I want to decrypt a SSL connection that is established by an unknown binary file on a Windows 7 Computer. This binary doesn't exist on any other computer on our network and establishes SSL encrypted Connections to a specific host in irregular intervals. I now want to decrypt the connection to be able to determine which data is transfered.
I already tried to intercept the connection using
mitmproxy and a fake CA which did not work. Is there a way to detect SSL keys in the RAM or is there another way to "catch" all keys used to decrypt SSL connections?
// The connecton breaks when I try to use mitmproxy. I assume the binary brings its own list of valid CA certificates.