A method and system for offline extraction of DPAPI keys based on memory image

Abstract

Disclosed is a method and system for extracting DPAPI keys offline based on memory images, including loading memory images, obtaining system version information from the memory images, extracting the minidump of the lsass.exe process; performing Search Sign Apply Offset operations in the lsasrv.dll memory range with different offsets of the flag bits of the Logon Session Sign table corresponding to the system version to obtain the Logon Session List and the Logon Session Count; obtaining the Cache Master Key corresponding to each Logon Session with the Cached Master Key structure in the corresponding dynamic link library memory range according to different system versions; performing Search Sign Apply Offset operations in the lsasrv.dll memory range with different offsets of the flag bits of the Decrypt Key Sign table corresponding to the system version to obtain the 16-byte IV and Key3DES, performing Search Sign Apply Offset operations on Key3DES to obtain Key AES; and decrypting the Cache Master Key, Key3DES, Key AES and IV to obtain the Master Key corresponding to each Logon Session. The present invention has the characteristics of free-password acquisition, good applicability and high success rate.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption or decryption, and in particular to a method and system for extracting a DPAPI key offline based on a memory image. Background Art

[0002] DPAPI (Data Protection Application Programming Interface) is a data protection interface component developed by Microsoft. It is built into the Microsoft Windows operating system of Windows 2000 and later, and provides data protection services for applications and operating systems. The notable feature of this group of interfaces is that encryption and decryption operations must be performed on the same computer, and the operating system completes the generation, storage and use of keys, without the user having to worry about key storage and protection. Due to the high market share of Microsoft Windows operating system and the simple use of DPAPI external interface, DPAPI has a wide range of applications, such as remote desktop passwords, FTP account passwords, wireless Internet passwords, EFS private key encryption, some email account passwords, common browsers' automatic Internet forms, and many other applications and functions. Therefore, parsing DPAPI encrypted data is of great significance in the electronic forensics industry.

[0003] In the Windows operating system, there are two types of DPAPI encrypted data, DPAPI encrypted data in the user storage area and DPAPI encrypted data in the system storage area. The DPAPI encrypted data in the user storage area is encrypted using a key derived from the user's password, and the DPAPI encrypted data in the system storage area is encrypted using a key derived from a set of data in the registry.

[0004] At present, most forensic software uses an on-site online method to parse DPAPI encrypted data, that is, by directly starting or dynamically simulating the operating system where the data source is located, logging in to the corresponding account, and installing and starting the forensic software. The forensic software internally calls the CryptUnprotectData function to decrypt the DPAPI encrypted data block, and finally displays the result on the interface. This method is easy to pollute the data source during operation, destroy the read-only nature of the evidence, and is directly dependent on the target source operating system. If the system is damaged and cannot be started, the data cannot be decrypted.

[0005] In addition, although the decryption of DPAPI encrypted data in the user storage area in the prior art can parse the encrypted data at the user account level, it is necessary to know the SID and plain text password corresponding to the user login account in advance, otherwise it cannot be decrypted. There is also an offline analysis solution for decrypting DPAPI encrypted data in the system storage area, that is, the local system level, but this solution can only obtain the DPAPI key of the system storage area, and cannot obtain the DPAPI key of the user storage area. Summary of the invention

[0006] In order to solve the technical problems of the prior art such as difficulty in extracting and decrypting DPAPI encrypted data, the present invention proposes a method and system for offline extraction of DPAPI keys based on memory mirroring to solve the above technical problems.

