Jump to content

Recommended Posts

Hi everyone, I created a function to gather bitlocker information. It can tell you whether or not a drive is protected, which encryption method is being used, ...

I tried to cover all the details in the function description

 

The function (and 3 "internal" functions) :

; #FUNCTION# ====================================================================================================================
; Name...........: _BitlockerDriveInfo
; Description ...: Get Bitlocker information for one or multiple drives
; Syntax.........: _BitlockerDriveInfo([$sDrive[, $sComputer = @ComputerName[, $bDebug = False]]])
; Parameters ....: $sDrive  - Optional: The drive. Allowed values are:
;                  |""      - Get the info for all available drives
;                  |Letter: - Get the info for the specific drive
;                  $sComputer - Optional: The computer from which the info should be requested
;                  $bDebug  - Optional: Shows the hex ReturnValue from the WMI methods if set to True
; Return values .: Success  - Returns a 2D array with the following information
;                  |[string] Drive Letter
;                  |[string] Drive Label
;                  |[string] Volume Type
;                  |[bool]   Initialized For Protection
;                  |[string] Protection Status
;                  |[string] Lock Status
;                  |[bool]   Auto Unlock Enabled
;                  |[bool]   Auto Unlock Key Stored
;                  |[string] Conversion Status
;                  |[string] Encryption Method
;                  |[int]    Encryption Percentage
;                  |[string] Wiping Status
;                  |[int]    Wiping Percentage
;                  |[array]  Key Protectors (Or [string] "None" if the drive isn't protected)
;                  Failure  - 0, sets @error to:
;                  |1 - There was an issue retrieving the COM object. @extended returns error code from ObjGet
;                  |2 - The specified drive in $Drive doesn't exist
;                  |3 - There was an issue running the WMI query
; Author ........: colombeen
; Modified.......:
; Remarks .......: Requires to be run with admin elevation. Windows Vista or newer!
;                  A BIG THANKS to everyone from the community who contributed!
; Related .......:
; Link ..........:
; Example .......: #include <Array.au3>
;                  $Header = "Drive Letter|Drive Label|Volume Type|Initialized For Protection|Protection Status|" & _
;                            "Lock Status|Auto Unlock Enabled|Auto Unlock Key Stored|Conversion Status|Encryption " & _
;                            "Method|Encryption Percentage|Wiping Status|Wiping Percentage|Key Protectors"
;                  _ArrayDisplay(_BitlockerDriveInfo(), "Bitlocker Drive Info", "", 64, Default, $Header)
; ===============================================================================================================================
Func _BitlockerDriveInfo($sDrive = "", $sComputer = @ComputerName, $bDebug = False)
    Local $aConversionStatusMsg[7]  =   ["Unknown", "Fully Decrypted", "Fully Encrypted", "Encryption In Progress", "Decryption In Progress", "Encryption Paused", "Decryption Paused"]
    Local $aEncryptionMethodMsg[9]  =   ["Unknown", "None", "AES_128_WITH_DIFFUSER", "AES_256_WITH_DIFFUSER", "AES_128", "AES_256", "HARDWARE_ENCRYPTION", "XTS_AES_128", "XTS_AES_256"]
    Local $aKeyProtectorTypeMsg[11] =   ["Unknown or other protector type", "Trusted Platform Module (TPM)", "External key", "Numerical password", "TPM And PIN", "TPM And Startup Key", "TPM And PIN And Startup Key", "Public Key", "Passphrase", "TPM Certificate", "CryptoAPI Next Generation (CNG) Protector"]
    Local $aLockStatusMsg[3]        =   ["Unknown", "Unlocked", "Locked"]
    Local $aProtectionStatusMsg[3]  =   ["Unprotected", "Protected", "Unknown"]
    Local $aVolumeTypeMsg[3]        =   ["Operating System Volume", "Fixed Data Volume", "Portable Data Volume"]
    Local $aWipingStatusMsg[5]      =   ["Unknown", "Free Space Not Wiped", "Free Space Wiped", "Free Space Wiping In Progress", "Free Space Wiping Paused"]
    Local $iRow                     =   0
    Local $sRunMethod, $objWMIService, $objWMIQuery, $sDriveFilter, $iProtectionStatus, $iLockStatus, $bIsAutoUnlockEnabled, $bIsAutoUnlockKeyStored, $iConversionStatus, $iEncryptionPercentage, $iEncryptionFlags, $iWipingStatus, $iWipingPercentage, $iEncryptionMethod, $aVolumeKeyProtectorID, $aVolumeKeyProtectors, $iKeyProtectorType

