Method for searching Veracrypt key in memory data

Abstract

The invention discloses a method for searching a Veracrypt key in memory data. The method is characterized by comprising the following steps of S100, searching a mark character Driv in a physical memory; s200, judging whether a mark character Driv in the physical memory is found or not, if yes, executing the step S300, and if not, executing the step S100; s300, judging whether the found mark character Driv corresponds to an effective Veracrypt driving object or not, if yes, executing the step S400, and if not, executing the step S100; s400, judging whether the type of the equipment object is an equipment volume or not, if yes, executing the step S600, and if not, executing the step S500; s500, addressing a next equipment object, and executing the step S400; s600, obtaining an expansion object; s700, acquiring an encrypted information object; and S800, a Veracryt secret key is obtained.

Description

Technical Field

[0001] The invention belongs to the field of electronic evidence collection and relates to a method for searching for Veracrypt keys in memory data. Background Art

[0002] Veracrypt is an open source disk encryption software used to create and manage encrypted disk partitions or containers. It can help users create an encrypted virtual disk on their computer and encrypt and save files and data to protect users' privacy and sensitive information. Veracrypt is a fork inherited from the TrueCrypt project, which stopped development in 2014.

[0003] Veracrypt provides a variety of encryption algorithms and methods, including AES, Serpent and Twofish, and users can choose the appropriate encryption method according to their needs. In addition, Veracrypt also supports advanced features such as hidden volumes and hidden operating systems to enhance data security.

[0004] With Veracrypt, users can create an encrypted container file or encrypt an entire disk partition. The contents of the container or partition can only be accessed and viewed after the correct password or key is entered. This allows users' data to remain safe even if the physical device is lost or stolen.

[0005] To summarize, Veracrypt is a tool for data encryption and privacy protection that is suitable for individual users and organizations to create a secure encrypted storage area on a computer.

[0006] Veracrypt facilitates the confidentiality of our data, but it also brings troubles to electronic forensics. After collecting Veracrypt's encrypted container files or encrypted disks on site, when electronic data forensics checks the encrypted container files or encrypted disks, it is impossible to view the encrypted contents without the user's password.

[0007] When a Veracrypt encrypted container file or encrypted disk is mounted on a system and works normally, the decryption key is in the system memory, and the decryption key can be collected to decrypt the Veracrypt encrypted container file or encrypted disk. However, there is no technical solution for extracting the Veracrypt decryption key from the memory in the prior art. Summary of the invention

[0008] This application aims at the technical problems of the prior art and provides a method for searching for Veracrypt keys in memory data: extracting decryption keys based on the decryption key data structure allocated by the Veracrypt driver in the Windows operating system kernel. Because the functions of Veracrypt to decrypt data are all located in its driver program, the Veracrypt driver resides in the Windows operating system kernel, and the Veracrypt driver needs to allocate memory in the kernel to save the decryption key, so that the data can be decrypted in the memory continuously and quickly.

[0009] The method provided in this application comprises the following steps:

[0010] S100: Search for the flag character Driv in the physical memory, where the flag character Driv is

[0011] The label that the Windows operating system kernel assigns to driver objects;

[0012] S200: Determine whether the flag character Driv in the physical memory is found, if yes, execute step S300, otherwise, execute step S100;

[0013] S300: Determine whether the found flag character Driv corresponds to a valid Veracrypt driver object. If yes, execute step S400. Otherwise, execute step S100. Step S300 includes the following steps:

[0014] S301: Taking the starting address of the flag character Driv as the reference, the address is shifted forward by 4 bytes as the first address of the current drive object;

[0015] S302: Obtain the byte length of the current drive object: take the first address of the current drive object as the starting address, and continuously read 2 bytes of content as the byte length of the current drive object;

[0016] S303: Determine whether the byte length of the current drive object is a valid value, if yes, execute step S304, otherwise, execute step S100;

[0017] S304: Obtain the type of the current drive object: take the first address of the current drive object as the starting address, shift backward by 3 bytes, and read the addressed 1-byte content as the type of the current drive object;

[0018] S305: Determine whether the type of the current driving object is a valid value, if yes, execute step S306, otherwise, execute step S100;

[0019] S306: Get the name pointer of the current drive object: take the first address of the current drive object as the starting address, shift 336 bytes backward, and read the addressed continuous 20 bytes as the name pointer of the current drive object;

[0020] S307: using the name pointer of the current driver object and addressing, determining whether the string of the addressed continuous 9 bytes is Veracrypt, if so, indicating that the current driver object is a Veracrypt driver, executing step S400, otherwise, executing step S100;

[0021] S400: Determine whether the type of the device object is a device volume, if yes, execute step S600, otherwise, execute step S500;

[0022] S500: addressing the next device object, executing step S400;

[0023] S600: Acquire an extension object;

[0024] S700: Acquire an encrypted information object, wherein the encrypted information object includes encryption / decryption information and a Veracrypt key;

[0025] S800: Get Veracrypt key.