[0007] According to one aspect of the present invention, a method for offline extraction of DPAPI keys based on a memory image is proposed, comprising:

[0008] S1: Load the memory image, obtain the system version information from the memory image, and extract the minidump of the lsass.exe process;

[0009] S2: Perform Search Sign Apply Offset operation in the memory range of lsasrv.dll with different offsets of the flag bits of the Logon Session Sign table of the corresponding system version to obtain Logon Session List and LogonSession Count;

[0010] S3: Obtain the Cache Master Key corresponding to each Logon Session in the corresponding dynamic link library memory range using the Cached Master Key structure according to different system versions;

[0011] S4: Perform Search Sign Apply Offset operation on the memory range of lsasrv.dll at different offsets of the flag bit of the Decrypt Key Sign table of the corresponding system version to obtain the 16-byte IV and Key3DES, and perform Search Sign Apply Offset operation on Key3DES to obtain Key AES;

[0012] S5: Decrypt the Cache Master Key, Key3DES, Key AES and IV to obtain the Master Key corresponding to each Logon Session.

[0013] In some specific embodiments, the Search Sign Apply Offset operation is specifically as follows: search the flag bit, obtain a position Sign Base, offset Sign Offset bytes, read a 4-byte unsigned long integer in little-endian format and record it as Offset, and the result is Sign Base+Sign Offset+4+Offset.

[0014] In some specific embodiments, a flag bit of a system version in the Logon Session Sign table corresponds to two offset information, offset 0 and offset 1.

[0015] In some specific embodiments, step S2 specifically includes:

[0016] In the memory range of lsasrv.dll, use the flag bit of the Logon Session Sign table corresponding to the system version and offset 0 as the Sign Offset to perform the Search Sign Apply Offset operation, obtain the Logon Session AddressList, and then obtain the information of the login session list Logon Session List according to the Logon Session structure;

[0017] In the memory range of lsasrv.dll, use the flag bit of the Logon Session Sign table corresponding to the system version and offset 1 as the Sign Offset to perform the Search Sign Apply Offset operation and obtain the Logon Session Count.

[0018] In some specific embodiments, a flag bit of a system version in the Decrypt Key Sign table corresponds to three offset information of offset 0, offset 1 and offset 2.

[0019] In some specific embodiments, step S4 specifically includes:

[0020] In the memory range of lsasrv.dll, use the offset 0 in the flag bit of the Decrypt Key Sign table as the SignOffset to perform the Search Sign Apply Offset operation to obtain a 16-byte IV.

[0021] In the memory range of lsasrv.dll, use the offset 1 in the flag bit of the Decrypt Key Sign table as the SignOffset to perform the Search Sign Apply Offset operation to obtain the Decrypt HandleAddress in the Decrypt Key structure, and then read the Decrypt Key structure to obtain a key Key3DES;

[0022] Replace Sign Offset with offset 2 corresponding to the Decrypt Key Sign table, repeat the Search SignApply Offset operation, and obtain Key AES.

[0023] According to a second aspect of the present invention, a computer-readable storage medium is provided, on which one or more computer programs are stored. When the one or more computer programs are executed by a computer processor, any of the above methods is implemented.

[0024] According to a third aspect of the present invention, a system for offline extraction of DPAPI keys based on memory image is proposed, the system comprising:

[0025] A memory image loading unit, configured to load the memory image, obtain system version information from the memory image, and extract a minidump of the lsass.exe process;

[0026] Cache Master Key acquisition unit: configured to acquire the Cache Master Key corresponding to each Logon Session in the corresponding dynamic link library memory range according to different system versions using the Cached Master Key structure;

[0027] Offset processing unit: configured to perform Search Sign Apply Offset operation in the lsasrv.dll memory range at different offsets of the flag bit of the LogonSession Sign table corresponding to the system version to obtain LogonSession List and Logon Session Count; perform Search Sign Apply Offset operation in the lsasrv.dll memory range at different offsets of the flag bit of the Decrypt Key Sign table corresponding to the system version to obtain 16-byte IV and Key3DES, and perform Search Sign Apply Offset operation on Key3DES to obtain Key AES;

[0028] Decryption unit: configured to obtain the Master Key corresponding to each Logon Session according to the Cache Master Key, Key3DES, Key AES and IV decryption.

