nightmare-eclipse/yellowkey

YellowKey is a security research repository that documents a Bitlocker bypass vulnerability found on Windows 11 systems, including Server 2022 and 2025. Windows 10 is not affected. The author describes copying a folder from the Windows Recovery Environment onto a USB stick, or directly into a device's EFI partition, then using a specific key sequence during a Windows 11 reboot to reach a command shell with full access to a Bitlocker protected drive, without needing the encryption password or recovery key. The README walks through the exact reproduction steps: copying the FsTx folder to a USB stick formatted with NTFS, FAT32, or exFAT, holding Shift while clicking restart to enter the recovery environment, then holding Ctrl during the boot sequence. If the steps are followed correctly, an unrestricted shell opens on the protected volume. The author raises a concern about why this happens: the component responsible for the bypass exists inside the Windows Recovery Environment image but not in a normal Windows installation, even though a component with the same name is present there without the same behavior. The author speculates this could be intentional rather than accidental, though this is presented as personal suspicion rather than a confirmed fact. This is not a software tool or application. There is no code to install, no dependencies, and no setup process. It is a short writeup describing a specific vulnerability and the manual steps to trigger it, along with one screenshot showing the resulting shell. The README credits several named parties for making the public disclosure possible, suggesting the finding went through some form of coordinated disclosure process before being shared here. Given the sensitive nature of the content, this repository is best understood as a public vulnerability advisory rather than a piece of software meant to be used, extended, or integrated into other projects.