I've created a C# program that encrypts and decrypts a file. The encryption method is DES. The program is exactly the same as in the following link, except that the part that removes the key from memory has been commented out:

How to encrypt and decrypt a file by using Visual C#

My question is, after running the program and creating a memory dump, how do I identify the encryption key using winhex? All I can see are random bytes of data. Is just finding the variable name "sSecretKey" considered finding the key?

  • 1
    You realize, of course, that DES is badly insecure, and that guide appears to be about 15 years old. (3DES has a larger key size and is still secure, though AES is a much better option for other reasons.) Mar 18, 2014 at 16:45

1 Answer 1


Without any knowledge this is a difficult task but not impossible. A DES key is random data with high entropy. Finding the key is something like trial and error. You are looking for random data in the memory dump and then you try to decrypt a ciphertext which you previously have been encrypted by using this data as the DES key.

This is a difficult task. I would suggest that you use a debugger. Set a break point right after the DES key has been assigned to sSecretKey. If the debugger stops the execution of the program at this point the DES key has been assigned to the variable and you can read it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .