Default encrypt algo is now AES256_CBC + Fix import_pfx default flags to be able to use it for AES256_CBC simply

samples/crypto/encryption_demo.py

@@ -1,4 +1,6 @@
 import argparse
+import getpass
+
 import windows.crypto as crypto
 from windows import winproxy
 from windows.generated_def import *
@@ -23,6 +25,8 @@ def crypt(src, dst, certs, **kwargs):
 def decrypt(src, pfxfile, password, outfile=None, **kwargs):
     """Decrypt the content of 'src' with the private key in 'pfxfile'. the 'pfxfile' is open using the 'password'"""
     # Open the 'pfx' with the given password
+    if password is None:
+        password = getpass.getpass()
     pfx = crypto.import_pfx(pfxfile.read(), password)
     # Decrypt the content of the file
     decrypted = crypto.decrypt(pfx, src.read())
@@ -95,6 +99,8 @@ def genkeys(common_name, pfxpassword, outname, keysize=2048, **kwargs):
 ## Read pfx info !!!! PRINT PRIVATE KEY !!!!
 ### openssl pkcs12 -info -in {pfx} -nodes
 
+## Read ASN1 data
+### openssl asn1parse -inform DER -in {file}
 
 
 parser = argparse.ArgumentParser(prog=__file__)
@@ -112,7 +118,7 @@ decryptparse = subparsers.add_parser('decrypt')
 decryptparse.set_defaults(func=decrypt)
 decryptparse.add_argument('src', type=argparse.FileType('rb'), help='File to decrypt')
 decryptparse.add_argument('pfxfile', type=argparse.FileType('rb'), help='PFX file to use')
-decryptparse.add_argument('password', help='Password of the PFX')
+decryptparse.add_argument('--password', help='Password of the PFX')
 decryptparse.add_argument('--outfile', default=None, help='The outputfile default is print')
 
 genkeysparse = subparsers.add_parser('genkey')

samples/find_value.py

@@ -32,7 +32,7 @@ def search_name_in_struct(target):
 def search_name_in_windef(target):
     for name, windef in meta.windef_walker():
         if match(target, name):
-            print(windef)
+            print(repr(windef))
 
 def search_name_in_interface(target):
     for name, interface in meta.interfaces_walker():

windows/crypto/certificate.py

@@ -158,7 +158,18 @@ class EHCERTSTORE(gdef.HCERTSTORE):
 
 # PKCS12_NO_PERSIST_KEY -> do not save it in a key container on disk
 # Without it, a key container is created at 'C:\Users\USERNAME\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3241049326-165485355-1070449050-1001'
-def import_pfx(pfx, password=None, flags=gdef.CRYPT_USER_KEYSET | gdef.PKCS12_NO_PERSIST_KEY):
+# More about this:
+# If you use 'PKCS12_NO_PERSIST_KEY' the key are indeed NOT STORED but there is a problem
+# If you use an algo like 'szOID_NIST_AES256_CBC' the function 'CryptDecryptMessage' won't be able to decrypt the message
+# Unless you also specify the 'PKCS12_ALWAYS_CNG_KSP' flags.
+
+# My guess: somewhere 'CryptDecryptMessage' ask for each (CNG_KSP | CSP ?) to try to decrypt with the keys
+# BUT: as we DID NOT EXPORT the keys, they are not able to get the key from memory and expect them on disk.
+# By forcing PKCS12_ALWAYS_CNG_KSP we remove this as the key are directly linked to the correct CNG_KSP in the CertStore
+# Look like it's based on this part of the PFX:
+# Microsoft CSP Name: Microsoft Enhanced Cryptographic Provider v1.0
+
+def import_pfx(pfx, password=None, flags=gdef.CRYPT_USER_KEYSET | gdef.PKCS12_NO_PERSIST_KEY | gdef.PKCS12_ALWAYS_CNG_KSP):
     """Import the file ``pfx`` with the ``password``.
 
     ``default flags = PKCS12_NO_PERSIST_KEY | CRYPT_USER_KEYSET``.

windows/crypto/encrypt_decrypt.py

@@ -28,7 +28,7 @@ class GenerateInitVector(object):
 geninitvector = GenerateInitVector()
 
 
-def encrypt(cert_or_certlist, msg, algo=szOID_RSA_DES_EDE3_CBC, initvector=geninitvector):
+def encrypt(cert_or_certlist, msg, algo=szOID_NIST_AES256_CBC, initvector=geninitvector):
     """Encrypt ``msg`` with the certificate(s) in ``cert_or_certlist`` using ``algo`` with the initial
        vector ``initvector``.