[0026] Preferably, step S303 includes the following steps: the byte length of the current drive object is greater than 0xf8, indicating that the byte length of the current drive object is a valid value;

[0027] Step S305 includes the following steps: the type of the current drive object is equal to 0x01, indicating that the type of the current drive object is a valid value.

[0028] Preferably, step S400 includes the following steps:

[0029] S401: Get the pointer of the device: take the first address of the current drive object as the starting address, shift 8 bytes backward, and read the addressed continuous 8 bytes as the pointer of the device of the current drive object;

[0030] S402: Use the pointer of the device and address it, and obtain the addressed continuous 336 bytes as the device object;

[0031] S403: Get the type of the device object: take the first address of the device object as the starting address, offset 72 bytes backward, and read the addressed 1-byte content as the type of the device object;

[0032] S404: Determine whether the type of the device object is a device volume, if yes, execute step S600, otherwise, execute step S500.

[0033] Preferably, step S404 includes the following steps:

[0034] It is determined whether the value of the type of the device object is 0x07. If so, it indicates that the device object is a device volume, and step S600 is executed. Otherwise, step S500 is executed.

[0035] Preferably, the step of addressing the next device object in step S500 includes:

[0036] S501: Taking the first address of the device object as the starting address, shifting backward by 16 bytes, and reading the addressed continuous 8-byte content as the addressing address of the next device object;

[0037] S502: Use the addressing address of the next device object to perform addressing and obtain the next device object.

[0038] Preferably, step S600 includes the following steps:

[0039] S601: Get the pointer of the extended object: take the first address of the device object as the starting address, offset 64 bytes backward, and read the addressed continuous 8 bytes as the pointer of the extended object;

[0040] S602: Get the extended object: use the pointer of the extended object and address it, and get the addressed continuous 1504 bytes as the extended object.

[0041] Preferably, step S700 includes the following steps:

[0042] S701: Get the pointer of the encrypted information object: take the first address of the extended object as the starting address, offset 144 bytes backward, and read the addressed continuous 8 bytes as the pointer of the encrypted information object;

[0043] S702: Obtain the encrypted information object: Use the pointer of the encrypted information object and address it, and obtain the addressed continuous 17512 bytes as the encrypted information object.

[0044] Preferably, step S800 includes the following steps:

[0045] Take the first address of the encrypted information object as the starting address, shift backward 12 bytes, and read the addressed continuous 5324 bytes as the Veracrypt key.

[0046] The present invention solves the technical problem that there is no method for searching Veracrypt keys in memory data in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1It is a flow chart of a method for searching Veracrypt keys in memory data provided by the present invention;

[0048] Figure 2 is a flow chart of determining whether the found flag character Driv corresponds to a valid Veracrypt driver object in an embodiment of the present invention;

[0049] Figure 3 It is a flowchart of judging whether the type of a device object is a device volume in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The Windows operating system will label the driver object with "Driv". Searching for this label in the memory will locate a driver object. Then verify whether this location is a valid driver object data structure through the driver context. If it is a valid driver object structure, the DriverName field of the driver structure is used to determine whether it is a Veracrypt driver. The name (DriverName) value of the driver object of the Veracrypt driver is the "Veracrypt" string. If it is a Veracrypt driver, the data structure of the Veracrypt driver is found through the extended object (Extobj) field. This data structure stores the Veracrypt decryption key. We can extract this key to decrypt the Veracrypt encrypted container file or encrypted disk.

