chrome-tools 1.1.14 → 1.1.16

package/dist/src/modules/passwords.js

@@ -1,198 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { discoverProfiles, resolveTargetProfiles, } from "../core/chrome.js";
-import { deriveEncryptionKey, decryptValue } from "../core/platform/index.js";
-import { chromeTimeToDate } from "../core/crypto.js";
-import { queryDatabase } from "../core/db.js";
-/**
- * Chrome stores saved passwords in two SQLite files per profile:
- *   - "Login Data"             — passwords kept on this device only.
- *   - "Login Data For Account" — passwords synced to the signed-in Google Account.
- * Both share the same `logins` schema and v10 encryption, so we read both and
- * tag each entry with its source.
- */
-const PASSWORD_STORES = [
-    { file: "Login Data", source: "device" },
-    { file: "Login Data For Account", source: "account" },
-];
-/** Where a CDP launcher keeps the User Data directory it drives Chrome with. */
-const AUTOMATION_DIR = join(homedir(), ".chrome_cdp_profile");
-/** …and where it records a relocated one. */
-const AUTOMATION_CONFIG = join(homedir(), ".config", "chrome-cdp-manager", "config.json");
-/** `CHROME_AUTOMATION_DIR` values meaning "do not look there at all". */
-const AUTOMATION_OFF = ["0", "off", "none", "false"];
-/**
- * The automation profile tree, on a machine that has one.
- *
- * Most machines do not: no CDP launcher is installed, the directory was never
- * created, or it exists but holds no profile yet. All three answer undefined,
- * which leaves the search exactly as it was before this existed — the everyday
- * profile, alone. Nothing here is required for a plain Chrome install.
- *
- * `CHROME_AUTOMATION_DIR` names the tree explicitly, and `off` (or `0`, `none`,
- * `false`) skips it even where one exists.
- */
-function automationChromeDir() {
-    const override = process.env.CHROME_AUTOMATION_DIR?.trim();
-    if (override && AUTOMATION_OFF.includes(override.toLowerCase()))
-        return undefined;
-    const dir = override || configuredAutomationDir() || AUTOMATION_DIR;
-    // Holding a profile is what makes it a tree worth reading — an absent or
-    // empty directory would otherwise add a root every lookup searches for
-    // nothing, and turn a missing `--profile` into a spurious refusal.
-    return discoverProfiles(dir).length > 0 ? dir : undefined;
-}
-/** The profile directory a CDP launcher was configured with, if it says. */
-function configuredAutomationDir() {
-    try {
-        const stored = JSON.parse(readFileSync(AUTOMATION_CONFIG, "utf-8"));
-        return typeof stored.profileDir === "string" && stored.profileDir ? stored.profileDir : undefined;
-    }
-    catch {
-        // No launcher config, or an unreadable one: fall back to its default path.
-        return undefined;
-    }
-}
-/**
- * The User Data directories a lookup reads, in order.
- *
- * The automation tree first, then the everyday one. A Chrome driven over CDP
- * keeps its own profile tree, so a login saved while signing in to that window
- * is stored there and nowhere else — looking only at the everyday tree could
- * not find it. Naming a directory or a browser answers "which tree?" outright,
- * and is used as given.
- */
-function passwordRoots(userDataDir, browser) {
-    const roots = [];
-    const automation = userDataDir || browser ? undefined : automationChromeDir();
-    if (automation)
-        roots.push(automation);
-    roots.push(userDataDir);
-    return roots;
-}
-/**
- * Reports what a `getPasswords` call would read, and what it could not.
- *
- * `getPasswords` skips a store it cannot open — a missing file, a schema it does
- * not know, a database another process is holding — and an empty result cannot
- * tell "nothing saved here" from "could not look". This runs the same profile
- * resolution and opens the same databases, and answers with row counts and
- * errors only. It decrypts nothing, so no password value can escape through it.
- */
-export function describePasswordStores({ chromeDir, profilePath, profile, browser, } = {}) {
-    const userDataDir = profilePath || chromeDir;
-    const reports = [];
-    for (const root of passwordRoots(userDataDir, browser)) {
-        let profiles;
-        try {
-            profiles = resolveTargetProfiles({ chromeDir: root, profile, browser });
-        }
-        catch (error) {
-            reports.push({
-                root: root ?? "default",
-                profile: profile ?? "*",
-                file: "*",
-                source: "device",
-                exists: false,
