Deciphering method and system of data protection application programming interface (DPAPI) enciphered data

Abstract

The invention provides a deciphering method and system of data protection application programming interface (DPAPI) enciphered data. The method comprises the following steps: loading a device, wherein a data source is in the device, identifying a system partition from the data source and reading files in the system partition, wherein the Windows system is in the system partition, acquiring files which need to be deciphered and master key files of all users, acquiring all DPAPI enciphered blocks from the files which need to be deciphered, analyzing all the DPAPI enciphered blocks to acquire the first deciphering key information which comprises encipherment secret key unique identification, acquiring the master key files of each DPAPI enciphered block according to the encipherment secret key unique identification, analyzing the master key files to acquire the second deciphering key information which comprises a second annoyance value and a second secret key derive function iteration based on commands, and deciphering the DPAPI enciphered blocks according to a login password, system entropy parameters, the first deciphering key information and the second deciphering key information. The method and the system can achieve read only operation of the data source and meet the need of cross-platform without restriction of operating system.

Description

technical field [0001] The present invention relates to a data decryption method and system, in particular, to a decryption method and a decryption system for DPAPI encrypted data. Background technique [0002] Microsoft has introduced an easy-to-use application data protection interface (Data Protect Application-Programming Interface, DPAPI) since Windows 2000, which is used to provide system-level data protection for user programs and operating systems. In the Windows system, various private data such as wireless network passwords, Internet access passwords, and private keys of encrypted file systems are all encrypted and stored with DPAPI. However, the encryption mechanism of DPAPI is extremely complicated, and Microsoft has never disclosed any technical details about DPAPI. Therefore, , it is very difficult to understand the internal implementation mechanism of DPAPI. [0003] At present, no one in China has studied the offline decryption method of DPAPI, and there are...

AI Technical Summary

Problems solved by technology

This forensics method directly depends on the operating system of the target source, and it is likely to pollute the data of the target source during the operation of the operating system, and cannot meet the read-only requirements of the target data source.

Although some software in foreign countries can realize the offline decryption of DPAPI, they are all realized by directly calling the encryption application programming interface (CryptoAPI), and have not analyzed and implemented the internal algorithm of the CryptoAPI interface, because CryptoAPI directly depends on the Windows operating system Moreover, different operating systems support different security functions, which makes these software unable to meet the cross-platform requirements, and even cannot be decrypted normally on some versions of Windows systems.

Images