chrome-tools 1.1.13 → 1.1.15

package/dist/src/core/crypto.d.ts

@@ -28,6 +28,20 @@ export declare function decryptValueBuffer(encryptedBlob: Buffer | Uint8Array |
  * @returns The decrypted plaintext bytes, or a placeholder string.
  */
 export declare function decryptValueBufferGcm(encryptedBlob: Buffer | Uint8Array | null | undefined, key: Buffer): Buffer | string;
+/**
+ * Decrypts a Windows Chrome 127+ `v20` blob using AES-256-GCM.
+ *
+ * App-Bound Encryption uses the same AES-256-GCM layout as `v10`/`v11` but
+ * with a `"v20"` prefix and a key obtained from Chrome's Elevation Service
+ * (IElevator COM) instead of plain DPAPI.
+ *
+ * Layout: "v20" (3 bytes) + 12-byte nonce + ciphertext + 16-byte GCM tag
+ *
+ * @param encryptedBlob - The encrypted blob from the database.
+ * @param key - The 32-byte AES-256 key from ABE decryption.
+ * @returns The decrypted plaintext bytes, or a placeholder string.
+ */
+export declare function decryptValueBufferGcmV20(encryptedBlob: Buffer | Uint8Array | null | undefined, key: Buffer): Buffer | string;
 /**
  * Converts a Chrome/Webkit timestamp (microseconds since 1601-01-01)
  * to a readable local Date string.

package/dist/src/core/crypto.js

@@ -83,6 +83,45 @@ export function decryptValueBufferGcm(encryptedBlob, key) {
         return "<decryption failed>";
     }
 }
+/**
+ * Decrypts a Windows Chrome 127+ `v20` blob using AES-256-GCM.
+ *
+ * App-Bound Encryption uses the same AES-256-GCM layout as `v10`/`v11` but
+ * with a `"v20"` prefix and a key obtained from Chrome's Elevation Service
+ * (IElevator COM) instead of plain DPAPI.
+ *
+ * Layout: "v20" (3 bytes) + 12-byte nonce + ciphertext + 16-byte GCM tag
+ *
+ * @param encryptedBlob - The encrypted blob from the database.
+ * @param key - The 32-byte AES-256 key from ABE decryption.
+ * @returns The decrypted plaintext bytes, or a placeholder string.
+ */
+export function decryptValueBufferGcmV20(encryptedBlob, key) {
+    if (!encryptedBlob || encryptedBlob.length === 0) {
+        return Buffer.alloc(0);
+    }
+    const blob = Buffer.isBuffer(encryptedBlob)
+        ? encryptedBlob
+        : Buffer.from(encryptedBlob);
+    const prefix = blob.subarray(0, 3).toString("utf-8");
+    if (prefix !== "v20") {
+        return "<unsupported encryption format>";
+    }
+    if (blob.length < 3 + GCM_NONCE_LENGTH + GCM_TAG_LENGTH) {
+        return "<decryption failed>";
+    }
+    const nonce = blob.subarray(3, 3 + GCM_NONCE_LENGTH);
+    const tag = blob.subarray(blob.length - GCM_TAG_LENGTH);
+    const ciphertext = blob.subarray(3 + GCM_NONCE_LENGTH, blob.length - GCM_TAG_LENGTH);
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    }
+    catch {
+        return "<decryption failed>";
+    }
+}
 /**
  * Converts a Chrome/Webkit timestamp (microseconds since 1601-01-01)
  * to a readable local Date string.

package/dist/src/core/platform/types.d.ts

@@ -23,8 +23,18 @@ export interface ChromePlatform {
      */
     getDecryptionKey(chromeDir?: string, browser?: BrowserDescriptor): Buffer;
     /**
-     * Decrypts a single Chrome `v10`/`v11` blob using this platform's scheme
-     * (AES-128-CBC on macOS/Linux, AES-256-GCM on Windows).
+     * Returns the App-Bound Encryption key for Chrome 127+ on Windows.
+     * Only the win32 backend implements this; others return `undefined`.
+     *
+     * @param chromeDir - User Data dir containing the `Local State` file.
+     * @param browser - Browser to target (needed to select the COM CLSID).
+     * @returns The decrypted 32-byte AES key, or `undefined` if ABE is
+     *   unavailable or unsupported on this platform.
+     */
+    getAppBoundKey?(chromeDir?: string, browser?: BrowserDescriptor): Buffer | undefined;
+    /**
+     * Decrypts a single Chrome `v10`/`v11`/`v20` blob using this platform's
+     * scheme (AES-128-CBC on macOS/Linux, AES-256-GCM on Windows).
