moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
MIT License
11.02k stars 1.56k forks source link

Add support for SLbrowser (lenovo browser) #93

Open YuriSizuku opened 3 years ago

YuriSizuku commented 3 years ago

I think this browser has the similar structure with chrome browser. I try to use 256bits aes-gcm with nonce like chrome (see python code below) , but it doesn't work.

def decrypt_aeskey(localstatepath=""):
    with codecs.open(localstatepath, 'r', 'utf-8') as fp:
        encrypted_key_b64 = json.loads(fp.read())['os_crypt']['encrypted_key']
    encrypted_key = base64.b64decode(encrypted_key_b64)
    if encrypted_key[:5] == b'DPAPI': encrypted_key = encrypted_key[5:]
    _, aeskey = win32crypt.CryptUnprotectData(encrypted_key)
    return aeskey

def decrypt_blob(aeskey, data):
    version = data[0:5]
    if version == b'lnv20':
        nonce = data[5:5+12]
        ciphertext = data[5+12:]
        cipher = AES.new(aeskey, AES.MODE_GCM, nonce=nonce)
        plaintext = cipher.decrypt(ciphertext)
    return plaintext

The encrypted_value is something start with lnv20, here's the sample of this browser encrypted value:

0000  6c 6e 76 32 30 9b 35 66 4f ad 82 2f b0 e7 70 95  lnv20.5fO../..p. 
0010  27 97 49 6b b4 3f 95 7d 4f b0 48 b1 e1 62 58 b9  '.Ik.?.}O.H..bX. 
0020  cc ad 11 79 c7 4f ea 8f 6e 3b 95 26 d1 d9 36 a9  ...y.O..n;.&..6. 
0030  7a f4 0d 51 f0 98 a5                             z..Q...          

Would you please help me dealing with slbrowser ?

Star-KWL commented 1 year ago

好像现在还是不支持

He1za1 commented 1 week ago

Can you please help me dealing with lenovo slbrowser ? ` if (bufferString.StartsWith("lnv20")) { byte[] iv = new byte[12]; Array.Copy(buffer, 5, iv, 0, iv.Length);

                byte[] cipherText = new byte[buffer.Length - 17];
                Array.Copy(buffer, 17, cipherText, 0, cipherText.Length);

                byte[] tag = new byte[16];
                Array.Copy(cipherText, cipherText.Length - tag.Length, tag, 0, tag.Length);

                byte[] data = new byte[cipherText.Length - tag.Length];
                Array.Copy(cipherText, 0, data, 0, data.Length);

                decryptedData = new AesGcm().Decrypt(MasterKey, iv, null, data, tag);
            }`