    $objWMIService = ObjGet("winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" & $sComputer & "\root\CIMV2\Security\MicrosoftVolumeEncryption")
    If @error Then Return SetError(1, @error, 0)

    If $sDrive <> "" Then
        Local $iDriveType = _WMIPropertyValue("DriveType", "Win32_LogicalDisk", "WHERE DeviceID='" & $sDrive & "'", Default, $sComputer)
        If @error Or ($iDriveType <> 2 And $iDriveType <> 3) Then Return SetError(2, 0, 0)
        $sDriveFilter = " WHERE DriveLetter='" & $sDrive & "'"
    EndIf

    $objWMIQuery = $objWMIService.ExecQuery("SELECT * FROM Win32_EncryptableVolume" & $sDriveFilter, "WQL", 0)
    If Not IsObj($objWMIQuery) Then Return SetError(3, 0, 0)

    Local $aResult[$objWMIQuery.count][14]
    For $objDrive In $objWMIQuery
        If $bDebug Then ConsoleWrite(@CRLF & "+> " & $objDrive.DriveLetter & @CRLF)
        If _WMIMethodExists($objDrive, "GetConversionStatus") Then
            $sRunMethod = $objDrive.GetConversionStatus($iConversionStatus, $iEncryptionPercentage, $iEncryptionFlags, $iWipingStatus, $iWipingPercentage)
            If $bDebug Then ConsoleWrite("!> GetConversionStatus    0x" & Hex($sRunMethod) & @CRLF)
        Else
            $iConversionStatus      =   -1
            $iWipingStatus          =   -1
            $iEncryptionPercentage  =   0
            $iWipingPercentage      =   0
        EndIf
        If _WMIMethodExists($objDrive, "GetEncryptionMethod") Then
            $sRunMethod = $objDrive.GetEncryptionMethod($iEncryptionMethod)
            If $bDebug Then ConsoleWrite("!> GetEncryptionMethod    0x" & Hex($sRunMethod) & @CRLF)
        Else
            $iEncryptionMethod      =   0
        EndIf
        If _WMIMethodExists($objDrive, "GetKeyProtectors") Then
            $sRunMethod = $objDrive.GetKeyProtectors("0", $aVolumeKeyProtectorID)
            If $bDebug Then ConsoleWrite("!> GetKeyProtectors       0x" & Hex($sRunMethod) & @CRLF)
        Else
            $aVolumeKeyProtectorID  =   0
        EndIf
        If _WMIMethodExists($objDrive, "GetLockStatus") Then
            $sRunMethod = $objDrive.GetLockStatus($iLockStatus)
            If $bDebug Then ConsoleWrite("!> GetLockStatus          0x" & Hex($sRunMethod) & @CRLF)
        Else
            $iLockStatus            =   -1
        EndIf
        If _WMIMethodExists($objDrive, "GetProtectionStatus") Then
            $sRunMethod = $objDrive.GetProtectionStatus($iProtectionStatus)
            If $bDebug Then ConsoleWrite("!> GetProtectionStatus    0x" & Hex($sRunMethod) & @CRLF)
        Else
            $iProtectionStatus      =   2
        EndIf
        If _WMIMethodExists($objDrive, "IsAutoUnlockEnabled") Then
            $sRunMethod = $objDrive.IsAutoUnlockEnabled($bIsAutoUnlockEnabled)
            If $bDebug Then ConsoleWrite("!> IsAutoUnlockEnabled    0x" & Hex($sRunMethod) & @CRLF)
        Else
            $bIsAutoUnlockEnabled   =   "Unknown"
        EndIf
        If _WMIMethodExists($objDrive, "IsAutoUnlockKeyStored") Then
            $sRunMethod = $objDrive.IsAutoUnlockKeyStored($bIsAutoUnlockKeyStored)
            If $bDebug Then ConsoleWrite("!> IsAutoUnlockKeyStored  0x" & Hex($sRunMethod) & @CRLF)
        Else
            $bIsAutoUnlockKeyStored =   "Unknown"
        EndIf