[0029] In some specific embodiments, the Search Sign Apply Offset operation is specifically as follows: search the flag bit, obtain a position Sign Base, offset Sign Offset bytes, read a 4-byte unsigned long integer in little-endian format and record it as Offset, and the result is Sign Base+Sign Offset+4+Offset.

[0030] In some specific embodiments, a flag bit of a system version in the Logon Session Sign table corresponds to two offset information, offset 0 and offset 1.

[0031] In some specific embodiments, the offset processing unit specifically includes:

[0032] In the memory range of lsasrv.dll, use the flag bit of the Logon Session Sign table corresponding to the system version and offset 0 as the Sign Offset to perform the Search Sign Apply Offset operation, obtain the Logon Session AddressList, and then obtain the information of the login session list Logon Session List according to the Logon Session structure;

[0033] In the memory range of lsasrv.dll, use the flag bit of the Logon Session Sign table corresponding to the system version and offset 1 as the Sign Offset to perform the Search Sign Apply Offset operation and obtain the Logon Session Count.

[0034] In some specific embodiments, a flag bit of a system version in the Decrypt Key Sign table corresponds to three offset information of offset 0, offset 1 and offset 2.

[0035] In some specific embodiments, the offset processing unit specifically includes:

[0036] In the memory range of lsasrv.dll, use the offset 0 in the flag bit of the Decrypt Key Sign table as the SignOffset to perform the Search Sign Apply Offset operation to obtain a 16-byte IV.

[0037] In the memory range of lsasrv.dll, use the offset 1 in the flag bit of the Decrypt Key Sign table as the SignOffset to perform the Search Sign Apply Offset operation to obtain the Decrypt HandleAddress in the Decrypt Key structure, and then read the Decrypt Key structure to obtain a key Key3DES;

[0038] Replace Sign Offset with offset 2 corresponding to the Decrypt Key Sign table, repeat the Search SignApply Offset operation, and obtain Key AES.

[0039] The present invention proposes a method and system for extracting DPAPI keys offline based on memory images. The method and system can extract and decrypt the keys of encrypted data in the DPAPI system storage area and the user storage area without relying on the operating system where the target data source is located and without knowing the user name and password of the computer, and also meet the requirements of read-only operation and cross-platform decryption of the evidence source. By loading the memory image, the DPAPI key field is obtained, and then the method of decrypting the DPAPI Blob is called to obtain the plaintext of the DPAPI encrypted data, so as to improve the efficiency of evidence collection. Only the memory image and the hard disk image need to be made on site, and they can be processed in the laboratory later to reduce the pressure of on-site inspection. And it can be used to extract the DPAPI keys in the memory image, avoiding the possible loss of key DPAPI keys in traditional methods, resulting in the inability to decrypt important encrypted data. It can parse a database of chromium password storage, Outlook encrypted database, remote desktop password, FTP account password, Outlook account password, IE and Chrome browser automatic online forms, wireless Internet password, EFS private key encryption, MSN Messenger password and other data encrypted by DPAPI. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and together with the description are used to explain the principles of the present invention. Other embodiments and many expected advantages of the embodiments will be readily appreciated as they become better understood by reference to the following detailed description. Other features, objects and advantages of the present application will become more apparent by reading the detailed description of the non-limiting embodiments made with reference to the following drawings:

[0041] Figure 1 It is a flowchart of a method for offline extraction of DPAPI keys based on memory image according to an embodiment of the present application;

[0042] Figure 2 This is a Logon Session structure diagram of a specific embodiment of the present application;

[0043] Figure 3 is a Cached Master Key structure diagram of a specific embodiment of the present application;

[0044] Figure 4 is a Decrypt Key structure diagram of a specific embodiment of the present application;

[0045] Figure 5 is a flowchart of a method for extracting a DPAPI key according to a specific embodiment of the present application;

[0046] Figure 6 This is a system framework diagram for offline extraction of DPAPI keys based on memory image in one embodiment of the present application;

[0047] Figure 7 It is a schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application;

