Dumpscan - Tool To Extract And Dump Secrets From Kernel And Windows Minidump Formats

Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3.

Features

• x509 Public and Private key (PKCS #8/PKCS #1) parsing
• SymCrypt parsing
  • Supported structures
    • SYMCRYPT_RSAKEY - Determines if the key structure also has a private key
  • Matching to public certificates found in the same process
  • More SymCrypt structures to come
• Environment variables
• Command line arguments

Note: Testing has only been performed on Windows 10 and …

kernel secrets tool volatility windows windows 10