        If IsArray($aVolumeKeyProtectorID) And UBound($aVolumeKeyProtectorID) > 0 Then
            Dim $aVolumeKeyProtectors[UBound($aVolumeKeyProtectorID)][2]

            For $i = 0 To UBound($aVolumeKeyProtectorID) - 1
                $aVolumeKeyProtectors[$i][0]        =   $aVolumeKeyProtectorID[$i]
                If _WMIMethodExists($objDrive, "GetKeyProtectorType") Then
                    If $objDrive.GetKeyProtectorType($aVolumeKeyProtectorID[$i], $iKeyProtectorType) = 0 Then
                        $aVolumeKeyProtectors[$i][1]=   $aKeyProtectorTypeMsg[$iKeyProtectorType]
                    Else
                        $aVolumeKeyProtectors[$i][1]=   "Unknown"
                    EndIf
                Else
                    $aVolumeKeyProtectors[$i][1]    =   "Unknown"
                EndIf
            Next
        Else
            $aVolumeKeyProtectors                   =   "None"
        EndIf

        ; DriveLetter
        $aResult[$iRow][0]      =   $objDrive.DriveLetter
        ; DriveLabel
        $aResult[$iRow][1]      =   _WMIPropertyValue("VolumeName", "Win32_LogicalDisk", "WHERE DeviceID='" & $objDrive.DriveLetter & "'", Default, $sComputer)
        ; VolumeType
        If _WMIPropertyExists($objDrive, "VolumeType") Then
            $aResult[$iRow][2]  =   $aVolumeTypeMsg[$objDrive.VolumeType]
        Else
            If $objDrive.DriveLetter = _WMIPropertyValue("SystemDrive", "Win32_OperatingSystem", "", Default, $sComputer) Then
                $aResult[$iRow][2]= $aVolumeTypeMsg[0]
            ElseIf _WMIPropertyValue("DriveType", "Win32_LogicalDisk", "WHERE DeviceID='" & $objDrive.DriveLetter & "'", Default, $sComputer) = 3 Then
                $aResult[$iRow][2]= $aVolumeTypeMsg[1]
            ElseIf _WMIPropertyValue("DriveType", "Win32_LogicalDisk", "WHERE DeviceID='" & $objDrive.DriveLetter & "'", Default, $sComputer) = 2 Then
                $aResult[$iRow][2]= $aVolumeTypeMsg[2]
            Else
                $aResult[$iRow][2]= "Unknown"
            EndIf
        EndIf
        ; IsVolumeInitializedForProtection
        If _WMIPropertyExists($objDrive, "IsVolumeInitializedForProtection") Then
            $aResult[$iRow][3]  =   $objDrive.IsVolumeInitializedForProtection
        Else
            $aResult[$iRow][3]  =   "Unkown"
        EndIf
        ; ProtectionStatus
        $aResult[$iRow][4]      =   $aProtectionStatusMsg[$iProtectionStatus]
        ; LockStatus
        $aResult[$iRow][5]      =   $aLockStatusMsg[$iLockStatus + 1]
        ; IsAutoUnlockEnabled
        $aResult[$iRow][6]      =   $bIsAutoUnlockEnabled
        ; IsAutoUnlockEnabled
        $aResult[$iRow][7]      =   $bIsAutoUnlockKeyStored
        ; ConversionStatus
        $aResult[$iRow][8]      =   $aConversionStatusMsg[$iConversionStatus + 1]
        ; EncryptionMethod
        $aResult[$iRow][9]      =   $aEncryptionMethodMsg[$iEncryptionMethod + 1]
        ; EncryptionPercentage
        $aResult[$iRow][10]     =   $iEncryptionPercentage
        ; WipingStatus
        $aResult[$iRow][11]     =   $aWipingStatusMsg[$iWipingStatus + 1]
        ; WipingPercentage
        $aResult[$iRow][12]     =   $iWipingPercentage
        ; KeyProtectors
        $aResult[$iRow][13]     =   $aVolumeKeyProtectors