-                rows: null,
-                error: error instanceof Error ? error.message : String(error),
-            });
-            continue;
-        }
-        for (const p of profiles) {
-            for (const store of PASSWORD_STORES) {
-                const dbPath = join(p.path, store.file);
-                const report = {
-                    root: root ?? "default",
-                    profile: p.name,
-                    file: store.file,
-                    source: store.source,
-                    exists: existsSync(dbPath),
-                    rows: null,
-                };
-                try {
-                    report.rows = queryDatabase(dbPath, "SELECT COUNT(*) AS n FROM logins")[0]?.n ?? 0;
-                }
-                catch (error) {
-                    report.error = error instanceof Error ? error.message : String(error);
-                }
-                reports.push(report);
-            }
-        }
-    }
-    return reports;
-}
-/**
- * Extracts and decrypts saved passwords from Chrome's password databases.
- * Reads both the device-local and account-synced stores, labelling each entry
- * with its `source` (no de-duplication across the two).
- *
- * @param options - Options for profile selection and filtering.
- * @returns Array of decrypted password entries.
- */
-export function getPasswords({ chromeDir, profilePath, profile, search, browser, decryptionKey, } = {}) {
-    const userDataDir = profilePath || chromeDir;
-    const roots = passwordRoots(userDataDir, browser);
-    const results = [];
-    const term = search?.toLowerCase();
-    // A named profile missing from one tree is not a failure while another is
-    // still to come — but a profile in none of them is still an error, so the
-    // first refusal is kept and raised if no tree resolved at all.
-    let refusal;
-    let resolved = false;
-    for (const root of roots) {
-        let profiles;
-        try {
-            profiles = resolveTargetProfiles({ chromeDir: root, profile, browser });
-        }
-        catch (error) {
-            refusal ??= error;
-            continue;
-        }
-        resolved = true;
-        // Per root: on Windows the key comes from that tree's own Local State.
-        let derivedKey = decryptionKey;
-        for (const p of profiles) {
-            for (const store of PASSWORD_STORES) {
-                const dbPath = join(p.path, store.file);
-                try {
-                    const rows = queryDatabase(dbPath, `SELECT origin_url, username_value, password_value, date_last_used
-             FROM logins ORDER BY origin_url`);
-                    for (const row of rows) {
-                        // Matched before anything is decrypted. Both columns the search
-                        // looks at — the origin and the username — are stored in the clear,
-                        // so a row that cannot match never needs its password read at all.
-                        //
-                        // Decrypting first cost one platform decryption per stored login on
-                        // the way to finding one: a store with a few hundred entries spent
-                        // upwards of ten seconds answering "what is the password for this
-                        // one site", and every one of those decryptions was thrown away by
-                        // the filter immediately below.
-                        if (term &&
-                            !(row.origin_url && row.origin_url.toLowerCase().includes(term)) &&
-                            !(row.username_value && row.username_value.toLowerCase().includes(term))) {
-                            continue;
-                        }
-                        results.push({
-                            profile: p.name,
-                            source: store.source,
-                            url: row.origin_url,
-                            username: row.username_value,
-                            password: row.password_value?.length > 0
-                                ? decryptValue(row.password_value, derivedKey ??= deriveEncryptionKey(root, browser))
-                                : "",
-                            lastUsed: chromeTimeToDate(row.date_last_used || 0),
-                        });
-                    }
-                }
-                catch {
-                    // Skip missing or unreadable stores and continue with the others.
-                }
-            }
-        }
-    }
-    if (!resolved && refusal)
-        throw refusal;
-    return results;
-}

