inception

Note: This tool is no longer under active development, please look at PCILeech instead. INCEPTION Inception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe HW interfaces...

BitUnlocker

BitUnlocker Downgrade Attack A proof of concept for accessing BitLocker-encrypted disks in under 5 minutes on fully patched Windows 11 machines through a boot manager downgrade attack, leveraging the SDI vulnerability originally documented as CVE-2025-48804. The July 2025 patch fixes this in...

bitlocker-attacks

BitLocker Attacks A list of public attacks on BitLocker. Any public attack with the potential to attack BitLocker but where the exact method is still not public like baton drop is out of scope. Most of the attacks are for where the VMK is sealed by TPM only, which is the default setting, and is...

ntfstool

ntfstool NTFSTool is a forensic tool focused on NTFS volumes. It supports reading partition info MBR, partition table, VBR but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more. Download the latest binaries on AppVeyor or by checking the...

CVE-2024-20666

CVE-2024-20666 Vulnerability Patch Guide Welcome to the repository for addressing the CVE-2024-20666 vulnerability patch failures in the Windows Recovery Environment WinRE. Overview This repository provides resources and instructions to resolve patch failures related to the Windows OS update...

ExtractBitlockerKeys

A system administration or post-exploitation script to automatically extract the bitlocker recovery keys from a domain. Features Automatically gets the list of all computers from the domain controller's LDAP. Multithreaded connections to extract Bitlocker keys from LDAP. Iterate on LDAP result...

BSOD_bitlocker_recover

BitLocker VMK Carving Tool This Python script helps you extract potential BitLocker Volume Master Keys VMKs from memory dump files, such as those generated by a Blue Screen of Death BSOD. It's a command-line utility designed to assist in forensic investigations where BitLocker encryption is...

yellowkey-bitlocker

🔑 yellowkey-bitlocker - Unlock your BitLocker encrypted computer files 📁 Project Overview The yellowkey-bitlocker tool provides a way to regain access to your Windows storage drives. Many users encounter issues with BitLocker drive encryption, which can lock files during updates or hardware...

remote-bitlocker-encryption-report

remote-bitlocker-encryption-report This PowerShell script takes a list of PC as input, gets their BitLocker encryption type remotely, and outputs the list as a CSV file to help mitigate against CVE-2018-12038. Prevent CVE-2018-12038 vulnerability Description of CVE-2018-12038 from NIST : An issue...

YellowKey-Bitlocker

🔑 YellowKey-Bitlocker - Manage BitLocker security on Windows systems 🛡️ What is YellowKey-Bitlocker? YellowKey-Bitlocker is a program for Windows 10 and Windows 11. It helps users secure drives against the CVE-2026-45585 vulnerability. This issue affects how BitLocker manages drive encryption...

ntfstool

ntfstool NTFSTool は、NTFS ボリュームに特化したフォレンジックツールです。 パーティション情報（MBR、パーティションテーブル、VBR）の読み取りに加え、マスターファイルテーブル、BitLocker 暗号化ボリューム、EFS 暗号化ファイル、USN ジャーナルなどの情報も取得できます。 最新のバイナリは AppVeyor から、または GitHub の最新 アーティファクト を確認してダウンロードしてください。 機能の例については、以下の 例 を参照してください！ deepwiki...

tofu

tofu A modular tool for hacking offline Windows filesystems and bypassing login screens. Can do hashdumps, OSK-Backdoors, user enumeration and more. How it works : When a Windows machine is shut down, unless it has Bitlocker or another encryption service enabled, it's storage device contains...

YellowKey-WinRE-Remediation

YellowKey WinRE Remediation Intune Remediation package for the CVE-2026-45585 YellowKey BitLocker/WinRE bypass mitigation described in the provided procedure. This package removes autofstx.exe from the offline WinRE image's BootExecute value and refreshes WinRE registration so BitLocker trust is...

lpc_sniffer_tpm

ice40 スティック用 TPM 専用 LPC スニファ 低ピンカウント ice40 スティックを LPC スニファに変え、TPM 固有のメッセージのみを記録します。このリポジトリは https://github.com/lynxis/lpcsniffer/ の複製で、開始フィールドが 0101 でアドレスが 24 から 27 の間のメッセージのみを記録するように変更されています。 このプロジェクトは、BitLocker が既定の構成で有効になっているときに LPC バスをスニッフィングして、BitLocker の VMK キーを抽出するために使用されました。詳細は こちらの記事...

ClientInspectorV2

Introduction to ClientInspector v2 あなたはコントロールできていますか？ - それとも、パッチ適用、アンチウイルス、BitLocker有効化 などのコアインフラストラクチャプロセスが逸脱していませんか？または、LenovoやDellの保証に対して保証状態 を確認できる高度なインベントリ を実行したいですか？それなら、読み続けてください。 ClientInspector をチェックしてください。これにより、完全なクライアント環境 に関する素晴らしい洞察 を得ることができます。 ClientInspector はコミュニティに無料...

bitcracker

BitCracker BitCracker is the first open source password cracking tool for storage devices Hard Disk, USB Pendrive, SD card, etc... encrypted with BitLocker, an encryption feature available on Windows Vista, 7, 8.1 and 10 Ultimate, Pro and Enterprise editions. BitLocker offers a number of differen...

bitcracker

BitCracker BitCracker は、BitLocker で暗号化されたストレージデバイス（ハードディスク、USB メモリ、SD カードなど）を対象とした、初のオープンソースパスワードクラッキングツールです。BitLocker は Windows Vista、7、8.1、10（Ultimate、Pro、Enterprise エディション）で利用可能な暗号化機能です。BitLocker は、Trusted Platform Module TPM、スマートカード、回復パスワード、ユーザー提供パスワードなど、ストレージデバイスを暗号化するためのいくつかの認証方法を提供します。...

Yellowkey-mitigation

Yellowkey-mitigation.ps1 is a PowerShell script that automates the WinRE mitigation workflow described in CVE-2026-45585, adds verification after every step, and does not execute step 6 reagentc /disable + reagentc /enable if any earlier step fails. It also checks whether the required registry...

Script-For-CVE-2024-20666

Script-For-CVE-2024-20666 Automate updating the WinRE partition without having to resize it first and patch the CVE-2024-20666 BitLocker vulnerability. Microsoft Link Script found here Works for Windows Server 2022 Server Core installation KB5034439: Windows Recovery Environment update for Azure...

CVE-2026-45585

🔑 CVE-2026-45585 - YellowKey 🔓 Advanced mitigation for CVE-2026-45585 YellowKey 📌 What is YellowKey Vulnerability? YellowKey CVE-2026-45585 is a zero-day physical attack vulnerability discovered in May 2026 that allows attackers with physical access to completely bypass BitLocker encryption on...