        $iRow += 1
    Next
    _ArraySort($aResult)
    Return $aResult
EndFunc   ;==>_BitlockerDriveInfo

Func _WMIPropertyExists($Object, $Property)
    If Not IsObj($Object) Then Return False
    For $sProperty In $Object.Properties_
        If $sProperty.Name = $Property Then Return True
    Next
    Return False
EndFunc   ;==>_WMIPropertyExists

Func _WMIMethodExists($Object, $Method)
    If Not IsObj($Object) Then Return False
    For $sMethod In $Object.Methods_
        If $sMethod.Name = $Method Then Return True
    Next
    Return False
EndFunc   ;==>_WMIMethodExists

Func _WMIPropertyValue($sProperty = "", $sClass = "", $sFilter = "", $sNamespace = Default, $sComputer = @ComputerName)
    Local $objWMIService, $objWMIQuery

    If $sClass = "" Or $sProperty = "" Then Return SetError(1, 0, 0)
    If $sFilter <> "" Then $sFilter = " " & $sFilter
    If $sNamespace = Default Then $sNamespace = "\root\CIMV2"

    $objWMIService = ObjGet("winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" & $sComputer & $sNamespace)
    If @error Then Return SetError(2, @error, 0)

    $objWMIQuery = $objWMIService.ExecQuery("SELECT * FROM " & $sClass & $sFilter, "WQL", 0x30)
    If Not IsObj($objWMIQuery) Then Return SetError(3, 0, 0)

    For $objItem In $objWMIQuery
        For $Property In $objItem.Properties_
            If $Property.Name = $sProperty Then
                Return $Property.Value
            EndIf
        Next
    Next

    Return SetError(4, 0, 0)
EndFunc   ;==>_WMIPropertyValue

 

Example 1:

#RequireAdmin
#include <array.au3>

; Get information on all available drives
Global $test = _BitlockerDriveInfo()
If @error Then
    ConsoleWrite("!> _BitlockerDriveInfo() error: " & @error & ". extended: " & @extended & @CRLF)
ElseIf IsArray($test) Then
    _ArrayDisplay($test, "Bitlocker Drive Info", "", 64, Default, "Drive Letter|Drive Label|Volume Type|Initialized For Protection|Protection Status|Lock Status|Auto Unlock Enabled|Auto Unlock Key Stored|Conversion Status|Encryption Method|Encryption Percentage|Wiping Status|Wiping Percentage|Key Protectors")
    ; Display the Key Protectors for the first record
    If IsArray($test[0][13]) Then _ArrayDisplay($test[0][13])
EndIf

Example 2:

#RequireAdmin
#include <array.au3>

; Get information on the C-drive of the current computer + show extra information in the console
Global $test = _BitlockerDriveInfo("C:", @ComputerName, True)
If @error Then
    ConsoleWrite("!> _BitlockerDriveInfo() error: " & @error & ". extended: " & @extended & @CRLF)
ElseIf IsArray($test) Then
    ConsoleWrite("Bitlocker information on the " & $test[0][0] & " drive" & @CRLF)
    ConsoleWrite("Protection Status: " & $test[0][4] & @CRLF)
EndIf

 

Screenshot for the first example:

5b7d3052055e9_2018-08-2211_42_42-Clipboard.thumb.png.362f5fa3339f81ad50fb018664af4afd.png

 

Suggestions? Bugs?

Just let me know

 

TODO:

  • ???