[0048] Figure 8 It is a rendering of a method for extracting DPAPI keys according to a specific embodiment of the present application. DETAILED DESCRIPTION

[0049] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0050] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0051] According to a method for offline extraction of DPAPI keys based on memory image in one embodiment of the present application, Figure 1 FIG. 1 shows a flow chart of a method for offline extraction of DPAPI keys based on a memory image according to an embodiment of the present application. Figure 1 As shown, the method includes:

[0052] S101: Load the memory image, obtain system version information from the memory image, and extract the minidump of the lsass.exe process. Minidump is a small dump file of an application, which is a subset of a fault dump file. Extracting the minidump of the lsass.exe process can be used to increase speed and improve efficiency.

[0053] S102: Performing Search Sign Apply Offset operations in the memory range of lsasrv.dll at different offsets of the flag bits of the Logon Session Sign table corresponding to the system version to obtain Logon Session List and LogonSession Count.

[0054] In a specific embodiment, the Logon Session Sign table stores a flag for obtaining a login session and a corresponding offset, which includes two offsets, offset 0 and offset 1. The details are shown in Table 1 below.

[0055] Table 1. Logon Session Sign table

[0056]

[0057] If the system version is not in the above table, you can refer to the closest system version.

[0058] In a specific embodiment, the Search Sign Apply Offset operation is specifically as follows: search the flag, obtain a position Sign Base, offset Sign Offset bytes, read a 4-byte unsigned long integer in little-endian format and record it as Offset, and the result is Sign Base + Sign Offset + 4 + Offset. Combined with Table 1, in this step, the Search SignApply Offset operation is performed in the lsasrv.dll memory range with the flag corresponding to the system version Logon Session Sign table, offset 0 as Sign Offset, and Logon Session Address List is obtained, and then the information of the login session list Logon Session List is obtained according to the Logon Session structure; the Search Sign Apply Offset operation is performed in the lsasrv.dll memory range with the flag corresponding to the system version LogonSession Sign table, offset 1 as Sign Offset, and Logon Session Count is obtained.

[0059] S103: Obtain the Cache Master Key corresponding to each Logon Session in the Cached Master Key structure in the corresponding dynamic link library memory range according to different system versions.

[0060] In a specific embodiment, the Logon Session structure records the LogonId, SID, Domain and other information, which can be used to obtain the corresponding Master Key cache. The specific Logon Session structure is as follows: Figure 2 The Logon Session structure diagram of a specific embodiment of the present application is shown in FIG. The Cached Master Key structure records the Logon Id, KeyUid, Cached Master Key and other information. By traversing, the Cached Master Key corresponding to the Logon Id can be obtained. The specific Cached Master Key structure is as follows Figure 3 A Cached Master Key structure diagram of a specific embodiment of the present application is shown in , wherein DPAPISRV Base stores the dynamic link library memory base address of the Cached Master Key, which is dpapisrv.dll for Windows 8 and later versions and lsasrv.dll for other versions.

[0061] S104: Perform Search Sign Apply Offset operation on the memory range of lsasrv.dll at different offsets of the flag bit of the Decrypt Key Sign table corresponding to the system version to obtain the 16-byte IV and Key3DES, and perform Search Sign Apply Offset operation on Key3DES to obtain Key AES.

[0062] In a specific embodiment, the Decrypt Key structure records the key used to decrypt the Cached Master Key. The specific Decrypt Key structure is as follows: Figure 4 The Decrypt Key structure diagram of a specific embodiment of the present application is shown in the table. The Decrypt Key Sign table contains the flag bit for obtaining the decrypted CachedMasterKey key and the corresponding offset, which includes three offsets: offset 0, offset 1, and offset 2. The details are shown in Table 2 below:

[0063] Table 2. Decrypt Key Sign table

[0064]

[0065] If the system version is not in the above table, you can refer to the closest system version.

