https://github.com/deltatecs/voses
Volatile Secret Searcher - massively parallel, brute force memory dump analysis for (D)TLS secret extraction
https://github.com/deltatecs/voses
cuda memory-hacking reverse-engineering tls
Last synced: 7 months ago
JSON representation
Volatile Secret Searcher - massively parallel, brute force memory dump analysis for (D)TLS secret extraction
- Host: GitHub
- URL: https://github.com/deltatecs/voses
- Owner: DeltaTecs
- License: gpl-3.0
- Created: 2025-03-04T22:58:21.000Z (10 months ago)
- Default Branch: main
- Last Pushed: 2025-03-28T16:50:56.000Z (10 months ago)
- Last Synced: 2025-03-28T17:45:36.270Z (10 months ago)
- Topics: cuda, memory-hacking, reverse-engineering, tls
- Language: Cuda
- Homepage:
- Size: 126 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# VoSeS
Volatile Secret Searcher - massively parallel, brute force memory dump analysis for (D)TLS 1.2 secret extraction
You have:
- A wireshark capture file of application traffic
- A memory dump of the machine that was made while the application ran
and you want to decrypt the application traffic?
Then this tool works for you. Requirements:
- CUDA capable device * happy jensen noises *
- the traffic must be encrypted with tls 1.2 or dtls 1.2
- this tool supports only GCM_AES_128_SHA_256 and GCM_AES_256_SHA_384 encryption
Compile on windows:
1. `mkdir build`
2. `cd build`
3. `cmake ..`
4. `cmake --build .`
Run:
```
voses.exe
--client_random|-cr <32-byte hex>
--server_random|-sr <32-byte hex>
--client_finished|-cf
--algorithm|-a
--haystack|-h (memory dump file path)
[--entropy|-e ]
[--entropy-scan|-es]
```
set entropy to a different filter value if you like. scan will show you how many 48 byte locations match your filter.
When a master secret matching your randoms and cipher text is found it will be printed in a format that can be read by wireshark as a master secret log file.
This tool uses a custom cuda port based on the AES implementation of https://github.com/kokke/tiny-AES-c