 

Version 1.0:

  • Initial release

Version 1.1:

  • Fixed: Drive Label will not work when you request the information from a remote system (currently using DriveGetLabel)
  • Fixed: The current fix for the missing VolumeType property in some Windows versions will only work locally
  • Added: New internal function (_WMIPropertyValue())

Version 1.2:

  • Fixed: The drive exists & drive type check only worked locally when a drive was specified in $sDrive
Edited by colombeen
Release v1.2
Link to post
Share on other sites
  • colombeen changed the title to [FUNC] Bitlocker Drive Info
  • 2 months later...
Global $a, $b, $c

$strComputer = @ComputerName
$objWMIService = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & $strComputer & "\root\CIMV2\Security\MicrosoftVolumeEncryption")

While $b <> 100
    $objWMIQuery = $objWMIService.ExecQuery("SELECT * FROM Win32_EncryptableVolume WHERE DriveLetter='C:'", "WQL", 0)
    For $objDrive In $objWMIQuery
        $res = $objDrive.GetConversionStatus($a, $b, $c)
        ;Display Progress Text or increment a Progress Bar
        ;"Bitlocker Encryption in Progress (" & $b & "%)...")
        Sleep(1000)
    Next
WEnd

From your function - it helped me include Bitlocker Encryption Progress into my own GUI... Thankyou!!!!

Link to post
Share on other sites
; Use readable var names ;-)
Global $ConversionStatus, $EncryptionPercentage, $EncryptionFlags, $WipingStatus, $WipingPercentage

$strComputer = @ComputerName
$objWMIService = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & $strComputer & "\root\CIMV2\Security\MicrosoftVolumeEncryption")

; $objWMIService error check
If @error Then Return False

While $EncryptionPercentage <> 100
    $objWMIQuery = $objWMIService.ExecQuery("SELECT * FROM Win32_EncryptableVolume WHERE DriveLetter='C:'", "WQL", 0)
    For $objDrive In $objWMIQuery
        ; https://docs.microsoft.com/en-us/windows/desktop/secprov/getconversionstatus-win32-encryptablevolume
        $res = $objDrive.GetConversionStatus($ConversionStatus, $EncryptionPercentage, $EncryptionFlags, $WipingStatus, $WipingPercentage)
        
        ; Display Progress Text or increment a Progress Bar
        ; "Bitlocker Encryption in Progress (" & $EncryptionPercentage & "%)...")
        Sleep(1000)
    Next
WEnd

Nice to see that someone can use it :)

Edited by colombeen
Link to post
Share on other sites
  • 1 year later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By jguinch
      Hello.
      I did create these few functions several months ago. I post here, if it can interest someone.
      These functions based on WMI queries allow you to manage printers : add / delete printer, driver, port, or obtain configuration, set default printer ... I let you discover it with the code.

       
      Here is the list of the available functions :
      _PrintMgr_AddLocalPort
      _PrintMgr_AddLPRPort
      _PrintMgr_AddPrinter
      _PrintMgr_AddPrinterDriver
      _PrintMgr_AddTCPIPPrinterPort
      _PrintMgr_AddWindowsPrinterConnection
      _PrintMgr_CancelAllJobs
      _PrintMgr_CancelPrintJob
      _PrintMgr_EnumPorts
      _PrintMgr_EnumPrinter
      _PrintMgr_EnumPrinterConfiguration
      _PrintMgr_EnumPrinterDriver
      _PrintMgr_EnumPrinterProperties
      _PrintMgr_EnumPrintJobs
      _PrintMgr_EnumTCPIPPrinterPort
      _PrintMgr_Pause
      _PrintMgr_PortExists
      _PrintMgr_PrinterExists
      _PrintMgr_PrinterSetComment
      _PrintMgr_PrinterSetDriver
      _PrintMgr_PrinterSetPort
      _PrintMgr_PrinterShare
      _PrintMgr_PrintTestPage
      _PrintMgr_RemoveLocalPort
      _PrintMgr_RemoveLPRPort
      _PrintMgr_RemovePrinter
      _PrintMgr_RemovePrinterDriver
      _PrintMgr_RemoveTCPIPPrinterPort
      _PrintMgr_RenamePrinter
      _PrintMgr_Resume
      _PrintMgr_SetDefaultPrinter
       