package/dist/src/modules/search-engines.d.ts

@@ -1,21 +0,0 @@
-import { type ResolveProfilesOptions } from "../core/chrome.js";
-export interface SearchEngineOptions extends ResolveProfilesOptions {
-}
-export interface SearchEngineEntry {
-    profile: string;
-    id: number;
-    name: string;
-    keyword: string;
-    url: string;
-    suggestionsUrl: string;
-    faviconUrl: string;
-    isDefault: boolean;
-    isActive: boolean;
-}
-/**
- * Retrieves search engines configured in Chrome from the Web Data database.
- *
- * @param options - Targeting options.
- * @returns Array of search engine entries.
- */
-export declare function getSearchEngines({ chromeDir, profilePath, profile, browser, }?: SearchEngineOptions): SearchEngineEntry[];

package/dist/src/modules/search-engines.js

@@ -1,38 +0,0 @@
-import { join } from "node:path";
-import { resolveTargetProfiles } from "../core/chrome.js";
-import { queryDatabase } from "../core/db.js";
-/**
- * Retrieves search engines configured in Chrome from the Web Data database.
- *
- * @param options - Targeting options.
- * @returns Array of search engine entries.
- */
-export function getSearchEngines({ chromeDir, profilePath, profile, browser, } = {}) {
-    const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
-    const results = [];
-    for (const p of profiles) {
-        const dbPath = join(p.path, "Web Data");
-        try {
-            const rows = queryDatabase(dbPath, `SELECT id, short_name, keyword, url, suggestions_url,
-                favicon_url, prepopulate_id, is_active
-         FROM keywords ORDER BY short_name`);
-            for (const row of rows) {
-                results.push({
-                    profile: p.name,
-                    id: row.id,
-                    name: row.short_name || "",
-                    keyword: row.keyword || "",
-                    url: row.url || "",
-                    suggestionsUrl: row.suggestions_url || "",
-                    faviconUrl: row.favicon_url || "",
-                    isDefault: row.prepopulate_id === 1,
-                    isActive: row.is_active === 1,
-                });
-            }
-        }
-        catch {
-            // Skip profiles with errors
-        }
-    }
-    return results;
-}

package/dist/src/modules/top-sites.d.ts

@@ -1,17 +0,0 @@
-import { type ResolveProfilesOptions } from "../core/chrome.js";
-export interface TopSiteOptions extends ResolveProfilesOptions {
-}
-export interface TopSiteEntry {
-    profile: string;
-    url: string;
-    title: string;
-    rank: number;
-    redirects: string;
-}
-/**
- * Retrieves top sites from Chrome's Top Sites database.
- *
- * @param options - Targeting options.
- * @returns Array of top site entries.
- */
-export declare function getTopSites({ chromeDir, profilePath, profile, browser }?: TopSiteOptions): TopSiteEntry[];

package/dist/src/modules/top-sites.js

@@ -1,33 +0,0 @@
-import { join } from "node:path";
-import { resolveTargetProfiles } from "../core/chrome.js";
-import { queryDatabase } from "../core/db.js";
-/**
- * Retrieves top sites from Chrome's Top Sites database.
- *
- * @param options - Targeting options.
- * @returns Array of top site entries.
- */
-export function getTopSites({ chromeDir, profilePath, profile, browser } = {}) {
-    const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
-    const results = [];
-    for (const p of profiles) {
-        const dbPath = join(p.path, "Top Sites");
-        try {
-            const rows = queryDatabase(dbPath, `SELECT url, url_rank, title, redirects
-         FROM top_sites ORDER BY url_rank ASC`);
-            for (const row of rows) {
-                results.push({
-                    profile: p.name,
-                    url: row.url || "",
-                    title: row.title || "",
-                    rank: row.url_rank ?? 0,
-                    redirects: row.redirects || "",
-                });
-            }
-        }
-        catch {
-            // Skip profiles with errors
-        }
-    }
-    return results;
-}

package/src/native/build.bat

@@ -1,31 +0,0 @@
-@echo off
-REM Build chrome_abe_decrypt.exe with MSVC
-REM Run from a Visual Studio Developer Command Prompt or after calling vcvarsall.bat
-
-where cl.exe >nul 2>nul
-if %ERRORLEVEL% neq 0 (
-    if exist "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvarsall.bat" (
-        call "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvarsall.bat" x64
-    ) else if exist "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsall.bat" (
-        call "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsall.bat" x64
-    ) else if exist "C:\Program Files\Microsoft Visual Studio\2022\Professional\VC\Auxiliary\Build\vcvarsall.bat" (
-        call "C:\Program Files\Microsoft Visual Studio\2022\Professional\VC\Auxiliary\Build\vcvarsall.bat" x64
-    ) else if exist "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" (
-        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x64
-    )
-)
-
-cl.exe /nologo /O2 /W3 /Fe:chrome_abe_decrypt.exe chrome_abe_decrypt.c ole32.lib oleaut32.lib crypt32.lib advapi32.lib
-
-if %ERRORLEVEL% neq 0 (
-    echo Build failed.
-    exit /b 1
-)
-
-echo.
-echo Built: chrome_abe_decrypt.exe
-echo.
-echo Usage: chrome_abe_decrypt.exe ^<browser^>
-echo   Reads base64 app_bound_encrypted_key from stdin
-echo   Writes base64 decrypted key to stdout
-echo   browser: chrome, chrome-beta, brave, edge