[0051] The present invention comprises the following steps:

[0052] S100: searching for a flag character Driv in the physical memory, wherein the flag character Driv is a label marked by the kernel of the Windows operating system for allocating memory to the driver object;

[0053] S200: Determine whether the flag character Driv in the physical memory is found, if yes, execute step S300, otherwise, execute step S100;

[0054] S300: Determine whether the found flag character Driv corresponds to a valid Veracrypt driver object, if yes, execute step S400, otherwise, execute step S100. Step S300 includes the following steps:

[0055] S301: Taking the starting address of the flag character Driv as the reference, the address is shifted forward by 4 bytes as the first address of the current drive object;

[0056] S302: Obtain the byte length of the current drive object: take the first address of the current drive object as the starting address, and continuously read 2 bytes of content as the byte length of the current drive object;

[0057] S303: Determine whether the byte length of the current drive object is a valid value, if yes, execute step S304, otherwise, execute step S100;

[0058] Specifically, the byte length of the current drive object is greater than 0xf8, indicating that the byte length of the current drive object is a valid value;

[0059] S304: Obtain the type of the current drive object: take the first address of the current drive object as the starting address, shift backward by 3 bytes, and read the addressed 1-byte content as the type of the current drive object;

[0060] S305: Determine whether the type of the current driving object is a valid value, if yes, execute step S306, otherwise, execute step S100;

[0061] Specifically, the type of the current drive object is equal to 0x01, indicating that the type of the current drive object is a valid value.

[0062] S306: Get the name pointer of the current driver object: take the first address of the current driver object as the starting address, shift 336 bytes backward, and read the addressed continuous 20 bytes as the name pointer of the current driver object;

[0063] S307: Use the name pointer of the current drive object and address it to determine whether the string of the continuous 9 bytes addressed is Veracrypt. If so, it means that the current drive object is

[0064] Veracrypt driver, execute step S400, otherwise, execute step S100;

[0065] S400: Determine whether the type of the device object is a device volume. If yes, execute step S600; otherwise, execute step S500. Step S400 includes the following steps:

[0066] S401: Get the pointer of the device: take the first address of the current drive object as the starting address, shift 8 bytes backward, and read the addressed continuous 8 bytes as the pointer of the device of the current drive object;

[0067] S402: Use the pointer of the device and address it, and obtain the addressed continuous 336 bytes as the device object;

[0068] S403: Get the type of the device object: take the first address of the device object as the starting address, offset 72 bytes backward, and read the addressed 1-byte content as the type of the device object;

[0069] S404: Determine whether the type of the device object is a device volume. If yes, execute step S600.

[0070] Otherwise, execute step S500.

[0071] Specifically, it is determined whether the value of the type of the device object is 0x07. If so, it indicates that the device object is a device volume, and step S600 is executed. Otherwise, step S500 is executed.

[0072] S500: addressing the next device object, executing step S400; wherein the step of addressing the next device object in step S500 includes:

[0073] S501: Taking the first address of the device object as the starting address, shifting backward by 16 bytes, and reading the addressed continuous 8-byte content as the addressing address of the next device object;

[0074] S502: Use the addressing address of the next device object to perform addressing and obtain the next device object.

[0075] S600: Obtain an extended object (ExtObj, the same below); Step S600 includes the following steps:

[0076] S601: Get the pointer of the extended object: take the first address of the device object as the starting address, offset 64 bytes backward, and read the addressed continuous 8 bytes as the pointer of the extended object;

[0077] S602: Get the extended object: use the pointer of the extended object and address it, and get the addressed continuous 1504 bytes as the extended object.

[0078] S700: Obtain an encryption information object (cryptinfo, the same below), wherein the encryption information object includes encryption / decryption information and a Veracrypt key; step S700 includes the following steps:

[0079] S701: Get the pointer of the encrypted information object: take the first address of the extended object as the starting address, offset 144 bytes backward, and read the addressed continuous 8 bytes as the pointer of the encrypted information object;

[0080] S702: Obtain the encrypted information object: Use the pointer of the encrypted information object and address it, and obtain the addressed continuous 17512 bytes as the encrypted information object.

[0081] S800: Get Veracrypt key.

[0082] Specifically, the first address of the encrypted information object is used as the starting address, and the addressing continuous 5324 bytes are read as the Veracrypt key.

[0083] The method provided by the present invention solves the technical problem that there is no method for searching for Veracrypt keys in memory data in the prior art.