      *
      * @returns The plaintext bytes, or a `<...>` placeholder string on a
      *   recognized but undecryptable blob (never throws).

package/dist/src/core/platform/win32.d.ts

@@ -6,7 +6,8 @@ import type { ChromePlatform } from "./types.js";
  * unprotected via DPAPI into a raw 32-byte AES-256 key (no PBKDF2 on Windows).
  * Cipher: AES-256-GCM (nonce + tag carried in each blob).
  *
- * Note: Chrome 127+ adds app-bound ("v20") keys requiring elevation; those are
- * not handled here. Standard v10/v11 cookies and passwords decrypt fine.
+ * Chrome 127+ adds `os_crypt.app_bound_encrypted_key` — base64, "APPB"-prefixed.
+ * It is passed directly to Chrome's IElevator COM service via the native helper
+ * to obtain the 32-byte AES-256 key for "v20" blobs.
  */
 export declare const win32: ChromePlatform;

package/dist/src/core/platform/win32.js

@@ -1,14 +1,32 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { decryptValueBufferGcm } from "../crypto.js";
+import { decryptValueBufferGcm, decryptValueBufferGcmV20 } from "../crypto.js";
 import { getActiveBrowser } from "../browsers.js";
 // Chrome base64-encodes the DPAPI-protected AES key in Local State, prefixed
 // with the ASCII bytes "DPAPI".
 const DPAPI_PREFIX = Buffer.from("DPAPI", "ascii");
+// Chrome 127+ uses App-Bound Encryption. The key in Local State is prefixed
+// with "APPB" and requires the IElevator COM service to decrypt.
+const APPB_PREFIX = Buffer.from("APPB", "ascii");
 // Keyed by User Data dir so different browsers (each with its own Local State)
 // cache independently (e.g. under `--all-browsers`).
 const _cachedKeys = new Map();
+const _cachedABEKeys = new Map();
+let _lastResolvedDir;
+let _lastResolvedBrowser;
+// Maps browser ids to the COM service identifier used by the native helper.
+const ABE_BROWSER_MAP = {
+    chrome: "chrome",
+    "chrome-beta": "chrome-beta",
+    "chrome-canary": "chrome",
+    chromium: "chrome",
+    brave: "brave",
+    edge: "edge",
+    vivaldi: "chrome",
+    comet: "chrome",
+    opera: "chrome",
+};
 /**
  * Unprotects a DPAPI blob for the current user.
  *
@@ -37,6 +55,144 @@ function dpapiDecrypt(encrypted) {
     }
     return Buffer.from(out.trim(), "base64");
 }
+/**
+ * Resolves the Local State directory from a profile/chromeDir path.
+ * `profilePath` may point directly at .../Default. Local State belongs to
+ * the parent User Data directory.
+ */
+function resolveLocalStateDir(requestedDir) {
+    const parentDir = dirname(requestedDir);
+    return existsSync(join(requestedDir, "Local State"))
+        ? requestedDir
+        : parentDir !== requestedDir && existsSync(join(parentDir, "Local State"))
+            ? parentDir
+            : requestedDir;
+}
+/**
+ * Finds the source chrome_abe_decrypt helper executable.
+ * Searches in order:
+ *   1. Next to compiled output (dist/bin/)
+ *   2. In the package bin/ directory
+ *   3. In src/native/ (development)
+ *   4. On PATH
+ */
+function findABEHelper() {
+    const base = import.meta.dirname ?? "";
+    const candidates = [
+        join(base, "..", "..", "..", "bin", "chrome_abe_decrypt.exe"),
+        join(base, "..", "..", "..", "..", "bin", "chrome_abe_decrypt.exe"),
+        join(base, "..", "..", "..", "..", "src", "native", "chrome_abe_decrypt.exe"),
+    ];
+    for (const p of candidates) {
+        if (existsSync(p))
+            return p;
+    }
+    // Try on PATH
+    try {
+        execFileSync("where", ["chrome_abe_decrypt.exe"], { encoding: "utf-8", stdio: "pipe" });
+        return "chrome_abe_decrypt.exe";
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Candidate directories for staging the helper binary to satisfy Chrome's
+ * Elevation Service caller validation.
+ *
+ * In Chromium's `caller_validation.cc`, `MaybeTrimProcessPath()` strips the
+ * executable name and trailing 'Temp' or 'Application' folders. Executing the
+ * helper from `<BrowserRoot>\Temp\chrome_abe_decrypt.exe` matches the browser's
+ * validated root without requiring administrative privileges.
