I want to get pre-master key from OpenSSL application (in order to decrypt traffic). Details:

  • OpenSSL version: 1.0.2l, statically linked, no debug symbols
  • I'm able to debug the application (hit breakpoint inside SSL_connect(SSL *s) method)

Is there any way to get the pre-master key from there? I'm using x64dbg.

  • Can you modify OpenSSL and link with the modified version? – cisnjxqu Nov 21 '20 at 22:57

From https://stackoverflow.com/questions/36240279/how-do-i-extract-the-pre-master-secret-using-an-openssl-based-client

I recommend using the master key, which is easier to get at. To the best of my knowledge the pre-master key only exists ephemerally on the stack in OpenSSL. The master key is available in ssl_session_st (defined in ssl.h in the 1.0.2 branch but moved to ssl_locl.h in a later version). The SSL member variable session is a pointer to its ssl_session_st (aka SSL_SESSION).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.