DevOps Approach for Application Protector

namespace Decryptor
{
    public interface IDEKDecryptor
    {
        byte[] Decrypt(string keyLabel, string algorithmId, byte[] encDEK, out int decryptedDekLength);

    }
}

<Project Sdk="Microsoft.NET.Sdk">

	<PropertyGroup>
		<TargetFramework>net8.0</TargetFramework>
		<PlatformTarget>AnyCPU</PlatformTarget>
		<PublishAot>true</PublishAot>
		<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
		<EnableDynamicLoading>true</EnableDynamicLoading>
		<RuntimeIdentifier>win-x64</RuntimeIdentifier>
		<UseNativeAot>true</UseNativeAot>
	</PropertyGroup>

</Project>

using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;

namespace Decryptor
{

    [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
    public delegate IntPtr DecryptDelegate(
       [MarshalAs(UnmanagedType.LPUTF8Str)] string keyLabel,
       [MarshalAs(UnmanagedType.LPUTF8Str)] string algorithmId,
       IntPtr encData,
       int encLen,
       out int outLen);

   
    public static class DecryptorBridge
    {
        public static IDEKDecryptor Implementation { get; set; }
        static DecryptorBridge()
        {
            Implementation = new RSADecryptor();
        }
        public static IntPtr DecryptEntry(string keyLabel, string algorithmId, IntPtr encData, int encLen, out int outLen)
        {
            if (Implementation == null)
                throw new InvalidOperationException("Decryptor implementation not set.");
            byte[] encryptedDek = new byte[encLen];
            Marshal.Copy(encData, encryptedDek, 0, encLen);
            byte[] result = Implementation.Decrypt(keyLabel, algorithmId, encryptedDek, out outLen);
            IntPtr resultPtr = Marshal.AllocHGlobal(outLen);
            Marshal.Copy(result, 0, resultPtr, outLen);
            return resultPtr;
        }

        [UnmanagedCallersOnly(EntryPoint = "GetDecryptDelegate")]
        public static IntPtr GetDecryptDelegate() 
        {
            DecryptDelegate del = DecryptEntry;
            return Marshal.GetFunctionPointerForDelegate(del);
        }

        [UnmanagedCallersOnly(EntryPoint = "FreeBuffer", CallConvs = new[] { typeof(CallConvCdecl) })]
        public static void FreeBuffer(IntPtr ptr) { Marshal.FreeHGlobal(ptr); }

        

    }

}

using System;
using System.IO;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading.Tasks;
using Amazon;
using Amazon.KeyManagementService;
using Amazon.KeyManagementService.Model;
using Decryptor;

namespace DotNetDecryptor
{
    public class AWSKMSDecryptor : IDEKDecryptor
    {
        // Replace with your actual AWS region name (e.g., "us-east-1", "ap-south-1")
        private static readonly RegionEndpoint KMSRegion = RegionEndpoint.GetBySystemName("your-default-region");

        // Replace with your actual KMS Key ID 
        private static readonly string KMSKeyId = "your-key-id";
        public byte[] Decrypt(string keyLabel, string algorithmId, byte[] encDek, out int decryptedDekLength)
        {
            Console.WriteLine("Key Label: " + keyLabel);
            Console.WriteLine("AlgorithmID: " + algorithmId);
            Console.WriteLine("Base64 encoded input: " + Convert.ToBase64String(encDek));

            // Initialize the AWS KMS client using the specified region
            var kmsClient = new AmazonKeyManagementServiceClient(KMSRegion); 
            // Specify the encryption algorithm used during encryption
            EncryptionAlgorithmSpec algorithm = EncryptionAlgorithmSpec.RSAES_OAEP_SHA_256;
            // Create a decryption request with the encrypted DEK and algorithm
            var decryptRequest = new DecryptRequest
            {
                KeyId = KMSKeyId,
                CiphertextBlob = new MemoryStream(encDek),
                EncryptionAlgorithm = algorithm
            };
            // Send the decryption request to AWS KMS and wait for the response
            var decryptResponse = kmsClient.DecryptAsync(decryptRequest).Result;
            byte[] plaintext = decryptResponse.Plaintext.ToArray();
            decryptedDekLength = plaintext.Length;

            return plaintext;
        }

    }
}

using Azure.Identity;
using Azure.Security.KeyVault.Keys;
using Azure.Security.KeyVault.Keys.Cryptography;
using Decryptor;
using System;
using System.Net;
using System.Text;
using System.Threading.Tasks;

namespace Decryptor
{
    public class AzureKeyVaultDecryptor : IDEKDecryptor
    {