package/src/native/chrome_abe_decrypt.c

@@ -1,336 +0,0 @@
-/*
- * chrome_abe_decrypt.c — Minimal Chrome App-Bound Encryption key decryptor.
- *
- * Calls Chrome's IElevator COM service to decrypt an app_bound_encrypted_key.
- * Derived from xaitax/Chrome-App-Bound-Encryption-Decryption (MIT License).
- *
- * Usage:  chrome_abe_decrypt.exe <browser> < base64_encrypted_key
- *         Outputs: base64-encoded decrypted key to stdout
- *
- * <browser> is one of: chrome, chrome-beta, brave, edge
- *
- * Build:  cl.exe /O2 chrome_abe_decrypt.c ole32.lib oleaut32.lib advapi32.lib
- *
- * Copyright (c) 2024 Alexander 'xaitax' Hagenah (original COM logic)
- * MIT License
- */
-
-#define WIN32_LEAN_AND_MEAN
-#define COBJMACROS
-#include <windows.h>
-#include <objbase.h>
-#include <oleauto.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-/* ---------- base64 helpers (Windows CryptBinaryToStringA) ---------- */
-#pragma comment(lib, "crypt32.lib")
-#include <wincrypt.h>
-
-static int b64_decode(const char *b64, unsigned char **out, DWORD *outLen) {
-    DWORD len = 0;
-    if (!CryptStringToBinaryA(b64, 0, CRYPT_STRING_BASE64, NULL, &len, NULL, NULL))
-        return -1;
-    *out = (unsigned char *)malloc(len);
-    if (!*out) return -1;
-    if (!CryptStringToBinaryA(b64, 0, CRYPT_STRING_BASE64, *out, &len, NULL, NULL)) {
-        free(*out);
-        return -1;
-    }
-    *outLen = len;
-    return 0;
-}
-
-static int b64_encode(const unsigned char *data, DWORD dataLen, char **out) {
-    DWORD len = 0;
-    if (!CryptBinaryToStringA(data, dataLen, CRYPT_STRING_BASE64 | CRYPT_STRING_NOCRLF, NULL, &len))
-        return -1;
-    *out = (char *)malloc(len + 1);
-    if (!*out) return -1;
-    if (!CryptBinaryToStringA(data, dataLen, CRYPT_STRING_BASE64 | CRYPT_STRING_NOCRLF, *out, &len)) {
-        free(*out);
-        return -1;
-    }
-    (*out)[len] = '\0';
-    return 0;
-}
-
-/* ---------- IElevator COM interface (vtable-based, pure C) ---------- */
-
-/*
- * IElevator vtable layout (Chrome/Brave — 3 custom methods):
- *   [0] QueryInterface
- *   [1] AddRef
- *   [2] Release
- *   [3] RunRecoveryCRXElevated
- *   [4] EncryptData
- *   [5] DecryptData
- */
-typedef struct IElevatorVtbl {
-    /* IUnknown */
-    HRESULT (STDMETHODCALLTYPE *QueryInterface)(void *This, REFIID riid, void **ppv);
-    ULONG   (STDMETHODCALLTYPE *AddRef)(void *This);
-    ULONG   (STDMETHODCALLTYPE *Release)(void *This);
-    /* IElevator */
-    HRESULT (STDMETHODCALLTYPE *RunRecoveryCRXElevated)(void *This, const WCHAR*, const WCHAR*, const WCHAR*, const WCHAR*, DWORD, ULONG_PTR*);
-    HRESULT (STDMETHODCALLTYPE *EncryptData)(void *This, int protLevel, BSTR in, BSTR *out, DWORD *err);
-    HRESULT (STDMETHODCALLTYPE *DecryptData)(void *This, BSTR in, BSTR *out, DWORD *err);
-} IElevatorVtbl;
-
-typedef struct IElevator {
-    IElevatorVtbl *lpVtbl;
-} IElevator;
-
-/*
- * Edge vtable layout — has 3 extra base methods before the IElevator methods:
- *   [0] QueryInterface
- *   [1] AddRef
- *   [2] Release
- *   [3] EdgeBaseMethod1
- *   [4] EdgeBaseMethod2
- *   [5] EdgeBaseMethod3
- *   [6] RunRecoveryCRXElevated
- *   [7] EncryptData
- *   [8] DecryptData
