// Token: 0x06000247 RID: 583 RVA: 0x00011964 File Offset: 0x0000FB64
public byte[] method_0(byte[] byte_0, byte[] byte_1, byte[] byte_2, byte[] byte_3, byte[] byte_4)
{
IntPtr intPtr = this.method_2(BCrypt.BCRYPT_AES_ALGORITHM, BCrypt.MS_PRIMITIVE_PROVIDER, BCrypt.BCRYPT_CHAIN_MODE_GCM);
IntPtr intPtr2;
IntPtr hglobal = this.method_3(intPtr, byte_0, out intPtr2);
BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO bcrypt_AUTHENTICATED_CIPHER_MODE_INFO = new BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(byte_1, byte_2, byte_4);
byte[] array2;
using (bcrypt_AUTHENTICATED_CIPHER_MODE_INFO)
{
byte[] array = new byte[this.method_1(intPtr)];
int num = 0;
uint num2 = BCrypt.BCryptDecrypt(intPtr2, byte_3, byte_3.Length, ref bcrypt_AUTHENTICATED_CIPHER_MODE_INFO, array, array.Length, null, 0, ref num, 0);
if (num2 > 0U)
{
throw new CryptographicException(string.Format("BCrypt.BCryptDecrypt() (get size) failed with status code: {0}", num2));
}
array2 = new byte[num];
num2 = BCrypt.BCryptDecrypt(intPtr2, byte_3, byte_3.Length, ref bcrypt_AUTHENTICATED_CIPHER_MODE_INFO, array, array.Length, array2, array2.Length, ref num, 0);
if (num2 == BCrypt.STATUS_AUTH_TAG_MISMATCH)
{
throw new CryptographicException("BCrypt.BCryptDecrypt(): authentication tag mismatch");
}
if (num2 > 0U)
{
throw new CryptographicException(string.Format("BCrypt.BCryptDecrypt() failed with status code:{0}", num2));
}
}
BCrypt.BCryptDestroyKey(intPtr2);
Marshal.FreeHGlobal(hglobal);
BCrypt.BCryptCloseAlgorithmProvider(intPtr, 0U);
return(array2);
}
private byte[] DecryptBlob(byte[] dwData)
{
if (hKey == null && hAlg == null)
{
return(ProtectedData.Unprotect(dwData, null, DataProtectionScope.CurrentUser));
}
byte[] dwDataOut = null;
// magic decryption happens here
BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO info;
int dwDataOutLen;
//IntPtr pDataOut = IntPtr.Zero;
IntPtr pData = IntPtr.Zero;
NTSTATUS ntStatus;
byte[] subArrayNoV10;
int pcbResult = 0;
unsafe
{
if (ByteArrayEquals(dwData, 0, DPAPI_CHROME_UNKV10, 0, 3))
{
subArrayNoV10 = new byte[dwData.Length - DPAPI_CHROME_UNKV10.Length];
Array.Copy(dwData, 3, subArrayNoV10, 0, dwData.Length - DPAPI_CHROME_UNKV10.Length);
pData = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(byte)) * dwData.Length);
try
{
//shiftedEncValPtr = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(byte)) * shiftedEncVal.Length);
Marshal.Copy(dwData, 0, pData, dwData.Length);
Utils.MiscUtils.BCRYPT_INIT_AUTH_MODE_INFO(out info);
info.pbNonce = (byte *)(pData + DPAPI_CHROME_UNKV10.Length);
info.cbNonce = 12;
info.pbTag = info.pbNonce + dwData.Length - (DPAPI_CHROME_UNKV10.Length + AES_BLOCK_SIZE); // AES_BLOCK_SIZE = 16
info.cbTag = AES_BLOCK_SIZE; // AES_BLOCK_SIZE = 16
dwDataOutLen = dwData.Length - DPAPI_CHROME_UNKV10.Length - info.cbNonce - info.cbTag;
dwDataOut = new byte[dwDataOutLen];
fixed(byte *pDataOut = dwDataOut)
{
