dissect.target.plugins.os.windows.dpapi.blob

Module Contents

Classes

Blob	Represents a DPAPI blob.

Attributes

blob_def
c_blob

dissect.target.plugins.os.windows.dpapi.blob.blob_def = Multiline-String

Show Value

"""
struct DPAPIBlob {
    DWORD   dwVersion;
    char    provider[16];
    DWORD   mkVersion;
    char    guid[16];
    DWORD   flags;
    DWORD   descriptionLength;
    char    description[descriptionLength];
    DWORD   CipherAlgId;
    DWORD   keyLen;
    DWORD   saltLength;
    char    salt[saltLength];
    DWORD   strongLength;
    char    strong[strongLength];
    DWORD   CryptAlgId;
    DWORD   hashLen;
    DWORD   hmacLength;
    char    hmac[hmacLength];
    DWORD   cipherTextLength;
    char    cipherText[cipherTextLength];
    DWORD   signLength;
    char    sign[signLength];
};
"""

dissect.target.plugins.os.windows.dpapi.blob.c_blob

class dissect.target.plugins.os.windows.dpapi.blob.Blob(data: bytes)

Represents a DPAPI blob.

version

provider = ''

mkversion

guid = ''

flags

description

cipher_algorithm

key_len

salt

strong

hash_algorithm

hash_len

hmac

cipher_text

blob

sign

clear_text = None

decrypted = False

sign_computed = None

decrypt(master_key: bytes, entropy: bytes | None = None, strong_password: str | None = None, smart_card_secret: bytes | None = None) → bool

Try to decrypt the blob with the given master key.

Parameters:

• master_key – Decrypted master key value.

• entropy – Optional entropy for decrypting the blob.

• strong_password – Optional password for decrypting the blob.

• smart_card_secret – MS Next Gen Crypto secret (e.g. from PIN code).

Returns:

True if decryption is succesful, False otherwise.

__repr__() → str