[0066] In a specific embodiment, combined with Table 2, in this step, in the lsasrv.dll memory range, offset 0 in the flag bit of the Decrypt KeySign table is used as the Sign Offset to perform a Search Sign Apply Offset operation to obtain a 16-byte IV; in the lsasrv.dll memory range, offset 1 in the flag bit of the Decrypt Key Sign table is used as the Sign Offset to perform a Search Sign Apply Offset operation to obtain the Decrypt HandleAddress in the Decrypt Key structure, and then read according to the Decrypt Key structure to obtain a key Key3DES; the Sign Offset is replaced with the offset 2 corresponding to the Decrypt Key Sign table, and the Search Sign Apply Offset operation is repeated to obtain KeyAES.

[0067] S105: Decrypt the Cache Master Key, Key3DES, Key AES and IV to obtain the Master Key corresponding to each LogonSession, where the Master Key is the DPAPI user key / system key.

[0068] Continue to refer Figure 5 , Figure 5 A flowchart of a method for extracting a DPAPI key according to a specific embodiment of the present application is shown as follows: Figure 5 As shown, the method includes:

[0069] Step 501: load the memory image, obtain the version number and extract the minidump of lsass.exe; then execute steps 5021, 5022 and 5023 respectively;

[0070] Step 5021: Perform Search Sign Apply Offset operation (specifically, as in step 102 in the above method) according to the parameters in Table 1 to obtain Logon Session List and Logon Session Count in step 5031;

[0071] Step 5022: Extract the dynamic library of the Cached Master Key according to the structure to obtain the Cache Master Key in step 5032;

[0072] Step 5023: Perform Search Sign Apply Offset operation (specifically as step 104 in the above method) with the parameters in Table 2 to obtain IV, Key3DES, and Key AES in step 5033

[0073] Step 504: Determine whether the Cache Master Key has been traversed, if not, proceed to step 505;

[0074] Step 505: Get the next Cache Master Key;

[0075] Step 506: Determine whether the Logon ID of the Cache Master Key is in the Logon Session List. If not, return to step 504. If yes, proceed to step 507.

[0076] Step 507: Determine whether the length of the Cache Master Key is a multiple of 8. If so, proceed to step 508. If not, proceed to step 509.

[0077] Step 508: Use Key AES and IV to perform AES-CFB decryption on the Cache Master Key; obtain the Master Key of step 510;

[0078] Step 509: Use Key AES and the first 8 bytes of IV to perform 3DES-CBC decryption on the Cache Master Key to obtain the Master Key of step 510.

[0079] In a specific embodiment, the passwords saved by Chrome are encrypted using AES. The encryption key is encrypted by the DPAPI user key and stored in %APPDATA\Local\Google\Chrome\User Data\Local State. It is stored in the os_crypt field in base64. After decoding, a string starting with dpapi is obtained. After removing the head dpapi string, the string is the AES key encrypted by the user DPAPI. After DPAPI decryption, the key plaintext is obtained, and the passwords saved by Chrome can be decrypted. The decryption effect diagram is as follows: Figure 8 shown.

[0080] The Lsass.exe process of the Windows operating system is used for local security and login policies. It caches the encrypted DPAPI user key and system key in the process memory, and stores the initialization key used to decrypt the encrypted DPAPI user key and system key in plain text at a specific location in the memory. This method searches through the flag bit of the key position, reads the data of the memory offset of the specific module for decryption, and thus obtains the DPAPI key. This method can be used to extract the DPAPI key from the memory image, avoiding the possibility of loss of the key DPAPI key in the traditional method, resulting in the inability to decrypt important encrypted data. It can also parse the database of passwords saved by Chromium, the database encrypted by Outlook, remote desktop passwords, FTP account passwords, Outlook account passwords, IE and Chrome browsers automatic online forms, wireless Internet passwords, EFS private key encryption, MSN Messenger passwords and other data encrypted using DPAPI.

