aguinet / wannakey Goto Github PK

It should be sufficient, and much faster, to just check if (P > 1 && N % P == 0) right?

Please paste here the results of winapi_check!

Hi,

Looks good. Success.. :)

Note: First time, got the msvcp120.dll not found error.

Should note that you need Visual C++ Redistributable Packages for Visual Studio 2013 (https://www.microsoft.com/en-us/download/details.aspx?id=40784) for this to work.

FYI THIS DOES NOT WORK HOWEVER WITH Version 2:

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

Sample from:

hxxps://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100

As no wcry.exe process.

Thanks,

Will

If the Windows session is hibernated while Wanacrypt is encrypting, or as soon as the ransom message appears, would hiberfil.sys possibly contain the primes and be analyzable offline?

I checked the memory address that reported by winapi_check. It was created by vector in process.cpp for comparison. When winapi_check use it to check the address will be always different, that's why Windows 10 also report leakage.

After I modify the code by checking the MemInfo.BaseAddress, it will not report leakage.

P: 00BAEAB0
Q: 00BAEA28
Key generated, zeroying data at 00baeb60...
Will destroy key...
Will release ctx...
MemInfo.BaseAddress009B0000
MemInfo.BaseAddress00A20000
MemInfo.BaseAddress00AA8000
MemInfo.BaseAddress00BAC000
Found P at 00BAEAB0 => I changed to memory block address with offset
Found P at heap 026E2310 => this was created by std::vector<uint8_t> Buf; @process.cpp #138
Found Q at 00BAEA28
Found Q at heap 026E2288

why win7 donot used？

Want to know how one process i.e. wannakey.exe is able to access the memory of another process i.e. wcry.exe. Isn't accessing another process memory restricted in windows?