How to decrypt TLS in WireShark if I can hook the application's crypto API calls?

Question

I hooked BCryptEncrypt and BCryptDecrypt calls of an executable. I can get the input arguments and output values of these functions. This program calls BCryptEncrypt to encrypt the data sent over TLS, and calls BCryptDecrypt to decrypt the data received from TLS. So the hook gave me a lot of unencrypted data over the TLS channel.

However, a single HTTPS request might split into several TLS packets, and thus during each call of the above functions, my hook can only get a portion of the whole HTTPS stream.

I'm wondering if there's a way to "decrypt" the TLS captures in WireShark, given that I have already got the plain text for all the encrypted data for the TLS packets. So that I can utilize the Follow HTTP Stream, Gzip uncompression and many other goodies in WireShark to help me analyze the capture.

Answer 1

There is no way to let Wireshark work directly on the application level data you've got. But you can create a new pcap based on these data and then use Wireshark to analyze this pcap. For example this can be done with a bit of Perl and the Net::PcapWriter module which lets you easily create a pcap and add TCP connections with your own application data to it:

use strict;
use Net::PcapWriter;
my $pcap = Net::PcapWriter->new('test.pcap');
my $conn = $pcap->tcp_conn('1.1.1.1',1234,'2.2.2.2',80);
$conn->write(0,"GET / HTTP/1.0\r\nHost:..."); # HTTP request from client
$conn->write(1,"HTTP/1.1 200 ok\r\n...");     # HTTP response from server

Similar things can probably done with Python and the famous scapy library.