+ */
+function getBrowserTempDirs(browserId) {
+    const dirs = [];
+    const progFiles = process.env["ProgramFiles"] || "C:\\Program Files";
+    const progFilesX86 = process.env["ProgramFiles(x86)"] || "C:\\Program Files (x86)";
+    const localAppData = process.env.LOCALAPPDATA ||
+        (process.env.USERPROFILE ? join(process.env.USERPROFILE, "AppData", "Local") : "");
+    const subpaths = {
+        chrome: ["Google\\Chrome"],
+        "chrome-beta": ["Google\\Chrome Beta"],
+        "chrome-canary": ["Google\\Chrome SxS"],
+        chromium: ["Chromium"],
+        edge: ["Microsoft\\Edge"],
+        brave: ["BraveSoftware\\Brave-Browser"],
+        vivaldi: ["Vivaldi"],
+    };
+    const rels = subpaths[browserId] || ["Google\\Chrome"];
+    for (const rel of rels) {
+        dirs.push(join(progFiles, rel, "Temp"));
+        dirs.push(join(progFilesX86, rel, "Temp"));
+        if (localAppData) {
+            dirs.push(join(localAppData, rel, "Temp"));
+        }
+    }
+    return dirs;
+}
+/**
+ * Ensures the helper binary is located in a path that passes the browser
+ * elevation service's validation checks. Stages a copy to the browser's Temp
+ * folder if necessary.
+ */
+function findOrStageABEHelper(browserId) {
+    const sourceExe = findABEHelper();
+    if (!sourceExe)
+        return null;
+    const targetDirs = getBrowserTempDirs(browserId);
+    for (const targetDir of targetDirs) {
+        try {
+            if (!existsSync(targetDir)) {
+                mkdirSync(targetDir, { recursive: true });
+            }
+            const stagedExe = join(targetDir, "chrome_abe_decrypt.exe");
+            if (!existsSync(stagedExe) || statSync(stagedExe).size !== statSync(sourceExe).size) {
+                copyFileSync(sourceExe, stagedExe);
+            }
+            return stagedExe;
+        }
+        catch {
+            // Permission denied or path not found, try next candidate
+            continue;
+        }
+    }
+    // Fallback to the original binary location
+    return sourceExe;
+}
+let _abeWarningShown = false;
+/**
+ * Decrypts an app_bound_encrypted_key using Chrome's IElevator COM service
+ * via the native helper binary.
+ *
+ * Note: App-Bound Encryption does NOT use standard user DPAPI. The raw
+ * encrypted payload (with the 4-byte 'APPB' prefix removed) is passed directly
+ * to the IElevator COM service, which executes the elevated decryption.
+ */
+function abeDecrypt(rawEncryptedBytes, browserId) {
+    const helperExe = findOrStageABEHelper(browserId);
+    if (!helperExe) {
+        if (!_abeWarningShown) {
+            _abeWarningShown = true;
+            process.stderr.write("[chrome-tools] chrome_abe_decrypt.exe not found. Chrome 127+ v20-encrypted\n" +
+                "cookies/passwords cannot be decrypted.\n");
+        }
+        return null;
+    }
+    const comBrowser = ABE_BROWSER_MAP[browserId] || "chrome";
+    try {
+        const out = execFileSync(helperExe, [comBrowser], {
+            input: rawEncryptedBytes.toString("base64"),
+            encoding: "utf-8",
+            timeout: 30000,
+            stdio: ["pipe", "pipe", "pipe"],
+            cwd: dirname(helperExe),
+        });
+        return Buffer.from(out.trim(), "base64");
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Windows backend.
  *
@@ -44,8 +200,9 @@ function dpapiDecrypt(encrypted) {
  * unprotected via DPAPI into a raw 32-byte AES-256 key (no PBKDF2 on Windows).
  * Cipher: AES-256-GCM (nonce + tag carried in each blob).
  *
- * Note: Chrome 127+ adds app-bound ("v20") keys requiring elevation; those are
- * not handled here. Standard v10/v11 cookies and passwords decrypt fine.
+ * Chrome 127+ adds `os_crypt.app_bound_encrypted_key` — base64, "APPB"-prefixed.
+ * It is passed directly to Chrome's IElevator COM service via the native helper
+ * to obtain the 32-byte AES-256 key for "v20" blobs.
  */
 export const win32 = {
     name: "win32",
@@ -67,17 +224,20 @@ export const win32 = {
     },
     getDecryptionKey(chromeDir, browser = getActiveBrowser()) {
         const requestedDir = chromeDir || this.getDefaultChromeDir(browser);
-        // `profilePath` may point directly at .../Default. Local State belongs to
-        // the parent User Data directory, so use it when the supplied path does not
-        // contain its own Local State file.
