Handler for crypt32!CryptDecryptMessage. More...

#include <CryptDecryptMessage.hh>

Inheritance diagram for introvirt::windows::crypt32::CryptDecryptMessage:

[legend]

Collaboration diagram for introvirt::windows::crypt32::CryptDecryptMessage:

[legend]

Public Member Functions
guest_ptr< void >	pDecryptPara () const

void	pDecryptPara (const guest_ptr< void > &pDecryptPara)

std::shared_ptr< CRYPT_DECRYPT_MESSAGE_PARA >	DecryptPara ()

guest_ptr< uint8_t[]>	pbEncryptedBlob () const

void	pbEncryptedBlob (const guest_ptr< uint8_t[]> &pbEncryptedBlob)

uint32_t	cbEncryptedBlob () const

void	cbEncryptedBlob (uint32_t cbEncryptedBlob)

guest_ptr< uint8_t[]>	pbDecrypted () const

void	pbDecrypted (const guest_ptr< uint8_t[]> &pbDecrypted)

guest_ptr< uint32_t >	pcbDecrypted () const

void	pcbDecrypted (const guest_ptr< uint32_t > &pcbDecrypted)

guest_ptr< void *, guest_ptr_t >	ppXchgCert () const

void	ppXchgCert (const guest_ptr< void > &ppXchgCert)

std::shared_ptr< CERT_CONTEXT >	XchgCert ()

const std::string &	function_name () const override
	Get the function name.

const std::string &	library_name () const override
	Get the name of the library this call is for.

void	write (std::ostream &os=std::cout) const override
	Write out a textual representation of the function for display.

Json::Value	json () const override
	Get the function as Json.

bool	result () const

void	result (bool result)

	CryptDecryptMessage (Event &event)

	~CryptDecryptMessage () override

Public Member Functions inherited from introvirt::windows::WindowsFunctionCall
guest_ptr< void >	return_address () const override
	Get the return address for this function call.

void	return_address (const guest_ptr< void > &value) override
	Set the return address for this function call.

bool	is_return_event (Event &event) const override
	Check if the given event is a return event for this function call.

void	handle_return (Event &event) override
	Handle the return event.

bool	returned () const override
	Check if the call has returned.

bool	x64 () const
	Check if the call is from x64 mode.hh>

virtual	~WindowsFunctionCall ()

Public Member Functions inherited from introvirt::FunctionCall
bool	hook_return () const
	Check if the user is requesting that the return be intercepted.

void	hook_return (bool val)
	Configure if the return should be intercepted.

void	data (const std::string &key, const std::shared_ptr< void > &value)
	Store arbitrary data with the FunctionCall.

void	data (const std::string &key, std::shared_ptr< void > &&value)
	Store arbitrary data with the FunctionCall.

std::shared_ptr< void >	data (const std::string &key)
	Retrieve arbitrary data stored with the FunctionCall.

std::shared_ptr< const void >	data (const std::string &key) const
	Retrieve arbitrary data stored with the FunctionCall.

virtual	~FunctionCall ()=default

Static Public Member Functions
static bool	inject (const guest_ptr< void > &pDecryptPara, const guest_ptr< uint8_t[]> &pbEncryptedBlob, uint32_t cbEncryptedBlob, const guest_ptr< uint8_t[]> &pbDecrypted, const guest_ptr< uint32_t > &pcbDecrypted, const guest_ptr< void *, guest_ptr_t > &ppXchgCert)

Static Public Attributes
static constexpr int	ArgumentCount = 6

static const std::string	LibraryName = "crypt32"

static const std::string	FunctionName = "CryptDecryptMessage"

Additional Inherited Members
Protected Member Functions inherited from introvirt::windows::WindowsFunctionCall
uint64_t	raw_return_value () const

void	raw_return_value (uint64_t value)

uint64_t	get_argument (unsigned int index) const

void	set_argument (unsigned int index, uint64_t value)

guest_ptr< void >	get_address_argument (unsigned int index) const

void	set_address_argument (unsigned int index, const guest_ptr< void > &address)

Vcpu &	vcpu ()

const Vcpu &	vcpu () const

	WindowsFunctionCall (Event &event, unsigned int argument_count, WindowsCallType type=WindowsCallType::AUTO)

Detailed Description

Handler for crypt32!CryptDecryptMessage.

See also: https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptdecryptmessage

Constructor & Destructor Documentation

◆ CryptDecryptMessage()

introvirt::windows::crypt32::CryptDecryptMessage::CryptDecryptMessage ( Event & event )

◆ ~CryptDecryptMessage()

introvirt::windows::crypt32::CryptDecryptMessage::~CryptDecryptMessage ( )

override

Member Function Documentation

◆ cbEncryptedBlob() [1/2]

uint32_t introvirt::windows::crypt32::CryptDecryptMessage::cbEncryptedBlob ( ) const

◆ cbEncryptedBlob() [2/2]

void introvirt::windows::crypt32::CryptDecryptMessage::cbEncryptedBlob ( uint32_t cbEncryptedBlob )

◆ DecryptPara()

std::shared_ptr< CRYPT_DECRYPT_MESSAGE_PARA > introvirt::windows::crypt32::CryptDecryptMessage::DecryptPara ( )

◆ function_name()

const std::string & introvirt::windows::crypt32::CryptDecryptMessage::function_name ( ) const

overridevirtual

Get the function name.

