CODEWITHSUNDEEP
fileencryptioncryptographyexecutable
ByteData90
ByteData90

Reputation: 11

Data Decryption In An Executable?

I am wanting to understand the process of an executable decrypting data from an encrypted file in terms of when and where it takes place. An example would be can the decryption be handled outside of the program during a Createfile or Readfile call? Or does decryption have to take place after having read the file into it's memory?

Upvotes: 1

Views: 279

Answers (1)

Maarten Bodewes
Maarten Bodewes

Reputation: 93978

Generally file systems do not provide separate routines for encrypting / decrypting files. Some systems may provide key stores, which then can be accessed by applications. If you encrypt using keys in those key stores then the keys / encryption routines may have additional protection from the system. Still, the encryption routine would not be performed directly when reading / writing the file.

Generally file encryption / decryption is performed in a piecemeal fashion. Because of this, most cryptographic libraries provide a "update / final" method of encryption (CBC for instance requires padding / unpadding, so the "final" method does have to perform an additional task). So you don't need to load all the file into memory, you can just read it into a buffer and encrypt the bytes in the buffer.

To make it even easier, a lot of libraries provide streams for encryption / decryption. In that case the stream takes care of the buffering. So you open a file stream and then use a "filter" stream to encrypt the data using the file stream as parent stream. Generally I prefer an output stream for encryption and an input stream for decryption.

One method that is often overlooked is the option to memory map a file. In that case it almost looks like you can directly encrypt / decrypt, although in the end the file must first be transferred to memory before it can be encrypted.

There are of course file system encryption / decryption systems such as BitLocker. Those are however usually transparent to the application that uses those encrypted files: for the application they seem like just normal files, and the key management is performed by the system, not the application.

Upvotes: 1

Related Questions