-        const parentDir = dirname(requestedDir);
-        const dir = existsSync(join(requestedDir, "Local State"))
-            ? requestedDir
-            : parentDir !== requestedDir && existsSync(join(parentDir, "Local State"))
-                ? parentDir
-                : requestedDir;
+        const dir = resolveLocalStateDir(requestedDir);
+        _lastResolvedDir = dir;
+        _lastResolvedBrowser = browser;
         const cached = _cachedKeys.get(dir);
         if (cached !== undefined) {
+            // Also pre-cache ABE key if not yet cached
+            if (!_cachedABEKeys.has(dir)) {
+                try {
+                    this.getAppBoundKey?.(dir, browser);
+                }
+                catch {
+                    // Ignore
+                }
+            }
             return cached;
         }
         const localStatePath = join(dir, "Local State");
@@ -103,12 +263,67 @@ export const win32 = {
         }
         const key = dpapiDecrypt(encryptedKey.subarray(DPAPI_PREFIX.length));
         _cachedKeys.set(dir, key);
+        // Also pre-cache the ABE key for v20 blobs
+        try {
+            this.getAppBoundKey?.(dir, browser);
+        }
+        catch {
+            // Ignore
+        }
+        return key;
+    },
+    getAppBoundKey(chromeDir, browser = _lastResolvedBrowser ?? getActiveBrowser()) {
+        const requestedDir = chromeDir || _lastResolvedDir || this.getDefaultChromeDir(browser);
+        const dir = resolveLocalStateDir(requestedDir);
+        _lastResolvedDir = dir;
+        _lastResolvedBrowser = browser;
+        const cached = _cachedABEKeys.get(dir);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const localStatePath = join(dir, "Local State");
+        if (!existsSync(localStatePath))
+            return undefined;
+        let appBoundKeyB64;
+        try {
+            const raw = readFileSync(localStatePath, "utf-8");
+            appBoundKeyB64 = JSON.parse(raw)?.os_crypt?.app_bound_encrypted_key;
+        }
+        catch {
+            return undefined;
+        }
+        if (!appBoundKeyB64)
+            return undefined;
+        const appBoundKey = Buffer.from(appBoundKeyB64, "base64");
+        if (!appBoundKey.subarray(0, APPB_PREFIX.length).equals(APPB_PREFIX)) {
+            return undefined;
+        }
+        // App-Bound Encryption: Pass raw encrypted bytes directly to COM elevation service
+        const abeKey = abeDecrypt(appBoundKey.subarray(APPB_PREFIX.length), browser.id);
+        if (!abeKey)
+            return undefined;
+        const key = abeKey.length > 32 ? abeKey.subarray(abeKey.length - 32) : abeKey;
+        _cachedABEKeys.set(dir, key);
         return key;
     },
     decrypt(blob, key) {
+        const prefix = blob.subarray(0, 3).toString("utf-8");
+        // v20 = App-Bound Encryption (Chrome 127+)
+        if (prefix === "v20") {
+            // Try to get the ABE key for this profile
+            const abeKey = this.getAppBoundKey?.(_lastResolvedDir, _lastResolvedBrowser);
+            if (!abeKey) {
+                return "<v20 app-bound encryption - requires chrome_abe_decrypt.exe>";
+            }
+            return decryptValueBufferGcmV20(blob, abeKey);
+        }
+        // v10/v11 = standard DPAPI + AES-256-GCM
         return decryptValueBufferGcm(blob, key);
     },
     clearCache() {
         _cachedKeys.clear();
+        _cachedABEKeys.clear();
+        _lastResolvedDir = undefined;
+        _lastResolvedBrowser = undefined;
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chrome-tools",
-  "version": "1.1.13",
+  "version": "1.1.15",
   "description": "CLI & Node.js library for chrome",
   "type": "module",
   "main": "./dist/src/index.js",
@@ -23,6 +23,8 @@
   "files": [
     "dist/src",
     "dist/bin",
+    "bin/chrome_abe_decrypt.exe",
+    "src/native",
     "README.md",
     "LICENSE"
   ],

package/src/native/build.bat

@@ -0,0 +1,31 @@
+@echo off
+REM Build chrome_abe_decrypt.exe with MSVC
+REM Run from a Visual Studio Developer Command Prompt or after calling vcvarsall.bat
+
+where cl.exe >nul 2>nul
+if %ERRORLEVEL% neq 0 (
+    if exist "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvarsall.bat" (
+        call "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvarsall.bat" x64
+    ) else if exist "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsall.bat" (
+        call "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsall.bat" x64
+    ) else if exist "C:\Program Files\Microsoft Visual Studio\2022\Professional\VC\Auxiliary\Build\vcvarsall.bat" (
+        call "C:\Program Files\Microsoft Visual Studio\2022\Professional\VC\Auxiliary\Build\vcvarsall.bat" x64
+    ) else if exist "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" (
+        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x64
+    )
+)
+
+cl.exe /nologo /O2 /W3 /Fe:chrome_abe_decrypt.exe chrome_abe_decrypt.c ole32.lib oleaut32.lib crypt32.lib advapi32.lib
+
+if %ERRORLEVEL% neq 0 (
+    echo Build failed.