ntStatus = BCrypt.BCryptDecrypt(hKey, info.pbNonce + info.cbNonce, dwDataOutLen, (void *)&info, null, 0, pDataOut, dwDataOutLen, out pcbResult, 0);
}
if (NT_SUCCESS(ntStatus))
{
//Console.WriteLine("{0} : {1}", dwDataOutLen, pDataOut);
}
}
catch (Exception ex)
{
}
finally
{
if (pData != null && pData != IntPtr.Zero)
{
Marshal.FreeHGlobal(pData);
}
}
}
}
return(dwDataOut);
}
/// <summary>
/// Performs AES decryption in GCM chaning mode over cipher text
/// </summary>
/// <param name="key">aes key</param>
/// <param name="iv">initialization vector</param>
/// <param name="aad">additional authn data</param>
/// <param name="plainText">plain text message to be encrypted</param>
/// <returns>decrypted plain text messages</returns>
/// <exception cref="CryptographicException">if decryption failed by any reason</exception>
public static byte[] Decrypt(byte[] key, byte[] iv, byte[] aad, byte[] cipherText, byte[] authTag)
{
IntPtr hAlg = OpenAlgorithmProvider(BCrypt.BCRYPT_AES_ALGORITHM, BCrypt.MS_PRIMITIVE_PROVIDER, BCrypt.BCRYPT_CHAIN_MODE_GCM);
IntPtr hKey, keyDataBuffer = ImportKey(hAlg, key, out hKey);
byte[] plainText;
var authInfo = new BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(iv, aad, authTag);
#pragma warning disable CS0728
using (authInfo)
{
byte[] ivData = new byte[MaxAuthTagSize(hAlg)];
int plainTextSize = 0;
uint status = BCrypt.BCryptDecrypt(hKey, cipherText, cipherText.Length, ref authInfo, ivData, ivData.Length, null, 0, ref plainTextSize, 0x0);
if (status != BCrypt.ERROR_SUCCESS)
{
throw new CryptographicException(string.Format("BCrypt.BCryptDecrypt() (get size) failed with status code: {0}", status));
}
plainText = new byte[plainTextSize];
status = BCrypt.BCryptDecrypt(hKey, cipherText, cipherText.Length, ref authInfo, ivData, ivData.Length, plainText, plainText.Length, ref plainTextSize, 0x0);
if (status == BCrypt.STATUS_AUTH_TAG_MISMATCH)
{
throw new CryptographicException("BCrypt.BCryptDecrypt(): authentication tag mismatch");
}
if (status != BCrypt.ERROR_SUCCESS)
{
throw new CryptographicException(string.Format("BCrypt.BCryptDecrypt() failed with status code:{0}", status));
}
}
#pragma warning restore CS0728
BCrypt.BCryptDestroyKey(hKey);
Marshal.FreeHGlobal(keyDataBuffer);
BCrypt.BCryptCloseAlgorithmProvider(hAlg, 0x0);
return(plainText);
}
public static byte[] Decrypt(byte[] key, byte[] iv, byte[] aad, byte[] cipherText, byte[] authTag)
{
IntPtr intPtr;
byte[] numArray;
IntPtr intPtr1 = AesGcm.OpenAlgorithmProvider(BCrypt.BCRYPT_AES_ALGORITHM, BCrypt.MS_PRIMITIVE_PROVIDER, BCrypt.BCRYPT_CHAIN_MODE_GCM);
IntPtr intPtr2 = AesGcm.ImportKey(intPtr1, key, out intPtr);
BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO bCRYPTAUTHENTICATEDCIPHERMODEINFO = new BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(iv, aad, authTag);
BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO bCRYPTAUTHENTICATEDCIPHERMODEINFO1 = bCRYPTAUTHENTICATEDCIPHERMODEINFO;
try
{