[0081] Continue to refer Figure 6 , Figure 6A system framework diagram of offline extraction of DPAPI keys based on memory image according to an embodiment of the present invention is shown. The system specifically includes a memory image loading unit 601, a Cache Master Key acquisition unit 602, an offset processing unit 603 and a decryption unit 604, wherein the memory image loading unit 601 is configured to load the memory image, obtain the system version information from the memory image, and extract the minidump of the lsass.exe process; the Cache Master Key acquisition unit 602 is configured to obtain the Cache Master Key corresponding to each Logon Session in the corresponding dynamic link library memory range according to different system versions with the Cached Master Key structure; the offset processing unit 603 is configured to perform Search Sign Apply Offset operations in the lsasrv.dll memory range with different offsets of the flag bits of the Logon Session Sign table corresponding to the system version to obtain the Logon Session List and the Logon Session Count; perform Search Sign Apply Offset operations in the lsasrv.dll memory range with different offsets of the flag bits of the Decrypt Key Sign table corresponding to the system version to obtain the 16-byte IV and Key3DES, and perform Search SignApply Offset operations on Key3DES to obtain Key AES; the decryption unit 604 is configured to obtain the 16-byte IV and Key3DES according to the Cache Master Key, Key3DES, and Key AES and IV decryption obtains the Master Key corresponding to each Logon Session.

[0082] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 suitable for implementing an electronic device of an embodiment of the present application. Figure 7 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0083] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0084] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0085] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above functions defined in the method of the present application are executed. It should be noted that the computer-readable storage medium of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.

[0086] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0087] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0088] The modules involved in the embodiments of the present application may be implemented by software or by hardware.

[0089] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: loads a memory image, obtains system version information from the memory image, and extracts a minidump of the lsass.exe process; performs Search Sign Apply Offset operations in the lsasrv.dll memory range at different offsets of the flag bits of the LogonSession Sign table corresponding to the system version to obtain the LogonSession List and the Logon Session Count; obtains the Cache Master Key corresponding to each Logon Session in the Cached Master Key structure in the corresponding dynamic link library memory range according to different system versions; performs Search Sign Apply Offset operations in the lsasrv.dll memory range at different offsets of the flag bits of the Decrypt Key Sign table corresponding to the system version to obtain a 16-byte IV and Key3DES, and performs Search SignApply Offset operations on Key3DES to obtain Key AES; and decrypts the Master Key corresponding to each Logon Session according to the Cache Master Key, Key3DES, Key AES, and IV.

[0090] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A method for extracting DPAPI keys offline based on memory image, characterized in that: include: S1: Load the memory image, obtain system version information from the memory image, and extract the minidump of the lsass.exe process; S2: Perform Search Sign Apply Offset operation in the memory range of lsasrv.dll with different offsets of the flag bit of the Logon Session Sign table corresponding to the system version to obtain Logon Session List and Logon SessionCount. The Search Sign Apply Offset operation is specifically as follows: search the flag bit, obtain a position Sign Base, offset Sign Offset bytes, read a 4-byte unsigned long integer in a little-endian format and record it as Offset, and the result is Sign Base+Sign Offset+4+Offset; the flag bit of a system version in the Logon Session Sign table corresponds to two offset information of offset 0 and offset 1; S3: Obtain the Cache Master Key corresponding to each Logon Session in the corresponding dynamic link library memory range using the Cached Master Key structure according to different system versions; S4: Perform Search Sign Apply Offset operation on the memory range of lsasrv.dll at different offsets of the flag bit of the Decrypt Key Sign table corresponding to the system version to obtain 16-byte IV and Key3DES, and perform Search Sign Apply Offset operation on the Key3DES to obtain Key AES. The flag bit of a system version in the Decrypt Key Sign table corresponds to three offset information of offset 0, offset 1 and offset 2; S5: Decrypt the Cache Master Key, Key3DES, Key AES and IV to obtain the Master Key corresponding to each Logon Session; The step S2 specifically includes: In the memory range of the lsasrv.dll, a Search Sign Apply Offset operation is performed with a flag bit of the Logon Session Sign table corresponding to the system version and an offset of 0 as the Sign Offset to obtain the Logon Session AddressList, and then the information of the login session list Logon Session List is obtained according to the Logon Session structure; In the memory range of lsasrv.dll, use the flag bit of the Logon Session Sign table corresponding to the system version and offset 1 as the Sign Offset to perform the Search Sign Apply Offset operation and obtain the Logon Session Count. The step S4 specifically includes: Perform Search Sign Apply Offset operation in the lsasrv.dll memory range with offset 0 in the flag bit of the Decrypt Key Sign table as SignOffset to obtain a 16-byte IV; Perform Search Sign Apply Offset operation in the memory range of lsasrv.dll with offset 1 in the flag bit of the Decrypt Key Sign table as SignOffset to obtain Decrypt HandleAddress in the Decrypt Key structure, and then read a key Key3DES according to the Decrypt Key structure; Replace Sign Offset with offset 2 corresponding to the Decrypt Key Sign table, repeat the Search SignApply Offset operation, and obtain Key AES.

