I have an app that stores credentials locally, the file is encrypted. I'm trying to understand the encryption that the app is using with the goal of modifying the file directly, bypassing the app.

The app imports quite a few libraries, most of which come from System32, I assume I can get the key or at least some hint by positioning myself between the app and the library.

Naturally, I found out about DLL hijacking. Two of the imports are CRYPT32.dll and ADVAPI32.dll. Even though CRYPT32.dll seems to mostly be certificate stuff I decided to go with it.

I'll skip the part where I also had to learn that there are calls to load strictly from System32, the important thing is that it forced (at least seemingly so) me to rename the import of the app with PE-bear.

I created a C++ DLL project in VS, created a definition file that exports all the functions that the app seeks to import. I also created an executable to test the forwarding.…