{"id":15912921,"url":"https://github.com/tintinweb/pymemscrape","last_synced_at":"2025-08-25T00:46:35.790Z","repository":{"id":150245411,"uuid":"46885269","full_name":"tintinweb/pymemscrape","owner":"tintinweb","description":"A python-ctypes based process memory scraper that attempts to find key-material by matching template C structs in memory (OpenSSL ssl_session_st, dsa_st, rsa_st, bignum_st, ec_key_st, dh_st and generic ASN.1)","archived":false,"fork":false,"pushed_at":"2015-11-25T21:42:53.000Z","size":29,"stargazers_count":4,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-03T03:15:48.706Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tintinweb.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-11-25T20:37:58.000Z","updated_at":"2023-10-24T01:37:22.000Z","dependencies_parsed_at":"2023-04-14T05:31:55.895Z","dependency_job_id":null,"html_url":"https://github.com/tintinweb/pymemscrape","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tintinweb/pymemscrape","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tintinweb%2Fpymemscrape","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tintinweb%2Fpymemscrape/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tintinweb%2Fpymemscrape/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tintinweb%2Fpymemscrape/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tintinweb","download_url":"https://codeload.github.com/tintinweb/pymemscrape/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tintinweb%2Fpymemscrape/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":268192592,"owners_count":24210541,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-01T02:00:08.611Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-06T16:21:48.502Z","updated_at":"2025-08-01T08:34:17.403Z","avatar_url":"https://github.com/tintinweb.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# pymemscrape\nA python-ctypes based process memory scraper that attempts to find key-material by matching template C structs in memory\n\nThis is just a python PoC. There is lots of space for improvement :)\n\n# Templates\n\n* OpenSSL ssl_session_st - SSL/TLS session struct containing the master_secret (decrypt communication for any cipherspec)\n* OpenSSL rsa_st, dsa_st - RSA and DSA key material (OpenSSH)\n* OpenSSL ec_key_st - Elliptic Curve key material\n* OpenSSL bignum_st - bignum struct matching\n* Generic ASN.1 - generic ASN.1 matching (Certificates, PubKey, PrivKey and other ASN.1 encoded objects)\n\n# Example\n\nExtract master_key, session_id from openssl s_client TLS1.0 session with ECDHE-RSA-AES256-SHA.\n\nStart the server:\n\n\t#\u003e openssl s_server \u0026\n\t[1] 16462\n\t\ninitiate s_client connection for any ECDH cipher:\n\n\t#\u003e # openssl s_client -connect localhost:4433 -tls1 -cipher ECDH\n\tCONNECTED(00000003)\n\t-----BEGIN SSL SESSION PARAMETERS-----\n\tMFoCAQECAgMBBALAFAQABDDy/bMXYX54SMKJf2VXblrBfnauG1U+C/giUOSlKYj6\n\t66moOC1548UkL9asG6ulcDqhBgIEVlYqAKIEAgIBLKQGBAQBAAAAqwMEAQE=\n\t-----END SSL SESSION PARAMETERS-----\n\tShared ciphers:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AECDH-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AECDH-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:AECDH-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AECDH-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDHE-RSA-NULL-SHA:ECDHE-ECDSA-NULL-SHA:AECDH-NULL-SHA:ECDH-RSA-NULL-SHA:ECDH-ECDSA-NULL-SHA\n\tCIPHER is ECDHE-RSA-AES256-SHA\n\tSecure Renegotiation IS supported\n\t---\n\tCertificate chain\n\t 0 s:/C=AU/ST=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server\n\t   i:/C=AU/ST=QLD/CN=SSLeay/rsa test CA\n\t---\n\tServer certificate\n\t-----BEGIN CERTIFICATE-----\n\tMIIBgjCCASwCAQQwDQYJKoZIhvcNAQEEBQAwODELMAkGA1UEBhMCQVUxDDAKBgNV\n\tBAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3JzYSB0ZXN0IENBMB4XDTk1MTAwOTIz\n\tMzIwNVoXDTk4MDcwNTIzMzIwNVowYDELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FM\n\tRDEZMBcGA1UEChMQTWluY29tIFB0eS4gTHRkLjELMAkGA1UECxMCQ1MxGzAZBgNV\n\tBAMTElNTTGVheSBkZW1vIHNlcnZlcjBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQC3\n\tLCXcScWua0PFLkHBLm2VejqpA1F4RQ8q0VjRiPafjx/Z/aWH3ipdMVvuJGa/wFXb\n\t/nDFLDlfWp+oCPwhBtVPAgMBAAEwDQYJKoZIhvcNAQEEBQADQQArNFsihWIjBzb0\n\tDCsU0BvL2bvSwJrPEqFlkDq3F4M6EGutL9axEcANWgbbEdAvNJD1dmEmoWny27Pn\n\tIMs6ZOZB\n\t-----END