       
      And some examples :
      #include <Array.au3> #include "PrintMgr.au3" _Example() Func _Example() ; Remove a printer called "My old Lexmark printer" : _PrintMgr_RemovePrinter("My old Lexmark printer") ; Remove the driver called "Lexmark T640" : _PrintMgr_RemovePrinterDriver("Lexmark T640") ; Remove the TCP/IP printer port called "TCP/IP" _PrintMgr_RemoveTCPIPPrinterPort("MyOLDPrinterPort") ; Add a driver, called "Samsung ML-451x 501x Series", and driver inf file is ".\Samsung5010\sse2m.inf" _PrintMgr_AddPrinterDriver("Samsung ML-451x 501x Series", "Windows NT x86", @ScriptDir & "\Samsung5010", @ScriptDir & "\Samsung5010\sse2m.inf") ; Add a TCP/IP printer port, called "MyTCPIPPrinterPort", with IPAddress = 192.168.1.10 and Port = 9100 _PrintMgr_AddTCPIPPrinterPort("MyTCPIPPrinterPort", "192.168.1.10", 9100) ; Add a printer, give it the name "My Printer", use the driver called "Samsung ML-451x 501x Series" and the port called "MyTCPIPPrinterPort" _PrintMgr_AddPrinter("My Printer", "Samsung ML-451x 501x Series", "MyTCPIPPrinterPort") ; Set the printer called "My Printer" as default printer _PrintMgr_SetDefaultPrinter("My Printer") ; Connect to the shared printer "\\192.168.1.1\HPDeskjetColor") _PrintMgr_AddWindowsPrinterConnection("\\192.168.1.1\HPDeskjetColor") ; List all installed printers Local $aPrinterList = _PrintMgr_EnumPrinter() _ArrayDisplay($aPrinterList) ; List all printers configuration Local $aPrinterConfig = _PrintMgr_EnumPrinterConfiguration() _ArrayDisplay($aPrinterConfig) ; List all installed printer drivers Local $aDriverList = _PrintMgr_EnumPrinterDriver() _ArrayDisplay($aDriverList) ; Retrieve the printer configuration for the printer called "Lexmark T640" $aPrinterConfig = _PrintMgr_EnumPrinterConfiguration("Lexmark T640") _ArrayDisplay($aPrinterConfig) ; Add a local printer port (for a file output) _PrintMgr_AddLocalPort("c:\temp\output.pcl") ; Remove the local port _PrintMgr_RemoveLocalPort("c:\temp\output.pcl") ; Enum a print job Local $aJobList = _PrintMgr_EnumPrintJobs() _ArrayDisplay($aJobList) EndFunc ;==>_Example Download link :
      PrintMgr_Example.au3  
      PrintMgr.au3
    • By TheXman
      Encryption / Decryption / Hashing
      Purpose
      Cryptography API: Next Generation (CNG) is Microsoft's long-term replacement for their CryptoAPI.  Microsoft's CNG is designed to be extensible at many levels and cryptography agnostic in behavior.  Although the Crypt.au3 UDF lib that is installed with AutoIt3 still works perfectly, the advapi32.dll functions that it uses have been deprecated.  In addition the Crypt.au3 UDF lib, as it is currently written, has a very limited ability to decrypt AES data that was not encrypted using Crypt.au3.  That is because Crypt.au3 functions do not allow you to specify an actual key or initialization vector (IV).  It only lets you specify data to be used to derive a key and uses a static IV.  This UDF was created to offer a replacement for the deprecated functions used by Crypt.au3.  According to Microsoft, deprecated functions may be removed in future release.  It was also created to allow more flexibility in encryption/decryption and to expand the ability for users to implement cryptography in their scripts.
      Description
