I've created a C# program that encrypts and decrypts a file. The encryption method is DES. The program is exactly the same as in the following link, except that the part that removes the key from memory has been commented out:

How to encrypt and decrypt a file by using Visual C#

My question is, after running the program and creating a memory dump, how do I identify the encryption key using winhex? All I can see are random bytes of data. Is just finding the variable name "sSecretKey" considered finding the key?

  • 1
    You realize, of course, that DES is badly insecure, and that guide appears to be about 15 years old. (3DES has a larger key size and is still secure, though AES is a much better option for other reasons.) – Matt Nordhoff Mar 18 '14 at 16:45

Without any knowledge this is a difficult task but not impossible. A DES key is random data with high entropy. Finding the key is something like trial and error. You are looking for random data in the memory dump and then you try to decrypt a ciphertext which you previously have been encrypted by using this data as the DES key.

This is a difficult task. I would suggest that you use a debugger. Set a break point right after the DES key has been assigned to sSecretKey. If the debugger stops the execution of the program at this point the DES key has been assigned to the variable and you can read it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.