Returns: const std::string&

Implements introvirt::FunctionCall.

◆ inject()

static bool introvirt::windows::crypt32::CryptDecryptMessage::inject	(	const guest_ptr< void > &	pDecryptPara,
		const guest_ptr< uint8_t[]> &	pbEncryptedBlob,
		uint32_t	cbEncryptedBlob,
		const guest_ptr< uint8_t[]> &	pbDecrypted,
		const guest_ptr< uint32_t > &	pcbDecrypted,
		const guest_ptr< void *, guest_ptr_t > &	ppXchgCert
	)

static

◆ json()

Json::Value introvirt::windows::crypt32::CryptDecryptMessage::json ( ) const

overridevirtual

Get the function as Json.

Returns: Json::Value

Implements introvirt::FunctionCall.

◆ library_name()

const std::string & introvirt::windows::crypt32::CryptDecryptMessage::library_name ( ) const

overridevirtual

Get the name of the library this call is for.

Returns: const std::string&

Implements introvirt::FunctionCall.

◆ pbDecrypted() [1/2]

guest_ptr< uint8_t[]> introvirt::windows::crypt32::CryptDecryptMessage::pbDecrypted ( ) const

◆ pbDecrypted() [2/2]

void introvirt::windows::crypt32::CryptDecryptMessage::pbDecrypted ( const guest_ptr< uint8_t[]> & pbDecrypted )

◆ pbEncryptedBlob() [1/2]

guest_ptr< uint8_t[]> introvirt::windows::crypt32::CryptDecryptMessage::pbEncryptedBlob ( ) const

◆ pbEncryptedBlob() [2/2]

void introvirt::windows::crypt32::CryptDecryptMessage::pbEncryptedBlob ( const guest_ptr< uint8_t[]> & pbEncryptedBlob )

◆ pcbDecrypted() [1/2]

guest_ptr< uint32_t > introvirt::windows::crypt32::CryptDecryptMessage::pcbDecrypted ( ) const

◆ pcbDecrypted() [2/2]

void introvirt::windows::crypt32::CryptDecryptMessage::pcbDecrypted ( const guest_ptr< uint32_t > & pcbDecrypted )

◆ pDecryptPara() [1/2]

guest_ptr< void > introvirt::windows::crypt32::CryptDecryptMessage::pDecryptPara ( ) const

◆ pDecryptPara() [2/2]

void introvirt::windows::crypt32::CryptDecryptMessage::pDecryptPara ( const guest_ptr< void > & pDecryptPara )

◆ ppXchgCert() [1/2]

guest_ptr< void *, guest_ptr_t > introvirt::windows::crypt32::CryptDecryptMessage::ppXchgCert ( ) const

◆ ppXchgCert() [2/2]

void introvirt::windows::crypt32::CryptDecryptMessage::ppXchgCert ( const guest_ptr< void > & ppXchgCert )

◆ result() [1/2]

bool introvirt::windows::crypt32::CryptDecryptMessage::result ( ) const

◆ result() [2/2]

void introvirt::windows::crypt32::CryptDecryptMessage::result ( bool result )

◆ write()

void introvirt::windows::crypt32::CryptDecryptMessage::write ( std::ostream & os = std::cout ) const

overridevirtual

Write out a textual representation of the function for display.

Parameters

os

Implements introvirt::FunctionCall.

◆ XchgCert()

std::shared_ptr< CERT_CONTEXT > introvirt::windows::crypt32::CryptDecryptMessage::XchgCert ( )

Member Data Documentation

◆ ArgumentCount

constexpr int introvirt::windows::crypt32::CryptDecryptMessage::ArgumentCount = 6

staticconstexpr

◆ FunctionName

const std::string introvirt::windows::crypt32::CryptDecryptMessage::FunctionName = "CryptDecryptMessage"

inlinestatic

◆ LibraryName

const std::string introvirt::windows::crypt32::CryptDecryptMessage::LibraryName = "crypt32"

inlinestatic

The documentation for this class was generated from the following file:

/home/runner/work/IntroVirt/IntroVirt/include/introvirt/windows/libraries/crypt32/functions/CryptDecryptMessage.hh

Public Member Functions

Static Public Member Functions

Static Public Attributes

Additional Inherited Members

Detailed Description

Constructor & Destructor Documentation

◆ CryptDecryptMessage()

◆ ~CryptDecryptMessage()

Member Function Documentation

◆ cbEncryptedBlob() [1/2]

◆ cbEncryptedBlob() [2/2]

◆ DecryptPara()

◆ function_name()

◆ inject()

◆ json()

◆ library_name()

◆ pbDecrypted() [1/2]

◆ pbDecrypted() [2/2]

◆ pbEncryptedBlob() [1/2]

◆ pbEncryptedBlob() [2/2]

◆ pcbDecrypted() [1/2]

◆ pcbDecrypted() [2/2]

◆ pDecryptPara() [1/2]

◆ pDecryptPara() [2/2]

◆ ppXchgCert() [1/2]

◆ ppXchgCert() [2/2]

◆ result() [1/2]

◆ result() [2/2]

◆ write()

◆ XchgCert()

Member Data Documentation

◆ ArgumentCount

◆ FunctionName

◆ LibraryName