The DPAPIck tool we released for our first BlackHat presentation is available with another one that allows you to compute DPAPI blobs and put them into files:

DPAPIck tool v0.1

DPAPIck test tool to create DPAPI blobs

DPAPIck v0.1 has some limitations (only works for xp/vista blobs, cannot deal with EFS, cannot import DPAPI data to current profile, does not do masterkey lookup, etc.). This version is no longer maintained as we have released DPAPIck v0.2.

As we mentioned during the talk, DPAPIck v0.1 tool is a PoC version. The GUI interface needs many improvements and bug corrections.

DPAPIck v0.2 is a full rewrite of our tool in Python. It only relies on OpenSSL library to be fully cross-platform and moreover, we release it under a GPLv3 licence.

The code is hosted at our Bitbucket repository and only stable versions are released. So do not expect to have upcoming features as they are developed on the private repository. We do not have a GUI anymore as we prefer focusing on extending the the tool for the moment.

If you have any idea of improvements, you want to report a bug or give us feedback. Please, feel free to contact us.