+    exit /b 1
+)
+
+echo.
+echo Built: chrome_abe_decrypt.exe
+echo.
+echo Usage: chrome_abe_decrypt.exe ^<browser^>
+echo   Reads base64 app_bound_encrypted_key from stdin
+echo   Writes base64 decrypted key to stdout
+echo   browser: chrome, chrome-beta, brave, edge

package/src/native/chrome_abe_decrypt.c

@@ -0,0 +1,336 @@
+/*
+ * chrome_abe_decrypt.c — Minimal Chrome App-Bound Encryption key decryptor.
+ *
+ * Calls Chrome's IElevator COM service to decrypt an app_bound_encrypted_key.
+ * Derived from xaitax/Chrome-App-Bound-Encryption-Decryption (MIT License).
+ *
+ * Usage:  chrome_abe_decrypt.exe <browser> < base64_encrypted_key
+ *         Outputs: base64-encoded decrypted key to stdout
+ *
+ * <browser> is one of: chrome, chrome-beta, brave, edge
+ *
+ * Build:  cl.exe /O2 chrome_abe_decrypt.c ole32.lib oleaut32.lib advapi32.lib
+ *
+ * Copyright (c) 2024 Alexander 'xaitax' Hagenah (original COM logic)
+ * MIT License
+ */
+
+#define WIN32_LEAN_AND_MEAN
+#define COBJMACROS
+#include <windows.h>
+#include <objbase.h>
+#include <oleauto.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* ---------- base64 helpers (Windows CryptBinaryToStringA) ---------- */
+#pragma comment(lib, "crypt32.lib")
+#include <wincrypt.h>
+
+static int b64_decode(const char *b64, unsigned char **out, DWORD *outLen) {
+    DWORD len = 0;
+    if (!CryptStringToBinaryA(b64, 0, CRYPT_STRING_BASE64, NULL, &len, NULL, NULL))
+        return -1;
+    *out = (unsigned char *)malloc(len);
+    if (!*out) return -1;
+    if (!CryptStringToBinaryA(b64, 0, CRYPT_STRING_BASE64, *out, &len, NULL, NULL)) {
+        free(*out);
+        return -1;
+    }
+    *outLen = len;
+    return 0;
+}
+
+static int b64_encode(const unsigned char *data, DWORD dataLen, char **out) {
+    DWORD len = 0;
+    if (!CryptBinaryToStringA(data, dataLen, CRYPT_STRING_BASE64 | CRYPT_STRING_NOCRLF, NULL, &len))
+        return -1;
+    *out = (char *)malloc(len + 1);
+    if (!*out) return -1;
+    if (!CryptBinaryToStringA(data, dataLen, CRYPT_STRING_BASE64 | CRYPT_STRING_NOCRLF, *out, &len)) {
+        free(*out);
+        return -1;
+    }
+    (*out)[len] = '\0';
+    return 0;
+}
+
+/* ---------- IElevator COM interface (vtable-based, pure C) ---------- */
+
+/*
+ * IElevator vtable layout (Chrome/Brave — 3 custom methods):
+ *   [0] QueryInterface
+ *   [1] AddRef
+ *   [2] Release
+ *   [3] RunRecoveryCRXElevated
+ *   [4] EncryptData
+ *   [5] DecryptData
+ */
+typedef struct IElevatorVtbl {
+    /* IUnknown */
+    HRESULT (STDMETHODCALLTYPE *QueryInterface)(void *This, REFIID riid, void **ppv);
+    ULONG   (STDMETHODCALLTYPE *AddRef)(void *This);
+    ULONG   (STDMETHODCALLTYPE *Release)(void *This);
+    /* IElevator */
+    HRESULT (STDMETHODCALLTYPE *RunRecoveryCRXElevated)(void *This, const WCHAR*, const WCHAR*, const WCHAR*, const WCHAR*, DWORD, ULONG_PTR*);
+    HRESULT (STDMETHODCALLTYPE *EncryptData)(void *This, int protLevel, BSTR in, BSTR *out, DWORD *err);
+    HRESULT (STDMETHODCALLTYPE *DecryptData)(void *This, BSTR in, BSTR *out, DWORD *err);
+} IElevatorVtbl;
+
+typedef struct IElevator {
+    IElevatorVtbl *lpVtbl;
+} IElevator;
+
+/*
+ * Edge vtable layout — has 3 extra base methods before the IElevator methods:
+ *   [0] QueryInterface
