What libraries does Windows use to send ssl traffic? The ws2_32.dll has the tcp send function, but the traffic is encrypted before it reaches that function.

I'm looking to reach the code where the traffic is still in plaintext. Its a windows application as well, its not a web page so I can't look at firefox source code etc.

There is a tool called Echo Mirage that does it, but I'm interested in how they achieve that.


  • If it's an http application hooking wininet or Winhttp might be easier. – Jonathan Allon May 30 '17 at 1:01

Windows uses its Secure Channel (schannel.dll) for all SSL/TLS type communications. You can try to look at the Windows docs for TLS. You might also be able to use Fiddler as an SSL proxy to look at the decrypted data.

@CBHacking commented with a tool that is very useful, Microsoft Message Analyzer. It uses Fiddler behind the scenes when you use its Quick Trace Tool for live HTTP decryption. But you can also perform Post Decryption on TLS using this tool. A quote from that blog post:

Today you can capture the traffic before it is encrypted using the Unencrypted HTTPS scenario from the Quick Trace menu. This requires you install the Fiddler Core components, which is how we enable this scenario. However, there are some limitations and scenarios that it doesn’t cover, like non HTTP traffic. And not all clients and capturing scenarios work with Fiddler. So another other option is to decrypt after the fact.

Post decryption has its challenges too. You need the private cert and password, which might not always be easily available. However, one nice mitigation is that the person who does have access to the certificate can always save the results, filtered down, and send only that data he wants you to see. Also, we haven’t hooked up every parser yet, however for some cases it’s a simple change and something we’ll extend moving forward.

If you have access to the cert in which you want to use for your application, then this could be a good substitution for non-HTTP TLS traffic.

  • 1
    You can also use Microsoft Message Analyzer to view TLS traffic, although (much like Fiddler) it's just adding a trusted root cert and then intercepting the handshake, injecting a MitM cert with a known private key, and decrypting the traffic on the fly. Won't work for apps that use cert pinning, for example. – CBHacking Jun 28 '17 at 23:42
  • @CBHacking That's a very nifty tool. Even if you wanted to have your app use cert pinning you could easily enable that later, and use this for protocol verification. Nice find! – RoraΖ Jun 29 '17 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.