Q: What is best method to find AES encryption key in executable? I try Aeskeyfind, Aeskeyfinder but no lock.
A:
It depends on the code. an AES key is either 16 (128bit) or 32 bytes (256bit), they are random. Only if the key is in plaintext and you know a way to check if a decryption was correct, you could write a program that just goes through the binary and tries every offset in the binary as being a key.
You need basic reverse engineering skills:
The way I would do it myself is using a debugger, you first analyze your binary in IDA, and find the AES decryption function, if you can't do that at first glance, get PEiD with KANAL plugin to find constants used by the AES cipher, then find xrefs from those to the function, read the function to understand which one does the decryption, then launch it in a debugger, like ollydbg or x64dbg, if it's a windows binary, or gdb or something else if it's linux or some other system, place a breakpoint on the function and look at the arguments, notice the input buffer, the destination buffer, the key. Copy the key from memory and you're done.
This only works if it's unmodified AES, there exist whitebox implementations that require some math knowledge to break, if you need to extract their key, I won't explain how to do it because it would be too lengthy, although almost all of them can be broken.
If your binary has obfuscation or antidebug or other protection, it will need to be dealt with somehow, removed or bypassed or patched.
Good luck with your challenge, I don't think I'll reply further, and nobody could answer your question without seeing the binary. A reverse engineering or cracking forum might be more suitable, but even those won't spoonfeed you, you need to do some work yourself.
BV1ovi7ebEKb 使用 IDA 断点 虚幻引擎的 DecryptData 函数，查看内存得到 AES Key