+ *   [1] AddRef
+ *   [2] Release
+ *   [3] EdgeBaseMethod1
+ *   [4] EdgeBaseMethod2
+ *   [5] EdgeBaseMethod3
+ *   [6] RunRecoveryCRXElevated
+ *   [7] EncryptData
+ *   [8] DecryptData
+ */
+typedef struct IEdgeElevatorVtbl {
+    /* IUnknown */
+    HRESULT (STDMETHODCALLTYPE *QueryInterface)(void *This, REFIID riid, void **ppv);
+    ULONG   (STDMETHODCALLTYPE *AddRef)(void *This);
+    ULONG   (STDMETHODCALLTYPE *Release)(void *This);
+    /* IEdgeElevatorBase (3 unknown methods) */
+    HRESULT (STDMETHODCALLTYPE *EdgeBase1)(void *This);
+    HRESULT (STDMETHODCALLTYPE *EdgeBase2)(void *This);
+    HRESULT (STDMETHODCALLTYPE *EdgeBase3)(void *This);
+    /* IElevator */
+    HRESULT (STDMETHODCALLTYPE *RunRecoveryCRXElevated)(void *This, const WCHAR*, const WCHAR*, const WCHAR*, const WCHAR*, DWORD, ULONG_PTR*);
+    HRESULT (STDMETHODCALLTYPE *EncryptData)(void *This, int protLevel, BSTR in, BSTR *out, DWORD *err);
+    HRESULT (STDMETHODCALLTYPE *DecryptData)(void *This, BSTR in, BSTR *out, DWORD *err);
+} IEdgeElevatorVtbl;
+
+typedef struct IEdgeElevator {
+    IEdgeElevatorVtbl *lpVtbl;
+} IEdgeElevator;
+
+/* ---------- Browser COM identifiers ---------- */
+/* From xaitax/Chrome-App-Bound-Encryption-Decryption/src/payload/browser_config.hpp */
+
+typedef struct BrowserCOM {
+    const char *name;
+    CLSID clsid;
+    IID   iid;       /* IElevator v1 */
+    IID   iid_v2;    /* IElevator v2 (Chrome 144+), GUID_NULL if none */
+    int   isEdge;
+} BrowserCOM;
+
+/* Chrome */
+static const CLSID CLSID_Chrome = {0x708860E0, 0xF641, 0x4611, {0x88, 0x95, 0x7D, 0x86, 0x7D, 0xD3, 0x67, 0x5B}};
+static const IID   IID_IElevatorChrome = {0x463ABECF, 0x410D, 0x407F, {0x8A, 0xF5, 0x0D, 0xF3, 0x5A, 0x00, 0x5C, 0xC8}};
+static const IID   IID_IElevator2Chrome = {0x1BF5208B, 0x295F, 0x4992, {0xB5, 0xF4, 0x3A, 0x9B, 0xB6, 0x49, 0x48, 0x38}};
+
+/* Chrome Beta */
+static const CLSID CLSID_ChromeBeta = {0xDD2646BA, 0x3707, 0x4BF8, {0xB9, 0xA7, 0x03, 0x86, 0x91, 0xA6, 0x8F, 0xC2}};
+static const IID   IID_IElevatorChromeBeta = {0xA2721D66, 0x376E, 0x4D2F, {0x9F, 0x0F, 0x90, 0x70, 0xE9, 0xA4, 0x2B, 0x5F}};
+static const IID   IID_IElevator2ChromeBeta = {0xB96A14B8, 0xD0B0, 0x44D8, {0xBA, 0x68, 0x23, 0x85, 0xB2, 0xA0, 0x32, 0x54}};
+
+/* Brave — reuses Chrome's IElevator IID */
+static const CLSID CLSID_Brave = {0x576B31AF, 0x6369, 0x4B6B, {0x85, 0x60, 0xE4, 0xB2, 0x03, 0xA9, 0x7A, 0x8B}};
+static const IID   IID_IElevatorBrave = {0xF396861E, 0x0C8E, 0x4C71, {0x82, 0x56, 0x2F, 0xAE, 0x6D, 0x75, 0x9C, 0xE9}};
+/* Brave reuses Chrome's v2 IID: IID_IElevator2Chrome */
+
+/* Edge */
+static const CLSID CLSID_Edge = {0x1FCBE96C, 0x1697, 0x43AF, {0x91, 0x40, 0x28, 0x97, 0xC7, 0xC6, 0x97, 0x67}};
+static const IID   IID_IElevatorEdge = {0xC9C2B807, 0x7731, 0x4F34, {0x81, 0xB7, 0x44, 0xFF, 0x77, 0x79, 0x52, 0x2B}};
+static const IID   IID_IElevator2Edge = {0x8F7B6792, 0x784D, 0x4047, {0x84, 0x5D, 0x17, 0x82, 0xEF, 0xBE, 0xF2, 0x05}};
+
+static const BrowserCOM browsers[] = {
+    {"chrome",      {0}, {0}, {0}, 0},  /* filled below */
+    {"chrome-beta", {0}, {0}, {0}, 0},
+    {"brave",       {0}, {0}, {0}, 0},
+    {"edge",        {0}, {0}, {0}, 1},
+};
+
