ssh-tpm-agent

SSH agent for TPM ssh-tpm-agent is a ssh-agent compatible agent that allows keys to be created by the Trusted Platform Module TPM for authentication towards ssh servers. TPM sealed keys are private keys created inside the Trusted Platform Module TPM and sealed in .tpm suffixed files. They are bou...

gEnclave

======== gEnclave .. image:: https://gitlab.com/renich/genclave/-/raw/master/assets/banner.svg :width: 100% :align: center :alt: gEnclave banner | .. image:: https://gitlab.com/renich/genclave/badges/master/pipeline.svg :target: https://gitlab.com/renich/genclave/-/commits/master :alt: pipeline...

attezt

attezt attezt is a suite of remote attestation tools. It provides several components that allows Linux systems to have hardware backed device certificates over the device-attest-01 ACME challenge. This is useful for environments where you want a strong device identity claim for things like x509...

lehack-2026-challenge

LeHack 2026 Challenge A 3-tier challenge demonstrating impact of direct disk mounting. Challenge Overview Level| Goal| Technique ---|---|--- 1| Access the unencrypted disk| Set boot cmdline to init=/bin/bash in grub 2| Crack vault1 LUKS| Extract header → hashcat → unlock & mount vault 3| Crack...

incus-os

Introduction IncusOS is an immutable OS image dedicated to running Incus. It's based on Debian 13 and built using mkosi. IncusOS can be installed on modern amd64 x8664 and arm64 systems. This aims at providing a very fast, safe and reliable way to run an Incus server. It's got a strong focus on...

TPMGenie

TPM Genie TPM Genie is designed to aid in vulnerability research of Trusted Platform Modules. As a serial bus interposer, TPM Genie is capable of intercepting and modifying all traffic that is sent across the I2C channel between the host machine and a discrete TPM chip. Outside of research, the...

ultrablue

Ultrablue, a remote attestation server for your phone Ultrablue User-friendly Lightweight TPM Remote Attestation over Bluetooth is a solution to allow individual users to perform boot state attestation with their phone. It consists in a server, running on a computer, acting as the attester, and a...

lpc_sniffer_tpm

TPM Specific lpc sniffer low pin count for ice40 stick Turn the ice40 stick into a LPC sniffer, only logging TPM specific messages. This repository is a duplicate of https://github.com/lynxis/lpcsniffer/, with modifications made to only log messages with start field 0101 and address between 24 an...

pyrite

Hardware-Bound & Cloud-Gated Binary Execution and Anti-Tamper Envelope Sealing for Crystal. What is Pyrite? Pyrite ensures that your compiled Crystal binary only executes on your authorized infrastructure. If an adversary extracts, leaks, steals, or modifies the binary, execution halts immediatel...

WHFB-PinCapture

WHFB-PinCapture TL;DR On a host where Windows Hello is protected by VBS/VSM an isolated NgcIso container in VTL1 + a TPM , the PIN is not recoverable offline and online brute-force is blocked by the secure-kernel trustlet. The only reliable route is capture-at-entry. This project captures the PIN...

tpm-vuln-checker

TPM 2.0 Vulnerability Scanning Tool This is a tool written in Golang designed to scan for multiple TPM vulnerabilities using the Immune Security tpm-vuln-checker library. Requirements To use this tool, you will need the following: TPM device driver Windows Vista+ or Linux operating system...

napper-for-tpm

,----------------, ,---------, ,-----------------------, ," ,"| ," Napper v1.3 for TPM ," | ," ," | +-----------------------+ | ," ," | | .-----------------Z | | +---------+ | | | Z | | | | -==----'| | | | ︶ ︶ z | | | | | | | | - | | |/----| ==== oo | | | | | | | ,/| | ," | -----------------' |,"...

YellowKey-BitLocker-CVE-2026-45585

🔐 YellowKey-BitLocker-CVE-2026-45585 - Recover Your BitLocker Keys Safely and Easily 🛡️ What Is YellowKey? YellowKey is a free, portable auditing tool built for Windows 10 and Windows 11. It helps you manage, audit, and back up your BitLocker recovery keys for volumes that you own. Think of it as ...

hiya

Hiya Fingerprint authentication for Linux. Handles sudo, su, polkit, screen unlock, SSH keys, and browser passkeys from a single enrollment. Replaces fprintd. Works with existing DEs without patching them. Requirements libfprint-supported fingerprint sensor Linux with PAM, systemd, D-Bus TPM 2.0...

CVE-2026-32606-POC

Proof-of-Concept for CVE-2026-32606 This repo has simple proof-of-concept code exploiting a common weakness initially described over a year ago at https://oddlama.org/blog/bypassing-disk-encryption-with-tpm2-unlock/. While it specifically targets IncusOS, the attack is pretty generic against most...

webauthn_tpm_portable

WebAuthn TPM Portable Credentials ⚠️ Early proof of concept. This project has not been thoroughly tested or audited. Do not use it for anything beyond experimentation. Portable, hardware-backed WebAuthn/passkey credentials that work across multiple devices using TPM 2.0. Traditional TPM credential...

attestos

attestos Experimental Linux boot-attestation image and evidence harness for testing what an anti-cheat vendor could verify instead of relying on a distribution-name allowlist. The mechanism, the threat model, and the vendor specification live in plunder707/attested-gaming. This repository is the...

[SECURITY] Fedora 43 Update: tpm2-tss-4.1.5-1.fc43

tpm2-tss is a software stack supporting Trusted Platform ModuleTPM 2.0 syst em APIs. It sits between TPM driver and applications, providing TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers...

Infineon-CVE-2017-15361

Infineon-CVE-2017-15361 Simple PowerShell script to check whether a computer is using an Infineon TPM chip that is vulnerable to CVE-2017-15361. IMPORTANT: THIS MUST BE EXECUTED AS ADMINISTRATOR!! This script only works on Windows 8.1 and Windows Server 2012 or later releases of Windows. The scri...

optee_ftpm

OP-TEE integration for the MS TPM 2.0 Reference Implementation fTPM fTPM TA The fTPM Trusted Application TA provides a secure firmware implementation of a TPM using the MS reference implementation. The platform specific integration code is kept in this repository. This is a fork from the the MS...