CERTIFICATE-----\n\tsubject=/C=AU/ST=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server\n\tissuer=/C=AU/ST=QLD/CN=SSLeay/rsa test CA\n\t---\n\tNo client certificate CA names sent\n\t---\n\tSSL handshake has read 863 bytes and written 310 bytes\n\t---\n\tNew, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA\n\tServer public key is 512 bit\n\tSecure Renegotiation IS supported\n\tCompression: zlib compression\n\tExpansion: zlib compression\n\tSSL-Session:\n\t    Protocol  : TLSv1\n\t    Cipher    : ECDHE-RSA-AES256-SHA\n\t    Session-ID: 4D7A7A527FB54F82B4D1687368DE234EDEB8F71A8EF33B64E6FBB58E4F751BC9\n\t    Session-ID-ctx:\n\t    Master-Key: F2FDB317617E7848C2897F65576E5AC17E76AE1B553E0BF82250E4A52988FAEBA9A8382D79E3C5242FD6AC1BABA5703A\n\t    Key-Arg   : None\n\t    PSK identity: None\n\t    PSK identity hint: None\n\t    SRP username: None\n\t    TLS session ticket lifetime hint: 300 (seconds)\n\t    TLS session ticket:\n\t    0000 - 8c 52 eb 9a da c6 78 ee-4e 1f 4f 3e 48 0f 32 0e   .R....x.N.O\u003eH.2.\n\t    0010 - c2 f0 f3 1a a7 5b 6b f6-e4 f2 64 b5 33 c9 5d 31   .....[k...d.3.]1\n\t    0020 - 53 5b 00 f8 ef 92 9a 84-c8 65 43 48 9b 83 f8 29   S[.......eCH...)\n\t    0030 - 84 37 8e 36 67 b8 32 13-b3 f7 15 62 fa 81 b2 61   .7.6g.2....b...a\n\t    0040 - 31 6b 3f ba 6d 46 ba a7-7b 82 a3 e2 63 71 b4 ae   1k?.mF..{...cq..\n\t    0050 - ef 9b fd 8c cc 08 00 8f-1c e6 df 08 39 26 91 6c   ............9\u0026.l\n\t    0060 - 9d 03 aa 9f 6e 8f d7 da-03 34 04 d3 e6 ea 3d 3c   ....n....4....=\u003c\n\t    0070 - ab e8 c1 62 86 af 1f 8d-ee e1 48 2d 69 ac d2 b1   ...b......H-i...\n\t    0080 - 17 dd ab 1a 72 8f 42 7d-54 25 5a 1c c4 dd b2 88   ....r.B}T%Z.....\n\t    0090 - 24 17 8c ae 86 47 bc 6e-f6 63 47 d8 9c 42 9e 3c   $....G.n.cG..B.\u003c\n\t\n\t    Compression: 1 (zlib compression)\n\t    Start Time: 1448487424\n\t    Timeout   : 7200 (sec)\n\t    Verify return code: 21 (unable to verify the first certificate)\n\t---\n\t\nscrape the memory for the ssl session struct:\n\n\t#\u003e for p in $(pgrep openssl); do python memscrape.py $p; done \n\t\u003cLinuxMemRegion size=880640 start=164278272 end=165158912 permissions=rw-p name=[heap]\n\t09cab000-09d82000 rw-p 00000000 00:00 0          [heap]\n\t[heap]\n\t0x0\n\t0x2000\n\t0x4000\n\t0x6000\n\t0x8000\n\t0xa000\n\t0xc000\n\t0xe000\n\t0x10000\n\t0x12000\n\t0x14000\n\t0x16000\n\t0x18000\n\t0x1a000\n\t0x1c000\n\t0x1e000\n\t0x20000\n\t0x22000\n\t0x24000\n\t0x26000\n\t0x28000\n\tstruct ssl_session_st {\n\t    long            version = 769\n\t    ulong           key_arg_length = 0L\n\t    char_Array_8    key_arg = ''\n\t    long            master_key_length = 48\n\t    char_Array_48   master_key = '\\xf2\\xfd\\xb3\\x17a~xH\\xc2\\x89\\x7feWnZ\\xc1~v\\xae\\x1bU\u003e\\x0b\\xf8\"P\\xe4\\xa5)\\x88\\xfa\\xeb\\xa9\\xa88-y\\xe3\\xc5$/\\xd6\\xac\\x1b\\xab\\xa5p:'\n\t    long            session_id_length = 32\n\t    char_Array_32   session_id = 'MzzR\\x7f\\xb5O\\x82\\xb4\\xd1hsh\\xde#N\\xde\\xb8\\xf7\\x1a\\x8e\\xf3;d\\xe6\\xfb\\xb5\\x8eOu\\x1b\\xc9'\n\t    long            sid_ctx_length = 0\n\t    char_Array_32   sid_ctx = ''\n\t    long            not_resumable = 0\n\t    void*           sess_cert = None\n\t    void*           peer = None\n\t    long            verify_result = 164453248\n\t    long            references = 164450800\n\t    long            timeout = 21\n\t    long            time = 1\n\t    long            compress_meth = 7200\n\t    void*           cipher = '0x56562a00'\n\t    ulong           cipher_id = 1L\n\t    void*           ciphers = '0xb7758ba0L'\n\t}\n\t--\u003e valid struct_ssl_session struct!\n\nmaster_key matches output of s_client, version matches 0x0301==769==TLS_1_0.\n\t\t\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftintinweb%2Fpymemscrape","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftintinweb%2Fpymemscrape","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftintinweb%2Fpymemscrape/lists"}