Package: dumpscan
Dumpscanis a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided byvolatility3.Featuresx509 Public and Private key (PKCS #8/PKCS #1) parsingSymCryptparsingSupported structuresSYMCRYPT_RSAKEY- Determines if the key structure also has a private keyMatching to public certificates found in the same processMore SymCrypt structures to comeEnvironment variablesCommand line argumentsNote: Testing has only been performed on Windows 10 and 11 64-bit hosts and processes. Feel free to file an issue for additional versions. Linux testing TBD.InstallationAs a command-line tool, installation is recommended usingpipx. This allows for easy updates and well and ensuring it is installed in its own virtual environment.pipx install dumpscan
pipx inject dumpscan git+https://github.com/volatilityfoundation/volatility3#39e812aUsageUsage: dumpscan [OPTIONS] COMMAND [ARGS]...

 Scan memory dumps for secrets and keys

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  --help         Show this message and exit.                                                      │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  kernel     Scan kernel dump using volatility                                                    │
│  minidump   Scan a user-mode minidump                                                            │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯In the case for subcommands that extract certificates, you can provide--output/-o <dir>to output any discovered certificates to disk.Kernel ModeAs mentioned, kernel analysis is performed by Volatility3.cmdline,envar, andpslistare direct calls to the Volatility3 plugins, whilesymcryptandx509are custom plugins.Usage: dumpscan kernel [OPTIONS] COMMAND [ARGS]...

 Scan kernel dump using volatility

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  --help         Show this message and exit.                                                      │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  cmdline    List command line for processes (Only for Windows)                                   │
│  envar      List process environment variables (Only for Windows)                                │
│  pslist     List all the processes and their command line arguments                              │
│  symcrypt   Scan a kernel-mode dump for symcrypt objects                                         │
│  x509       Scan a kernel-mode dump for x509 certificates                                        │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯Minidump ModeSupports Windows Minidump format.Note: This has only been tested on 64-bit processes on Windows 10+. 32-bit processes requires additional work but isn't a priority.Usage: dumpscan minidump [OPTIONS] COMMAND [ARGS]...

 Scan a user-mode minidump

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  --help         Show this message and exit.                                                      │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  cmdline    Dump the command line string                                                         │
│  envar      Dump the environment variables in a minidump                                         │
│  symcrypt   Scan a minidump for symcrypt objects                                                 │
│  x509       Scan a minidump for x509 objects                                                     │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯Built Withvolatility3constructyara-pythontyperrichrich_clickAcknowledgementsThanks toF-Secureand thephysmem2profitproject for providing the idea to useconstructfor parsing minidumps.Thanks toSkelsecand hisminidumpproject which helped me figure out to parse minidumps.To-DoVerify use against 32-bit minidumpsCreate a coredump parser for Linux process dumpsVerify volatility plugins work against Linux kernel dumpsAdd an HTML report that shows all pluginsCode refactoring to make more extensibleMORE SECRETS