BCryptDecrypt calls of an executable. I can get the input arguments and output values of these functions. This program calls
BCryptEncrypt to encrypt the data sent over TLS, and calls
BCryptDecrypt to decrypt the data received from TLS. So the hook gave me a lot of unencrypted data over the TLS channel.
However, a single HTTPS request might split into several TLS packets, and thus during each call of the above functions, my hook can only get a portion of the whole HTTPS stream.
I'm wondering if there's a way to "decrypt" the TLS captures in WireShark, given that I have already got the plain text for all the encrypted data for the TLS packets. So that I can utilize the Follow HTTP Stream, Gzip uncompression and many other goodies in WireShark to help me analyze the capture.