- */
-typedef struct IEdgeElevatorVtbl {
-    /* IUnknown */
-    HRESULT (STDMETHODCALLTYPE *QueryInterface)(void *This, REFIID riid, void **ppv);
-    ULONG   (STDMETHODCALLTYPE *AddRef)(void *This);
-    ULONG   (STDMETHODCALLTYPE *Release)(void *This);
-    /* IEdgeElevatorBase (3 unknown methods) */
-    HRESULT (STDMETHODCALLTYPE *EdgeBase1)(void *This);
-    HRESULT (STDMETHODCALLTYPE *EdgeBase2)(void *This);
-    HRESULT (STDMETHODCALLTYPE *EdgeBase3)(void *This);
-    /* IElevator */
-    HRESULT (STDMETHODCALLTYPE *RunRecoveryCRXElevated)(void *This, const WCHAR*, const WCHAR*, const WCHAR*, const WCHAR*, DWORD, ULONG_PTR*);
-    HRESULT (STDMETHODCALLTYPE *EncryptData)(void *This, int protLevel, BSTR in, BSTR *out, DWORD *err);
-    HRESULT (STDMETHODCALLTYPE *DecryptData)(void *This, BSTR in, BSTR *out, DWORD *err);
-} IEdgeElevatorVtbl;
-
-typedef struct IEdgeElevator {
-    IEdgeElevatorVtbl *lpVtbl;
-} IEdgeElevator;
-
-/* ---------- Browser COM identifiers ---------- */
-/* From xaitax/Chrome-App-Bound-Encryption-Decryption/src/payload/browser_config.hpp */
-
-typedef struct BrowserCOM {
-    const char *name;
-    CLSID clsid;
-    IID   iid;       /* IElevator v1 */
-    IID   iid_v2;    /* IElevator v2 (Chrome 144+), GUID_NULL if none */
-    int   isEdge;
-} BrowserCOM;
-
-/* Chrome */
-static const CLSID CLSID_Chrome = {0x708860E0, 0xF641, 0x4611, {0x88, 0x95, 0x7D, 0x86, 0x7D, 0xD3, 0x67, 0x5B}};
-static const IID   IID_IElevatorChrome = {0x463ABECF, 0x410D, 0x407F, {0x8A, 0xF5, 0x0D, 0xF3, 0x5A, 0x00, 0x5C, 0xC8}};
-static const IID   IID_IElevator2Chrome = {0x1BF5208B, 0x295F, 0x4992, {0xB5, 0xF4, 0x3A, 0x9B, 0xB6, 0x49, 0x48, 0x38}};
-
-/* Chrome Beta */
-static const CLSID CLSID_ChromeBeta = {0xDD2646BA, 0x3707, 0x4BF8, {0xB9, 0xA7, 0x03, 0x86, 0x91, 0xA6, 0x8F, 0xC2}};
-static const IID   IID_IElevatorChromeBeta = {0xA2721D66, 0x376E, 0x4D2F, {0x9F, 0x0F, 0x90, 0x70, 0xE9, 0xA4, 0x2B, 0x5F}};
-static const IID   IID_IElevator2ChromeBeta = {0xB96A14B8, 0xD0B0, 0x44D8, {0xBA, 0x68, 0x23, 0x85, 0xB2, 0xA0, 0x32, 0x54}};
-
-/* Brave — reuses Chrome's IElevator IID */
-static const CLSID CLSID_Brave = {0x576B31AF, 0x6369, 0x4B6B, {0x85, 0x60, 0xE4, 0xB2, 0x03, 0xA9, 0x7A, 0x8B}};
-static const IID   IID_IElevatorBrave = {0xF396861E, 0x0C8E, 0x4C71, {0x82, 0x56, 0x2F, 0xAE, 0x6D, 0x75, 0x9C, 0xE9}};
-/* Brave reuses Chrome's v2 IID: IID_IElevator2Chrome */
-
-/* Edge */
-static const CLSID CLSID_Edge = {0x1FCBE96C, 0x1697, 0x43AF, {0x91, 0x40, 0x28, 0x97, 0xC7, 0xC6, 0x97, 0x67}};
-static const IID   IID_IElevatorEdge = {0xC9C2B807, 0x7731, 0x4F34, {0x81, 0xB7, 0x44, 0xFF, 0x77, 0x79, 0x52, 0x2B}};
-static const IID   IID_IElevator2Edge = {0x8F7B6792, 0x784D, 0x4047, {0x84, 0x5D, 0x17, 0x82, 0xEF, 0xBE, 0xF2, 0x05}};
-
-static const BrowserCOM browsers[] = {
-    {"chrome",      {0}, {0}, {0}, 0},  /* filled below */
-    {"chrome-beta", {0}, {0}, {0}, 0},
-    {"brave",       {0}, {0}, {0}, 0},
-    {"edge",        {0}, {0}, {0}, 1},
-};
-
-static int get_browser(const char *name, const CLSID **clsid, const IID **iid, const IID **iid_v2, int *isEdge) {
-    if (strcmp(name, "chrome") == 0) {