+static int get_browser(const char *name, const CLSID **clsid, const IID **iid, const IID **iid_v2, int *isEdge) {
+    if (strcmp(name, "chrome") == 0) {
+        *clsid = &CLSID_Chrome; *iid = &IID_IElevatorChrome; *iid_v2 = &IID_IElevator2Chrome; *isEdge = 0;
+    } else if (strcmp(name, "chrome-beta") == 0) {
+        *clsid = &CLSID_ChromeBeta; *iid = &IID_IElevatorChromeBeta; *iid_v2 = &IID_IElevator2ChromeBeta; *isEdge = 0;
+    } else if (strcmp(name, "brave") == 0) {
+        *clsid = &CLSID_Brave; *iid = &IID_IElevatorBrave; *iid_v2 = &IID_IElevator2Chrome; *isEdge = 0;
+    } else if (strcmp(name, "edge") == 0) {
+        *clsid = &CLSID_Edge; *iid = &IID_IElevatorEdge; *iid_v2 = &IID_IElevator2Edge; *isEdge = 1;
+    } else {
+        return -1;
+    }
+    return 0;
+}
+
+/* ---------- Decrypt via COM ---------- */
+
+static HRESULT decrypt_via_com(
+    const CLSID *clsid,
+    const IID *iid,
+    const IID *iid_v2,
+    int isEdge,
+    const unsigned char *encData,
+    DWORD encLen,
+    unsigned char **outData,
+    DWORD *outLen
+) {
+    BSTR bstrEnc = SysAllocStringByteLen((const char *)encData, encLen);
+    if (!bstrEnc) return E_OUTOFMEMORY;
+
+    BSTR bstrPlain = NULL;
+    DWORD comErr = 0;
+    HRESULT hr = E_FAIL;
+
+    if (isEdge) {
+        /* Edge: try v2 first, then v1 */
+        IEdgeElevator *elevator = NULL;
+
+        /* Try v2 */
+        hr = CoCreateInstance(clsid, NULL, CLSCTX_LOCAL_SERVER, iid_v2, (void **)&elevator);
+        if (SUCCEEDED(hr)) {
+            CoSetProxyBlanket((IUnknown *)elevator, RPC_C_AUTHN_DEFAULT, RPC_C_AUTHZ_DEFAULT,
+                COLE_DEFAULT_PRINCIPAL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
+                RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_DYNAMIC_CLOAKING);
+            hr = elevator->lpVtbl->DecryptData(elevator, bstrEnc, &bstrPlain, &comErr);
+            elevator->lpVtbl->Release(elevator);
+        }
+
+        /* Fall back to v1 */
+        if (FAILED(hr)) {
+            elevator = NULL;
+            hr = CoCreateInstance(clsid, NULL, CLSCTX_LOCAL_SERVER, iid, (void **)&elevator);
+            if (SUCCEEDED(hr)) {
+                CoSetProxyBlanket((IUnknown *)elevator, RPC_C_AUTHN_DEFAULT, RPC_C_AUTHZ_DEFAULT,
+                    COLE_DEFAULT_PRINCIPAL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
+                    RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_DYNAMIC_CLOAKING);
+                hr = elevator->lpVtbl->DecryptData(elevator, bstrEnc, &bstrPlain, &comErr);
+                elevator->lpVtbl->Release(elevator);
+            }
+        }
+    } else {
+        /* Chrome/Brave: try v2 first, then v1 */
+        IElevator *elevator = NULL;
+
+        /* Try v2 (Chrome 144+) */
+        hr = CoCreateInstance(clsid, NULL, CLSCTX_LOCAL_SERVER, iid_v2, (void **)&elevator);
+        if (FAILED(hr) || hr == (HRESULT)0x80040154L /* REGDB_E_CLASSNOTREG */) {
+            /* Fall back to v1 */
+            hr = CoCreateInstance(clsid, NULL, CLSCTX_LOCAL_SERVER, iid, (void **)&elevator);
+        }
+
+        if (SUCCEEDED(hr)) {
+            CoSetProxyBlanket((IUnknown *)elevator, RPC_C_AUTHN_DEFAULT, RPC_C_AUTHZ_DEFAULT,
+                COLE_DEFAULT_PRINCIPAL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