        public byte[] Decrypt(string keyLabel, string algorithmId, byte[] encDek, out int decryptedDekLength)
        {
            Console.WriteLine("Key Label:" + keyLabel);
            Console.WriteLine("AlgorithmID:" + algorithmId);
            Console.WriteLine("Base64 encoded input: " + Convert.ToBase64String(encDek));
            var keyVaultUrl = "https://devops-key.vault.azure.net/";
            var keyName = "testkey";
            var credential = new DefaultAzureCredential();
            var keyClient = new KeyClient(new Uri(keyVaultUrl), credential);
            KeyVaultKey key = keyClient.GetKey(keyName);
            CryptographyClient _cryptoClient = new CryptographyClient(key.Id, credential);
            EncryptionAlgorithm algorithm = EncryptionAlgorithm.RsaOaep256;
            DecryptResult result = _cryptoClient.Decrypt(algorithm, encDek);
            decryptedDekLength = result.Plaintext.Length;
            Console.WriteLine("Base64 encoded output: " + Convert.ToBase64String(result.Plaintext));
            return result.Plaintext;
        }
    }
}

using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Net.Http;
using System.Reflection.Metadata;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Decryptor;
using Microsoft.IdentityModel.Tokens;
using Newtonsoft.Json;

namespace DotNetDecryptor
{
    public class GCPKMSDecryptor : IDEKDecryptor
    {
        public byte[] Decrypt(string keyLabel, string algorithmId, byte[] encDEK, out int decryptedDekLength)
        {
            Console.WriteLine("Key Name: " + keyLabel);
            Console.WriteLine("AlgorithmID: " + algorithmId);
            Console.WriteLine("Base64 encoded input: " + Convert.ToBase64String(encDEK));

            // TODO: Replace the below path with the full path to your service account key JSON file
            // Example: @"C:\Path\To\Your\File\your-file-name.json"

            string jsonPath = @"C:\Path\To\Your\File\your-file-name.json";
            var serviceAccount = JsonConvert.DeserializeObject<Dictionary<string, string>>(System.IO.File.ReadAllText(jsonPath));

            string privateKey = serviceAccount["private_key"];
            string clientEmail = serviceAccount["client_email"];
            string tokenUri = serviceAccount["token_uri"];

            var rsa = RSA.Create();
            rsa.ImportFromPem(privateKey.ToCharArray());

            var creds = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256);

            var now = DateTimeOffset.UtcNow;
            var jwtHeader = new JwtHeader(creds);
            var jwtPayload = new JwtPayload
            {
                { "iss", clientEmail },
                { "scope", "https://www.googleapis.com/auth/cloud-platform" },
                { "aud", tokenUri },
                { "iat", now.ToUnixTimeSeconds() },
                { "exp", now.AddMinutes(60).ToUnixTimeSeconds() }
            };

            var jwt = new JwtSecurityToken(jwtHeader, jwtPayload);
            string signedJwt = new JwtSecurityTokenHandler().WriteToken(jwt);

            var httpClient = new HttpClient();
            var tokenResponse = httpClient.PostAsync(tokenUri, new FormUrlEncodedContent(new Dictionary<string, string>
            {
                { "grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer" },
                { "assertion", signedJwt }
            })).Result;

            var tokenJson = JsonConvert.DeserializeObject<Dictionary<string, string>>(tokenResponse.Content.ReadAsStringAsync().Result);
            string accessToken = tokenJson["access_token"];

            string ciphertext = Convert.ToBase64String(encDEK);

            // TODO: Replace the below URL with your actual Google Cloud KMS key version URL
            // Format: https://cloudkms.googleapis.com/v1/projects/{PROJECT_ID}/locations/{LOCATION}/keyRings/{KEY_RING}/cryptoKeys/{KEY_NAME}/cryptoKeyVersions/{VERSION}:asymmetricDecrypt
            string kmsUrl = "https://cloudkms.googleapis.com/v1/projects/{PROJECT_ID}/locations/{LOCATION}/keyRings/{KEY_RING}/cryptoKeys/{KEY_NAME}/cryptoKeyVersions/{VERSION}:asymmetricDecrypt";

            var payload = new Dictionary<string, string>
            {
                { "ciphertext", ciphertext }
            };

            var kmsRequest = new StringContent(JsonConvert.SerializeObject(payload), Encoding.UTF8, "application/json");

            httpClient.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken);

            var kmsResponse = httpClient.PostAsync(kmsUrl, kmsRequest).Result;
            
            var responseContent = kmsResponse.Content.ReadAsStringAsync().Result;

            if (!kmsResponse.IsSuccessStatusCode)
            {
                Console.WriteLine("KMS API Error:");
                Console.WriteLine(responseContent);
                throw new Exception("KMS decryption failed.");
            }

            var kmsJson = JsonConvert.DeserializeObject<Dictionary<string, string>>(responseContent);
            string plaintextBase64 = kmsJson["plaintext"];

            byte[] plaintext = Convert.FromBase64String(plaintextBase64);

            decryptedDekLength = plaintext.Length;
          
            return plaintext;
        }
    }
}