-        *clsid = &CLSID_Chrome; *iid = &IID_IElevatorChrome; *iid_v2 = &IID_IElevator2Chrome; *isEdge = 0;
-    } else if (strcmp(name, "chrome-beta") == 0) {
-        *clsid = &CLSID_ChromeBeta; *iid = &IID_IElevatorChromeBeta; *iid_v2 = &IID_IElevator2ChromeBeta; *isEdge = 0;
-    } else if (strcmp(name, "brave") == 0) {
-        *clsid = &CLSID_Brave; *iid = &IID_IElevatorBrave; *iid_v2 = &IID_IElevator2Chrome; *isEdge = 0;
-    } else if (strcmp(name, "edge") == 0) {
-        *clsid = &CLSID_Edge; *iid = &IID_IElevatorEdge; *iid_v2 = &IID_IElevator2Edge; *isEdge = 1;
-    } else {
-        return -1;
-    }
-    return 0;
-}
-
-/* ---------- Decrypt via COM ---------- */
-
-static HRESULT decrypt_via_com(
-    const CLSID *clsid,
-    const IID *iid,
-    const IID *iid_v2,
-    int isEdge,
-    const unsigned char *encData,
-    DWORD encLen,
-    unsigned char **outData,
-    DWORD *outLen
-) {
-    BSTR bstrEnc = SysAllocStringByteLen((const char *)encData, encLen);
-    if (!bstrEnc) return E_OUTOFMEMORY;
-
-    BSTR bstrPlain = NULL;
-    DWORD comErr = 0;
-    HRESULT hr = E_FAIL;
-
-    if (isEdge) {
-        /* Edge: try v2 first, then v1 */
-        IEdgeElevator *elevator = NULL;
-
-        /* Try v2 */
-        hr = CoCreateInstance(clsid, NULL, CLSCTX_LOCAL_SERVER, iid_v2, (void **)&elevator);
-        if (SUCCEEDED(hr)) {
-            CoSetProxyBlanket((IUnknown *)elevator, RPC_C_AUTHN_DEFAULT, RPC_C_AUTHZ_DEFAULT,
-                COLE_DEFAULT_PRINCIPAL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
-                RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_DYNAMIC_CLOAKING);
-            hr = elevator->lpVtbl->DecryptData(elevator, bstrEnc, &bstrPlain, &comErr);
-            elevator->lpVtbl->Release(elevator);
-        }
-
-        /* Fall back to v1 */
-        if (FAILED(hr)) {
-            elevator = NULL;
-            hr = CoCreateInstance(clsid, NULL, CLSCTX_LOCAL_SERVER, iid, (void **)&elevator);
-            if (SUCCEEDED(hr)) {
-                CoSetProxyBlanket((IUnknown *)elevator, RPC_C_AUTHN_DEFAULT, RPC_C_AUTHZ_DEFAULT,
-                    COLE_DEFAULT_PRINCIPAL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
-                    RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_DYNAMIC_CLOAKING);
-                hr = elevator->lpVtbl->DecryptData(elevator, bstrEnc, &bstrPlain, &comErr);
-                elevator->lpVtbl->Release(elevator);
-            }
-        }
-    } else {
-        /* Chrome/Brave: try v2 first, then v1 */
-        IElevator *elevator = NULL;
-
-        /* Try v2 (Chrome 144+) */
-        hr = CoCreateInstance(clsid, NULL, CLSCTX_LOCAL_SERVER, iid_v2, (void **)&elevator);
-        if (FAILED(hr) || hr == (HRESULT)0x80040154L /* REGDB_E_CLASSNOTREG */) {
-            /* Fall back to v1 */
-            hr = CoCreateInstance(clsid, NULL, CLSCTX_LOCAL_SERVER, iid, (void **)&elevator);
-        }
-
-        if (SUCCEEDED(hr)) {
-            CoSetProxyBlanket((IUnknown *)elevator, RPC_C_AUTHN_DEFAULT, RPC_C_AUTHZ_DEFAULT,
-                COLE_DEFAULT_PRINCIPAL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
-                RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_DYNAMIC_CLOAKING);
