WinKeyFinder : Search for Windows key in bios dump

[SRO2]

Description:

WinKeyFinder is a program that I developed to search the Windows key in a bios dump file. This manipulation is easily done with a hexadecimal editor but I have added some features to the program that can help save time.

Program features:

- Graphical interface : allows you to choose if you want to scan one or more files or if you want to scan all the files in a directory. The result is displayed in a window and the found keys are automatically inserted in the clipboard.

- Drag and Drop : drag and drop one or more files or a folder directly on the executable. The result is displayed in a window and the found keys are automatically inserted in the clipboard.

- Commande line interface : allows you to indicate on the command line the files and/or directories you wish to analyze. The result is returned by default in the console but the program can also create a CSV file associating the file name with the corresponding Windows key

Help:
For more information about the program features you can click on the "?" button in the graphical interface or type the command winkeyfinder.exe -h

Licence:
The license of the program is GNU GPLv3.

Bug report:
If you notice any bugs or if you have any suggestions please let me know

Source code:
The source code is available in attachment. The program is written in AutoIt and compiled with version 3.3.14.5.

[lapfix]

Re: WinKeyFinder : Search for Windows key in bios dump

Thank you , i tested with some bios bin and it works

[hardware1]

Re: WinKeyFinder : Search for Windows key in bios dump

Thanks for sharing, I tried this tool with many files which I already know if they have a key or not. It's working fine and shows the correct key.

[R_J]

Re: WinKeyFinder : Search for Windows key in bios dump

What about the Trojan:Script/Wacatac.H!ml included

[SMDFlea]

Re: WinKeyFinder : Search for Windows key in bios dump

What about the Trojan:Script/Wacatac.H!ml included

It could be a false positive, the exe isn`t signed .

[R_J]

Re: WinKeyFinder : Search for Windows key in bios dump

It could be a false positive, the exe isn`t signed .

Ok, just thought I would mention it.

[SMDFlea]

Re: WinKeyFinder : Search for Windows key in bios dump

Ok, just thought I would mention it.

Its flagged by a few more at Virustotal https://www.virustotal.com/gui/file/...d5c4/detection

[SRO2]

Re: WinKeyFinder : Search for Windows key in bios dump

What about the Trojan:Script/Wacatac.H!ml included

Programs written in AutoIt are unfortunately often recognized as trojan/malware... I think that Antivirus programs identify false positives because they make a correspondence with real trojans that also use the native AutoIt libraries.

I can assure you that the executable I provided is compiled from the source code I provided.

More informations on the official Wiki of AutoIt : https://www.autoitscript.com/wiki/AutoIt_and_Malware