0

There are some files (drivers) that are encrypted, and these files are working in a program that is installed in my computer. The program using these files needs to decrypt them. I am sure that the private key and passphrase are stored inside the program in my computer. Meanwhile, there is no file for the private key! Everything is stored inside the program. I know that the program for decrypting those files is using OpenSSL libraries (Libeay32.dll).

Q: How can I capture the passphrase and private key that are stored in the program?

1

First of all, it is quite unlikely that the key has a passphrase. Passphrases are used to defend against stolen key assets, but since the key asset is embedded inside the program together with any passphrase, this is redundant. Therefore I will not assume there's a passphrase.

Now, to your main question. libeay32.dll exports many encryption related functions, and those are presumably used by said program. Without any more specifics, I'd suggest you search for the functions imported into the program from libeay32.dll.

Depending on the algorithm used (my first bet would be AES) to decrypt the files, several different functions will be called. The one you're interested in, that loads / initializes a key, a common such API is EVP_CIPHER_CTX_new which allocates a new symmetric encryption/decryption context, which will then be used in a function such as EVP_DecryptInit or EVP_DecryptInit_ex which will actually accept the key and iv parameters.

Without reviewing the APIs imported, it is quite hard to list the possible key-initialization functions you may be looking for. For example, EVP_PKEY_decrypt_init will be an equivalent function used for public key decryption (which could also be used in your case, if for some reason author decided to use asymmetric cryptography).

Once you identify the key initialization function, this should be a matter of tracking the values put into the key and iv parameters. A hardcoded string will be easy to find while a more complex key-generation flow (maybe using a hash function?) could be used. In the case of file decryption, it is unlikely that the key is not deterministic so it should be easy enough.

If you wish to manually decrypt the files, there are other important parameters except the key and iv. The encryption algorithm, mode of operation, block size, etc...

  • Thanks, the problem is that it is not clear which function is used for decryption ? there are more than 4000 function inside of the Libeay32.dll for using encryption and decryption ! – jig4r Oct 4 '18 at 15:36
  • How many of those are imported by your binary? – NirIzr Oct 4 '18 at 15:38
  • dear nirizr, It seems none of functions are used for decryption! when the program wants to run the libeay32.dll is needed but after that I removed the Dll and program still is working well. – jig4r Oct 17 '18 at 12:42
  • What do you mean by "removed the dll"? What functions are being used? You'll need to go over them and use common sense. – NirIzr Oct 17 '18 at 18:47
  • I mean how I can find a Function which is reading Private key and Passphrase ? after running my Program, I delete libeay32.dll to find out if my program is using libeay32.dll or not ? I figure out It works without libeay32.dll ! Any way my problem is to find out which function, read the private key and passphrase ? tnx for replying – jig4r Oct 18 '18 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.