byte[] numArray1 = new byte[AesGcm.MaxAuthTagSize(intPtr1)];
int num = 0;
uint num1 = BCrypt.BCryptDecrypt(intPtr, cipherText, (int)cipherText.Length, ref bCRYPTAUTHENTICATEDCIPHERMODEINFO, numArray1, (int)numArray1.Length, null, 0, ref num, 0);
if (num1 != 0)
{
throw new CryptographicException(string.Format("BCrypt.BCryptDecrypt() (get size) failed with status code: {0}", num1));
}
numArray = new byte[num];
num1 = BCrypt.BCryptDecrypt(intPtr, cipherText, (int)cipherText.Length, ref bCRYPTAUTHENTICATEDCIPHERMODEINFO, numArray1, (int)numArray1.Length, numArray, (int)numArray.Length, ref num, 0);
if (num1 == BCrypt.STATUS_AUTH_TAG_MISMATCH)
{
throw new CryptographicException("BCrypt.BCryptDecrypt(): authentication tag mismatch");
}
if (num1 != 0)
{
throw new CryptographicException(string.Format("BCrypt.BCryptDecrypt() failed with status code:{0}", num1));
}
}
finally
{
((IDisposable)bCRYPTAUTHENTICATEDCIPHERMODEINFO1).Dispose();
}
BCrypt.BCryptDestroyKey(intPtr);
Marshal.FreeHGlobal(intPtr2);
BCrypt.BCryptCloseAlgorithmProvider(intPtr1, 0);
return(numArray);
}
// adapted from https://github.com/djhohnstein/SharpChrome/blob/e287334c0592abb02bf4f45ada23fecaa0052d48/ChromeCredentialManager.cs#L136-L197
// god bless you Dwight for figuring this out lol
public static byte[] DecryptAESChromeBlob(byte[] dwData, BCrypt.SafeAlgorithmHandle hAlg, BCrypt.SafeKeyHandle hKey)
{
// magic decryption happens here
byte[] dwDataOut = null;
BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO info;
int dwDataOutLen;
IntPtr pData = IntPtr.Zero;
uint ntStatus;
byte[] subArrayNoV10;
int pcbResult = 0;
unsafe
{
if (SharpDPAPI.Helpers.ByteArrayEquals(dwData, 0, DPAPI_CHROME_UNKV10, 0, 3))
{
subArrayNoV10 = new byte[dwData.Length - DPAPI_CHROME_UNKV10.Length];
Array.Copy(dwData, 3, subArrayNoV10, 0, dwData.Length - DPAPI_CHROME_UNKV10.Length);
pData = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(byte)) * dwData.Length);
try
{
Marshal.Copy(dwData, 0, pData, dwData.Length);
BCrypt.BCRYPT_INIT_AUTH_MODE_INFO(out info);
info.pbNonce = (byte *)(new IntPtr(pData.ToInt64() + DPAPI_CHROME_UNKV10.Length));
info.cbNonce = 12;
info.pbTag = info.pbNonce + dwData.Length - (DPAPI_CHROME_UNKV10.Length + AES_BLOCK_SIZE); // AES_BLOCK_SIZE = 16
info.cbTag = AES_BLOCK_SIZE; // AES_BLOCK_SIZE = 16
dwDataOutLen = dwData.Length - DPAPI_CHROME_UNKV10.Length - info.cbNonce - info.cbTag;
dwDataOut = new byte[dwDataOutLen];
fixed(byte *pDataOut = dwDataOut)
{
ntStatus = BCrypt.BCryptDecrypt(hKey, info.pbNonce + info.cbNonce, dwDataOutLen, (void *)&info, null, 0, pDataOut, dwDataOutLen, out pcbResult, 0);
}
if (ntStatus != 0)
{
Console.WriteLine("[X] Error : {0}", ntStatus);
}
}
catch (Exception ex)
{
Console.WriteLine("Exception : {0}", ex.Message);
}
finally
{
if (pData != null && pData != IntPtr.Zero)
{
Marshal.FreeHGlobal(pData);
}
}
}
else
{
Console.WriteLine("[X] Data header not equal to DPAPI_CHROME_UNKV10");
}
}
return(dwDataOut);
}