      This UDF implements some of Microsoft's Cryptography API: Next Generation (CNG) Win32 API functions.  It implements functions to encrypt/decrypt text and files, generate hashes, derive keys using Password-Based Key Derivation Function 2 (PBKDF2), and has several cryptography-related helper functions.  The UDF can implement any encryption/decryption algorithms and hashing algorithms that are supported by the installed cryptography providers on the PC in which it is running.  Most, if not all, of the values that you would commonly use to specify that desired algorithms, key bit lengths, and other magic number type values, are already defined as constants or enums in the UDF file.
      To flatten the learning curve, there is an example file that shows examples of all of the major functionality.  This example file is not created to be an exhaustive set of how to implement each feature and parameter.  It is designed to give you a template or guide to help you hit the ground running in terms of using the functions.  I have tried to fully document the headers of all of the functions as well as the code within the functions themselves.    As of v1.4.0, there is also a Help file that includes all of the functions, with examples.
      Current UDF Functions
      Algorithm-Specific Symmetric Encryption/Decryption Functions _CryptoNG_AES_CBC_EncryptData _CryptoNG_AES_CBC_DecryptData
        _CryptoNG_AES_CBC_EncryptFile _CryptoNG_AES_CBC_DecryptFile
        _CryptoNG_AES_ECB_EncryptData _CryptoNG_AES_ECB_DecryptData
        _CryptoNG_AES_GCM_EncryptData _CryptoNG_AES_GCM_DecryptData
        _CryptoNG_3DES_CBC_EncryptData _CryptoNG_3DES_CBC_DecryptData
        _CryptoNG_3DES_CBC_EncryptFile _CryptoNG_3DES_CBC_DecryptFile
        Generic Symmetric Encryption/Decryption Functions _CryptoNG_EncryptData _CryptoNG_DecryptData
        _CryptoNG_EncryptFile _CryptoNG_DecryptFile
        Hashing Functions _CryptoNG_HashData _CryptoNG_HashFile
        _CryptoNG_PBKDF2
        Asymmetric (Public/Private Key) Encryption/Decryption Functions _CryptoNG_RSA_CreateKeyPair
        _CryptoNG_RSA_EncryptData _CryptoNG_RSA_DecryptData
        Misc / Helper Functions _CryptoNG_CryptBinaryToString _CryptoNG_CryptStringToBinary
        _CryptoNG_GenerateRandom
        _CryptoNG_EnumAlgorithms _CryptoNG_EnumRegisteredProviders _CryptoNG_EnumKeyStorageProviders
        _CryptoNG_LastErrorMessage
        _CryptoNG_Version  
      Related Links
      Cryptography API: Next Generation - Main Page
      Cryptography API: Next Generation - Reference
      Cryptography API: Next Generation - Primitives
      Cryptography API: Next Generation - Cryptographic Algorithm Providers
    • By RTFC
      CodeCrypter enables you to encrypt scripts without placing the key inside the script.
      This is because this key is extracted from the user environment at runtime by, for example:
      password user query any macro (e.g., @username) any AutoIt function call any UDF call some permanent environment variable on a specific machine (and not created by your script) a server response a device response anything else you can think of, as long as it's not stored in the script any combination of the above You need several scripts to get this to work, and they are scattered over several threads, so here's a single bundle that contains them all (including a patched version of Ward's AES.au3; with many thanks to Ward for allowing me to include this script here):
      Latest version: 3.4 (3 Dec 2021): please follow this link.
      Note: if you experience issues under Win8/8.1 (as some users have reported), please upgrade to Win10 (or use Win7) if you can; as far as I can tell, the scripts in the bundle all work under Win7 & Win10 (and XP). Moreover, I have no access to a Win8 box, so these issues will not be fixed, at least not by yours truly.
       