+                RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_DYNAMIC_CLOAKING);
+            hr = elevator->lpVtbl->DecryptData(elevator, bstrEnc, &bstrPlain, &comErr);
+            elevator->lpVtbl->Release(elevator);
+        }
+    }
+
+    SysFreeString(bstrEnc);
+
+    if (FAILED(hr) || !bstrPlain) {
+        if (bstrPlain) SysFreeString(bstrPlain);
+        return FAILED(hr) ? hr : E_FAIL;
+    }
+
+    *outLen = SysStringByteLen(bstrPlain);
+    *outData = (unsigned char *)malloc(*outLen);
+    if (!*outData) {
+        SysFreeString(bstrPlain);
+        return E_OUTOFMEMORY;
+    }
+    memcpy(*outData, bstrPlain, *outLen);
+    SysFreeString(bstrPlain);
+    return S_OK;
+}
+
+/* ---------- main ---------- */
+
+int main(int argc, char *argv[]) {
+    if (argc < 2) {
+        fprintf(stderr, "Usage: chrome_abe_decrypt.exe <browser>\n");
+        fprintf(stderr, "  browser: chrome, chrome-beta, brave, edge\n");
+        fprintf(stderr, "Reads base64 encrypted key from stdin, writes base64 decrypted key to stdout.\n");
+        return 1;
+    }
+
+    const char *browserName = argv[1];
+    const CLSID *clsid;
+    const IID *iid, *iid_v2;
+    int isEdge;
+
+    if (get_browser(browserName, &clsid, &iid, &iid_v2, &isEdge) != 0) {
+        fprintf(stderr, "ERROR: Unknown browser '%s'. Use: chrome, chrome-beta, brave, edge\n", browserName);
+        return 1;
+    }
+
+    /* Read base64 input from stdin */
+    char input[65536];
+    size_t totalRead = 0;
+    while (totalRead < sizeof(input) - 1) {
+        size_t n = fread(input + totalRead, 1, sizeof(input) - 1 - totalRead, stdin);
+        if (n == 0) break;
+        totalRead += n;
+    }
+    input[totalRead] = '\0';
+
+    /* Trim whitespace */
+    while (totalRead > 0 && (input[totalRead-1] == '\n' || input[totalRead-1] == '\r' || input[totalRead-1] == ' ')) {
+        input[--totalRead] = '\0';
+    }
+
+    if (totalRead == 0) {
+        fprintf(stderr, "ERROR: No input received on stdin\n");
+        return 1;
+    }
+
+    /* Decode base64 input */
+    unsigned char *encData = NULL;
+    DWORD encLen = 0;
+    if (b64_decode(input, &encData, &encLen) != 0) {
+        fprintf(stderr, "ERROR: Failed to decode base64 input\n");
+        return 1;
+    }
+
+    /* Initialize COM */
+    HRESULT hr = CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
+    if (FAILED(hr)) {
+        fprintf(stderr, "ERROR: CoInitializeEx failed: 0x%08lX\n", hr);
+        free(encData);
+        return 1;
+    }
+
+    /* Decrypt */
+    unsigned char *decData = NULL;
+    DWORD decLen = 0;
+    hr = decrypt_via_com(clsid, iid, iid_v2, isEdge, encData, encLen, &decData, &decLen);
+    free(encData);
+
+    if (FAILED(hr)) {
+        fprintf(stderr, "ERROR: DecryptData failed: 0x%08lX\n", hr);
+        CoUninitialize();
+        return 1;
+    }
+
+    /* Encode result as base64 and write to stdout */
+    char *b64out = NULL;
+    if (b64_encode(decData, decLen, &b64out) != 0) {
+        fprintf(stderr, "ERROR: Failed to encode result as base64\n");
+        free(decData);
+        CoUninitialize();
+        return 1;
+    }
+
+    printf("%s", b64out);
+    fflush(stdout);
+
+    free(b64out);
+    free(decData);
+    CoUninitialize();
+    return 0;
+}