-            hr = elevator->lpVtbl->DecryptData(elevator, bstrEnc, &bstrPlain, &comErr);
-            elevator->lpVtbl->Release(elevator);
-        }
-    }
-
-    SysFreeString(bstrEnc);
-
-    if (FAILED(hr) || !bstrPlain) {
-        if (bstrPlain) SysFreeString(bstrPlain);
-        return FAILED(hr) ? hr : E_FAIL;
-    }
-
-    *outLen = SysStringByteLen(bstrPlain);
-    *outData = (unsigned char *)malloc(*outLen);
-    if (!*outData) {
-        SysFreeString(bstrPlain);
-        return E_OUTOFMEMORY;
-    }
-    memcpy(*outData, bstrPlain, *outLen);
-    SysFreeString(bstrPlain);
-    return S_OK;
-}
-
-/* ---------- main ---------- */
-
-int main(int argc, char *argv[]) {
-    if (argc < 2) {
-        fprintf(stderr, "Usage: chrome_abe_decrypt.exe <browser>\n");
-        fprintf(stderr, "  browser: chrome, chrome-beta, brave, edge\n");
-        fprintf(stderr, "Reads base64 encrypted key from stdin, writes base64 decrypted key to stdout.\n");
-        return 1;
-    }
-
-    const char *browserName = argv[1];
-    const CLSID *clsid;
-    const IID *iid, *iid_v2;
-    int isEdge;
-
-    if (get_browser(browserName, &clsid, &iid, &iid_v2, &isEdge) != 0) {
-        fprintf(stderr, "ERROR: Unknown browser '%s'. Use: chrome, chrome-beta, brave, edge\n", browserName);
-        return 1;
-    }
-
-    /* Read base64 input from stdin */
-    char input[65536];
-    size_t totalRead = 0;
-    while (totalRead < sizeof(input) - 1) {
-        size_t n = fread(input + totalRead, 1, sizeof(input) - 1 - totalRead, stdin);
-        if (n == 0) break;
-        totalRead += n;
-    }
-    input[totalRead] = '\0';
-
-    /* Trim whitespace */
-    while (totalRead > 0 && (input[totalRead-1] == '\n' || input[totalRead-1] == '\r' || input[totalRead-1] == ' ')) {
-        input[--totalRead] = '\0';
-    }
-
-    if (totalRead == 0) {
-        fprintf(stderr, "ERROR: No input received on stdin\n");
-        return 1;
-    }
-
-    /* Decode base64 input */
-    unsigned char *encData = NULL;
-    DWORD encLen = 0;
-    if (b64_decode(input, &encData, &encLen) != 0) {
-        fprintf(stderr, "ERROR: Failed to decode base64 input\n");
-        return 1;
-    }
-
-    /* Initialize COM */
-    HRESULT hr = CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
-    if (FAILED(hr)) {
-        fprintf(stderr, "ERROR: CoInitializeEx failed: 0x%08lX\n", hr);
-        free(encData);
-        return 1;
-    }
-
-    /* Decrypt */
-    unsigned char *decData = NULL;
-    DWORD decLen = 0;
-    hr = decrypt_via_com(clsid, iid, iid_v2, isEdge, encData, encLen, &decData, &decLen);
-    free(encData);
-
-    if (FAILED(hr)) {
-        fprintf(stderr, "ERROR: DecryptData failed: 0x%08lX\n", hr);
-        CoUninitialize();
-        return 1;
-    }
-
-    /* Encode result as base64 and write to stdout */
-    char *b64out = NULL;
-    if (b64_encode(decData, decLen, &b64out) != 0) {
-        fprintf(stderr, "ERROR: Failed to encode result as base64\n");
-        free(decData);
-        CoUninitialize();
-        return 1;
-    }
-
-    printf("%s", b64out);
-    fflush(stdout);
-
-    free(b64out);
-    free(decData);
-    CoUninitialize();
-    return 0;
-}