aes-dumper-rs

Rust library for finding Unreal Engine AES keys in process memory through DLL injection.

Русская версия

Project Structure

The project consists of three crates in a workspace:

aes-dumper - Core Library

• Type: rlib (Rust library)
• Purpose: Contains all AES key search logic
• Modules:
  • entropy - entropy calculation for key validation
  • scanner - key search logic using ASM pattern matching
  • patterns - machine code patterns and false positive filtering
  • error - error types

aes-dumper-dll - DLL Wrapper

• Type: cdylib (dynamic library)
• Purpose: FFI interface for use from C/C++ and DLL injection
• Exported Functions:
  • scan_process_for_aes_keys - scan process for AES keys
  • free_scan_result - free scan result memory
  • aes_dumper_init - initialize DLL
  • aes_dumper_cleanup - cleanup DLL
  • start_scan_in_thread - start scan in separate thread

aes-dumper-cli - Command Line Interface

• Type: bin (executable)
• Purpose: Standalone executable for scanning files
• Features:
  • Scan .exe and .dll files
  • Drag & drop support (Windows)
  • Configurable entropy threshold
  • Colored output based on entropy values

Building

Build entire workspace:

cargo build --release --workspace

Build only library:

cargo build --release -p aes-dumper

Build only DLL:

cargo build --release -p aes-dumper-dll

DLL will be located at target/release/aes_dumper_dll.dll

Build only CLI:

cargo build --release -p aes-dumper-cli

Executable will be located at target/release/aes-dumper.exe

Usage

CLI Usage

Command Line:

aes-dumper.exe file1.exe file2.dll
aes-dumper.exe --min-entropy 3.5 file.exe

Drag & Drop (Windows):

Drag .exe or .dll file(s) onto aes-dumper.exe for automatic processing.

Help:

aes-dumper.exe --help

From Rust Code:

use aes_dumper::{scan_data_for_keys, filter_keys_by_entropy};

let data = std::fs::read("file.exe")?;
let result = scan_data_for_keys(&data, 0, "file.exe");
let filtered = filter_keys_by_entropy(&result, 3.3);

From C/C++ or via DLL Injection:

Use functions from aes-dumper-dll with FFI interface.

Algorithm

Re-implementation of AESDumpster algorithm:

1. Search for machine code patterns (ASM signatures) in process memory
2. Extract keys from found patterns by offsets
3. Calculate entropy for each key using Shannon's formula
4. Filter false positives
5. Display keys with entropy >= 3.3 (configurable)

---

Original repository: AESDumpster by GHFear