[0084] It should be understood that the present invention is not limited to the above examples. For those skilled in the art, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for searching for Veracrypt keys in memory data, characterized in that: The following steps are involved: S100: searching for a flag character Driv in the physical memory, wherein the flag character Driv is a label marked by the kernel of the Windows operating system for allocating memory to the driver object; S200: Determine whether the flag character Driv in the physical memory is found, if yes, execute step S300, otherwise, execute step S100; S300: Determine whether the found flag character Driv corresponds to a valid Veracrypt driver object. If yes, execute step S400. Otherwise, execute step S100. Step S300 includes the following steps: S301: Taking the starting address of the flag character Driv as the reference, the address is shifted forward by 4 bytes as the first address of the current drive object; S302: Obtain the byte length of the current drive object: take the first address of the current drive object as the starting address, and continuously read 2 bytes of content as the byte length of the current drive object; S303: Determine whether the byte length of the current drive object is a valid value, if yes, execute step S304, otherwise, execute step S100; S304: Obtain the type of the current drive object: take the first address of the current drive object as the starting address, shift backward by 3 bytes, and read the addressed 1-byte content as the type of the current drive object; S305: Determine whether the type of the current driving object is a valid value, if yes, execute step S306, otherwise, execute step S100; S306: Get the name pointer of the current drive object: take the first address of the current drive object as the starting address, shift 336 bytes backward, and read the addressed continuous 20 bytes as the name pointer of the current drive object; S307: Use the name pointer of the current drive object and address it to determine whether the string of the continuous 9 bytes addressed is Veracrypt. If so, it means that the current drive object is Veracrypt driver, execute step S400, otherwise, execute step S100; S400: Determine whether the type of the device object is a device volume. If yes, execute step S600. Otherwise, execute step S500; S500: addressing the next device object, executing step S400; S600: Acquire an extension object; S700: Acquire an encrypted information object, wherein the encrypted information object includes encryption / decryption information and a Veracrypt key; S800: Get Veracrypt key.

2. A method for searching for Veracrypt keys in memory data according to claim 1, characterized in that: Step S303 includes the following steps: the byte length of the current drive object is greater than 0xf8, indicating that the byte length of the current drive object is a valid value; Step S305 includes the following steps: the type of the current drive object is equal to 0x01, indicating that the type of the current drive object is a valid value.

3. A method for searching for Veracrypt keys in memory data according to claim 1, characterized in that: Step S400 includes the following steps: S401: Get the pointer of the device: take the first address of the current drive object as the starting address, shift 8 bytes backward, and read the addressed continuous 8 bytes as the pointer of the device of the current drive object; S402: Use the pointer of the device and address it, and obtain the addressed continuous 336 bytes as the device object; S403: Get the type of the device object: take the first address of the device object as the starting address, offset 72 bytes backward, and read the addressed 1-byte content as the type of the device object; S404: Determine whether the type of the device object is a device volume, if yes, execute step S600, otherwise, execute step S500.

4. A method for searching for Veracrypt keys in memory data according to claim 3, characterized in that: Step S404 includes the following steps: It is determined whether the value of the type of the device object is 0x07. If so, it indicates that the device object is a device volume, and step S600 is executed. Otherwise, step S500 is executed.

5. A method for searching for Veracrypt keys in memory data according to claim 1, characterized in that: The step of addressing the next device object in step S500 includes: S501: Taking the first address of the device object as the starting address, shifting backward by 16 bytes, and reading the addressed continuous 8-byte content as the addressing address of the next device object; S502: Use the addressing address of the next device object to perform addressing and obtain the next device object.

6. A method for searching for Veracrypt keys in memory data according to claim 1, characterized in that: Step S600 includes the following steps: S601: Get the pointer of the extended object: take the first address of the device object as the starting address, offset 64 bytes backward, and read the addressed continuous 8 bytes as the pointer of the extended object; S602: Get the extended object: use the pointer of the extended object and address it, and get the addressed continuous 1504 bytes as the extended object.

7. A method for searching for Veracrypt keys in memory data according to claim 1, characterized in that: Step S700 includes the following steps: S701: Get the pointer of the encrypted information object: take the first address of the extended object as the starting address, offset 144 bytes backward, and read the addressed continuous 8 bytes as the pointer of the encrypted information object; S702: Obtain the encrypted information object: Use the pointer of the encrypted information object and address it, and obtain the addressed continuous 17512 bytes as the encrypted information object.

8. A method for searching for Veracrypt keys in memory data according to claim 1, characterized in that: Step S800 includes the following steps: Take the first address of the encrypted information object as the starting address, shift backward 12 bytes, and read the addressed continuous 5324 bytes as the Veracrypt key.

Images