0

is it possible to decrypt data which was encrypted with MS DPAPI? For example i want to decrypt a digital certificate from the windows registry.

byte[] byteArray = (byte[]) Advapi32Util.registryGetValue(WinReg.HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\02FAF3E291435468607857694DF5E45B68851868", "Blob");

byte[] decrypted = Crypt32Util.cryptUnprotectData(byteArray);

String stringDecrypted = new String(decrypted);
System.out.println(stringDecrypted);

But i get an Win32 Exception: Exception in thread "main" com.sun.jna.platform.win32.Win32Exception: Data are invalid.

I don't found any information about this Exception. So what das this mean?? And could i decrypt these files like i want it or is it not possible?

Thnaks for help!

Opa114
  • 518
  • 4
  • 12
  • 28

1 Answers1

1

According to the MSDN documentation, you're missing six additional arguments to cryptUnprotectData.

Even if these arguments are marked "optional", you still need to declare them in your interface method signature.

UPDATE

Based on the MSDN documentation:

BOOL WINAPI CryptUnprotectData(
  _In_        DATA_BLOB *pDataIn,
  _Out_opt_   LPWSTR *ppszDataDescr,
  _In_opt_    DATA_BLOB *pOptionalEntropy,
  _Reserved_  PVOID pvReserved,
  _In_opt_    CRYPTPROTECT_PROMPTSTRUCT *pPromptStruct,
  _In_        DWORD dwFlags,
  _Out_       DATA_BLOB *pDataOut
);

The second, third, fourth, and fifth arguments can probably be null. The sixth argument can probably be zero. The final argument needs to be an appropriately allocated DATA_BLOB where the function can store its results (this structure is defined in JNA's platform.jar). Don't forget to free the DATA_BLOB's pbData field when you're done with it, passing its value to LocalFree.

technomage
  • 9,861
  • 2
  • 26
  • 40
  • and what are the exact arguments i need to add. i think the arguments must be the ones that uses DPAPI to encrypt the data. but i found no information what exact parameters they use. so it's a little bit hard to find out the arguments i need – Opa114 Dec 04 '14 at 12:52
  • the probelem is that the JNA function cryptUnprotectData() only accept these arguments: byte[] data OR byte[] data, byte[] entropy, int flags, WinCrypt.CRYPTPROTECT_PROMPTSTRUCT prompt OR byte[] data, int flags see here (https://jna.java.net/javadoc/platform/com/sun/jna/platform/win32/Crypt32Util.html) so i don't know which values i have to set there :( – Opa114 Dec 04 '14 at 18:11
  • According to [the latest on github, `cryptUnprotectData()`](https://github.com/twall/jna/blob/master/contrib/platform/src/com/sun/jna/platform/win32/Crypt32.java#L72-L112) matches the docs on MSDN. `jna.java.net` has not been used in years. – technomage Dec 04 '14 at 19:52
  • Are you able to unprotect the data using just native code? – technomage Dec 04 '14 at 19:56
  • i see one difference between my usage and yours: i used Crypt32Util you refer to Crypt32 only. But Crypt32 is only an interface. so i have to implement it by myself or i'm wrong? i'm not the best programmer :( What do you mena exactly with: i'm able to unprotect the data just native code? – Opa114 Dec 04 '14 at 21:02
  • No, you don't have to implement yourself. Crypt32Util uses Crypt32; the interface provides a structure that JNA then maps onto a native library with `Native.loadLibrary()`. The author of Crypt32Util just provided a few shortcuts against the native library definition. – technomage Dec 04 '14 at 22:16
  • okay, but in CryptUtil32 i don't have all the parameters which are given in Crypt32 – Opa114 Dec 06 '14 at 11:17