HackBrowserData icon indicating copy to clipboard operation
HackBrowserData copied to clipboard

Add support for SLbrowser (lenovo browser)

Open YuriSizuku opened this issue 3 years ago • 1 comments

I think this browser has the similar structure with chrome browser. I try to use 256bits aes-gcm with nonce like chrome (see python code below) , but it doesn't work.

def decrypt_aeskey(localstatepath=""):
    with codecs.open(localstatepath, 'r', 'utf-8') as fp:
        encrypted_key_b64 = json.loads(fp.read())['os_crypt']['encrypted_key']
    encrypted_key = base64.b64decode(encrypted_key_b64)
    if encrypted_key[:5] == b'DPAPI': encrypted_key = encrypted_key[5:]
    _, aeskey = win32crypt.CryptUnprotectData(encrypted_key)
    return aeskey

def decrypt_blob(aeskey, data):
    version = data[0:5]
    if version == b'lnv20':
        nonce = data[5:5+12]
        ciphertext = data[5+12:]
        cipher = AES.new(aeskey, AES.MODE_GCM, nonce=nonce)
        plaintext = cipher.decrypt(ciphertext)
    return plaintext

The encrypted_value is something start with lnv20, here's the sample of this browser encrypted value:

0000  6c 6e 76 32 30 9b 35 66 4f ad 82 2f b0 e7 70 95  lnv20.5fO../..p. 
0010  27 97 49 6b b4 3f 95 7d 4f b0 48 b1 e1 62 58 b9  '.Ik.?.}O.H..bX. 
0020  cc ad 11 79 c7 4f ea 8f 6e 3b 95 26 d1 d9 36 a9  ...y.O..n;.&..6. 
0030  7a f4 0d 51 f0 98 a5                             z..Q...          

Would you please help me dealing with slbrowser ?

YuriSizuku avatar Sep 28 '21 17:09 YuriSizuku

好像现在还是不支持

Star-KWL avatar Mar 30 '23 11:03 Star-KWL