      How the bits and pieces fit together:
      CodeCrypter is a front-end for the MCF UDF library (you need version 1.3 or later). Its thread is here:
      '?do=embed' frameborder='0' data-embedContent>>
      The MCF package (also contained in the CodeScannerCrypter bundle) contains MCF.au3 (the library itself) plus a little include file called MCFinclude.au3. The latter you have to include in any script you wish to encrypt. Any code preceding it will not be encrypted, any code following it will be encrypted. You define the dynamic key inside MCFinclude.au3, in the UDF: _MCFCC_Init().
      From the same post you can download an MCF Tutorial which I heartily recommend, because encrypting a script requires a number of steps in the right order, namely:
      In MCFinclude.au3, define and/or choose your dynamic key(s) (skip this step = use default setting) include MCFinclude.au3 in your target script Run CodeScanner (version 2.3+) on your target script, with setting WriteMetaCode=True (see '?do=embed' frameborder='0' data-embedContent>>), then close CodeScanner. Start CodeCrypter press the Source button to load your target file enable Write MCF0 (tick the first option in Main Settings) Enable "Encrypt" (last option in the Main Settings) Go to the Tab Encrypt and set up the encryption the way you want (skip this = use default settings) Return to Main Tab and press "Run" if all goes well, a new script called MCF0test.au3 is created in the same directory as your target. It has no includes and no redundant parts. Please check that it works as normal. (see Remarks if not) It all sounds far more complicated than it is, really.
      Not convinced? Check out:
      a simple HowTo Guide: HowToCodeCrypt.pdf an updated and extended Q & A pdf (FAQ, also included in the bundle) to help you get started:CodeCrypterFAQ.pdf For additional explanations/examples in response to specific questions by forum members (how it works, what it can/cannot do), see elsewhere in this thread, notably:
      Simple analogy of how it works: post #53, second part General Explanation and HowTo: post #9, 51, 75, 185/187, 196, 207, 270, 280 (this gets a bit repetitive) BackTranslation: post #179 Obfuscation: post #36 (general), 49 (selective obfuscation) Specific features and fixes: post #3 (security), 84 (redefining the expected runtime response), 169 (Curl Enum fix), 185/187 (using license keys), 194 (replacing Ward's AES UDF with different encryption/decryption calls), 251 (AV detection issue), 262 (extract key contents to USB on different target machine prior to encryption) Limitations: post #26 (@error/@extended), 149 (FileInstall), 191 (AES.au3 on x64) Not recommended: post #46/249 (static encryption), 102 (programme logic error), 237 (parsing password via cmdline)  
      Technical notes:
      BackTranslation is a test to check that the MetaCode translation worked. Skip it at your peril. It also turns your multi-include composite script into a single portable file without redundant parts (you can opt to leave the redundant parts in, if you want).
      CodeCrypter can also obfuscate (vars and UDF names) and replace strings, variable names and UDF names with anything else you provide, for  example, for language translation). After CodeScanner separates your target's structure from its contents, CodeCrypter (actually MCF, under the hood) can change any part, and then generate a new script from whichever pieces you define. See the MCF Tutorial for more explanation and examples.
      Encryption currently relies on Ward's excellent AES UDF and TheXman's sophisticated CryptoNG bundle. You can replace these with any other algorithm you like (but this is not trivial to do: edit MCFinclude.au3 UDF _MCFCC(), and MCF.au3 UDF _EncryptEntry(), see post #194 in this thread). AES by Ward, and CryptoNG by TheXman are also included in the bundle (with many thanks to Ward and TheXman for graciously allowing me to republish their outstanding work).
      Going to lie down now...
      RT
       
    • By RTFC
      The CodeScannerCrypterBundle (ca. 2.9 MB unzipped) contains the following UDFs and utilities:
      CodeScanner: analyse AutoIt script structure and content, identify potential issues, generate MCF data files CodeCrypter: front-end GUI for the MCF library, for script encryption (without storing the decryption key(s) in the script!) MetaCodeFile UDF (MCF library): for analysis and user-defined alterations of AutoIt script structure and content MCFinclude.au3: #include this UDF in any AutoIt script that you wish CodeCrypter to process CryptoNG, by TheXman; encryption UDF using Bcrypt dll calls (32/64-bit; various algorithms) StoreCCprofile.au3/readCSdatadump.au3/helloworld.au3: auxiliary utilities and example script HowToCodeCrypt.pdf: a simple guide in five steps CodeCrypterFAQ.pdf: questions and answers, partly based upon exchanges in the CodeCrypter thread. MetaCodeTutorial.pdf: the MCF engine explained; useful for encryption, GUI translation, code translation, and much more... Please follow the links for additional information.
    • By hek
      Hey everyone,
      Was wondering how I would be able to implement this on a local computer instead of using connectserver? 
      Any suggestions or help would be appreciated. Thanks. 
×
×
  • Create New...