SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
extracting-encryption-keys-from-binaries
0
Locates candidate encryption keys in a binary by finding high-entropy fixed-size regions (16/24/32 bytes) near cryptographic constants or crypto API references, and surfacing printable key/passphrase strings. Activates for requests to extract encryption keys, find an AES key in a sample, or recover hardcoded crypto material.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Extracting Encryption Keys From Binaries ## When to Use - You have a sample with hardcoded crypto and want to surface candidate keys/IVs (16/24/32-byte high-entropy blocks) and passphrase strings. - You are recovering material to decrypt config, C2 traffic, or ransomware test vectors. **Do not use** entropy alone as proof a region is a key — corroborate with proximity to crypto constants/APIs and by attempting decryption. This skill reads the binary statically and executes nothing. ## Prerequisites - The binary (read inertly). Pairs well with the crypto-constant scanner. ## Safety & Handling - Read bytes statically; handle recovered keys as sensitive and store securely. ## Workflow ### Step 1: Find high-entropy key-sized regions ```bash python scripts/analyst.py keys sample.bin ``` Slides a window of 16/24/32 bytes and reports regions whose entropy exceeds a threshold (likely random key material), with offsets. ### Step 2: Surface printable secrets Extract printable strings that look like passphrases/hex keys (e.g., 32/64-hex, base64 of 16/32 bytes). ### Step 3: Corroborate Rank candidates by proximity to crypto constants/API references and confirm by decrypting a known ciphertext. ### Step 4: Document Record candidate keys, sizes, offsets, and the corroborating evidence. ## Validation - Candidate regions are exactly key-sized (16/24/32 bytes) and high-entropy. - Hex/base64 key strings are length-consistent with a real key size. - A candidate is confirmed only by successful decryption, not entropy alone. ## Pitfalls - Compressed/packed data producing many false high-entropy regions — unpack first. - Keys derived at runtime (KDF) not present statically. - Endianness/encoding of the key (raw vs hex vs base64) before use. ## References - See [`references/api-reference.md`](references/api-reference.md) for the extractor. - FIPS 197 and ATT&CK T1573 (linked in frontmatter).