Skip to content

Instantly share code, notes, and snippets.

@postworthy
Created November 8, 2023 18:12
Show Gist options
  • Save postworthy/dc25ba772a9b4a1151d620cbf0b48c15 to your computer and use it in GitHub Desktop.
Save postworthy/dc25ba772a9b4a1151d620cbf0b48c15 to your computer and use it in GitHub Desktop.
A simple c program that takes a base64 encoded string containing data protected with CryptProtectData and calls CryptUnprotectData on it
/*
* To build run the following commands (ensure that the path to vcvars64.bat matches with your build environment)
* call "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
* cl /EHsc unprotect.c /link Advapi32.lib Crypt32.lib
*/
#include <windows.h>
#include <wincrypt.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void base64_decode(char* input, BYTE** output, DWORD* outputSize) {
DWORD decodedSize;
CryptStringToBinaryA(input, 0, CRYPT_STRING_BASE64, NULL, &decodedSize, NULL, NULL);
*output = (BYTE*)malloc(decodedSize);
CryptStringToBinaryA(input, 0, CRYPT_STRING_BASE64, *output, &decodedSize, NULL, NULL);
*outputSize = decodedSize;
}
int main(int argc, char *argv[]) {
if (argc != 2) {
printf("Usage: %s base64_encoded_data\n", argv[0]);
return 1;
}
BYTE* base64DecodedData;
DWORD base64DecodedSize;
// Decode base64 encoded data
base64_decode(argv[1], &base64DecodedData, &base64DecodedSize);
DATA_BLOB input;
DATA_BLOB output;
// Initialize input data
input.pbData = base64DecodedData;
input.cbData = base64DecodedSize;
BOOL result = CryptUnprotectData(&input, NULL, NULL, NULL, NULL, 0, &output);
if (result) {
printf("Decryption successful!\n");
// The decrypted data is in the output structure
printf("Decrypted Data: %.*s\n", output.cbData, (char*)output.pbData);
// Clean up the output data
LocalFree(output.pbData);
} else {
printf("Decryption failed. Error code: %d\n", GetLastError());
}
// Clean up the base64 decoded data
free(base64DecodedData);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment