\nsaved passwords and the cookie key, Credential Manager, Vault, Wi-Fi keys, and\nthe master-key files themselves. The blob format and the decrypt-given-key\ncrypto are identical on disk and in live memory — so `dpapi-core` is a pure\n`\u0026[u8]`-in library that both a memory tool and a disk tool can share.\n\n## Quick start\n\n```toml\n[dependencies]\ndpapi-core = \"0.1\"\n```\n\n```rust\nuse dpapi_core::{parse_dpapi_blob, decrypt_dpapi_blob};\n\n// `master_key` comes from your key source (LSASS cache in memory, or a\n// master-key file + password derivation on disk).\nlet blob = parse_dpapi_blob(raw_blob_bytes)?;\nlet plaintext = decrypt_dpapi_blob(\u0026blob, master_key)?;\n# Ok::\u003c(), dpapi_core::DpapiError\u003e(())\n```\n\nChrome/Edge cookies (`Local State` key already recovered):\n\n```rust\nuse dpapi_core::{detect_chrome_cookie_encoding, decrypt_v10_cookie, ChromeCookieEncoding};\n\nif let ChromeCookieEncoding::V10 { nonce, ciphertext } =\n    detect_chrome_cookie_encoding(encrypted_value)\n{\n    let cookie = decrypt_v10_cookie(\u0026nonce, \u0026ciphertext, \u0026aes_key)?;\n}\n# Ok::\u003c(), dpapi_core::DpapiError\u003e(())\n```\n\n## What it does\n\n`dpapi-core` (the library) is byte-oriented and performs no I/O:\n\n- **`parse_dpapi_blob(\u0026[u8])`** — decode the `DPAPI_BLOB` wire format: version,\n  master-key GUID, description, algorithm IDs, HMAC key, ciphertext, and HMAC.\n- **`decrypt_dpapi_blob(blob, master_key)`** — derive the session key\n  (HMAC-SHA1) and decrypt with AES-256-CBC or 3DES-CBC.\n- **`detect_chrome_cookie_encoding` / `decrypt_v10_cookie`** — classify a\n  Chrome/Edge `encrypted_value` (`v10`/`v20`/classic-DPAPI/raw) and unwrap the\n  AES-256-GCM variants.\n\nAll cryptography uses audited [RustCrypto](https://github.com/RustCrypto) crates\n(`aes`, `aes-gcm`, `cbc`, `des`, `hmac`, `sha1`, `sha2`). No primitive is\nhand-rolled. A bad key, IV length, or HMAC surfaces as a typed `DpapiError` —\nthe library never fabricates plausible-but-wrong plaintext.\n\n## Status\n\nStep 1 (this release) ships the byte-oriented `dpapi-core` primitives, validated\nby the unit tests carried over from `memory-forensic`. The `dpapi-forensic`\ncrate is a stub that re-exports `dpapi-core` and documents the roadmap.\n\nStep 2 (planned):\n\n- **`masterkey.rs`** in `dpapi-core` — parse master-key files\n  (`%APPDATA%\\Microsoft\\Protect\\\u003cSID\u003e\\\u003cGUID\u003e`) and derive the key-protection key\n  from the user password (SHA1 → PBKDF2-HMAC) or the domain backup key.\n- **`dpapi-forensic`** auditor — enumerate and decrypt Chrome/Edge passwords +\n  cookie key, Credential Manager, Vault, and Wi-Fi keys on an acquired\n  filesystem, emitting graded `forensicnomicon` findings.\n- **`dpapi4n6`** CLI per the fleet `*4n6` pattern, plus a tag-driven release\n  workflow.\n\n---\n\n[Privacy Policy](https://securityronin.github.io/dpapi-forensic/privacy/) · [Terms of Service](https://securityronin.github.io/dpapi-forensic/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fdpapi-forensic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Fdpapi-forensic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fdpapi-forensic/lists"}