2. A computer-readable storage medium having one or more computer programs stored thereon, characterized in that: When the one or more computer programs are executed by a computer processor, the method of claim 1 is implemented.

3. A system for extracting DPAPI keys offline based on memory images, characterized in that: The system comprises: A memory image loading unit, configured to load the memory image, obtain system version information from the memory image, and extract a minidump of the lsass.exe process; Cache Master Key acquisition unit: configured to acquire the Cache Master Key corresponding to each Logon Session in the corresponding dynamic link library memory range according to different system versions using the Cached Master Key structure; The offset processing unit is configured to perform Search Sign Apply Offset operation in the memory range of lsasrv.dll at different offsets of the flag bit of the corresponding system version Logon SessionSign table to obtain Logon SessionList and Logon Session Count; perform Search Sign Apply Offset operation in the memory range of lsasrv.dll at different offsets of the flag bit of the corresponding system version Decrypt KeySign table to obtain 16-byte IV and Key3DES, and perform Search Sign Apply Offset operation on the Key3DES to obtain Key AES. The SearchSign Apply Offset operation is specifically as follows: search the flag bit, obtain a position Sign Base, offset Sign Offset bytes, read a 4-byte unsigned long integer in a little-endian format and record it as Offset, and the result is Sign Base+Sign Offset+4+Offset. There are two offset information of offset 0 and offset 1 corresponding to the flag bit of a system version in the Logon Session Sign table, and there are three offset information of offset 0, offset 1 and offset 2 corresponding to the flag bit of a system version in the Decrypt Key Sign table; Decryption unit: configured to obtain the Master Key corresponding to each Logon Session according to the Cache Master Key, Key3DES, Key AES and IV decryption; In the memory range of the lsasrv.dll, a Search Sign Apply Offset operation is performed with a flag bit of the Logon Session Sign table corresponding to the system version and an offset of 0 as the Sign Offset to obtain the Logon Session AddressList, and then the information of the login session list Logon Session List is obtained according to the Logon Session structure; In the memory range of lsasrv.dll, use the flag bit of the Logon Session Sign table corresponding to the system version and offset 1 as the Sign Offset to perform the Search Sign Apply Offset operation and obtain the Logon Session Count. The offset processing unit specifically includes: Perform Search Sign Apply Offset operation in the lsasrv.dll memory range with offset 0 in the flag bit of the Decrypt Key Sign table as SignOffset to obtain a 16-byte IV; Perform Search Sign Apply Offset operation in the memory range of lsasrv.dll with offset 1 in the flag bit of the Decrypt Key Sign table as SignOffset to obtain Decrypt HandleAddress in the Decrypt Key structure, and then read a key Key3DES according to the Decrypt Key structure; Replace Sign Offset with offset 2 corresponding to the Decrypt Key Sign table, repeat the Search SignApply Offset operation, and obtain Key AES.

Images