HackBrowserData
HackBrowserData copied to clipboard
Add support for SLbrowser (lenovo browser)
I think this browser has the similar structure with chrome browser. I try to use 256bits aes-gcm with nonce like chrome (see python code below) , but it doesn't work.
def decrypt_aeskey(localstatepath=""):
with codecs.open(localstatepath, 'r', 'utf-8') as fp:
encrypted_key_b64 = json.loads(fp.read())['os_crypt']['encrypted_key']
encrypted_key = base64.b64decode(encrypted_key_b64)
if encrypted_key[:5] == b'DPAPI': encrypted_key = encrypted_key[5:]
_, aeskey = win32crypt.CryptUnprotectData(encrypted_key)
return aeskey
def decrypt_blob(aeskey, data):
version = data[0:5]
if version == b'lnv20':
nonce = data[5:5+12]
ciphertext = data[5+12:]
cipher = AES.new(aeskey, AES.MODE_GCM, nonce=nonce)
plaintext = cipher.decrypt(ciphertext)
return plaintext
The encrypted_value is something start with lnv20
, here's the sample of this browser encrypted value:
0000 6c 6e 76 32 30 9b 35 66 4f ad 82 2f b0 e7 70 95 lnv20.5fO../..p.
0010 27 97 49 6b b4 3f 95 7d 4f b0 48 b1 e1 62 58 b9 '.Ik.?.}O.H..bX.
0020 cc ad 11 79 c7 4f ea 8f 6e 3b 95 26 d1 d9 36 a9 ...y.O..n;.&..6.
0030 7a f4 0d 51 f0 98 a5 z..Q...
Would you please help me dealing with slbrowser ?
好像现在还是不支持