CalvinBackup/HackBrowserData
1
0
Fork 0
mirror of https://github.com/moonD4rk/HackBrowserData.git synced 2026-08-17 23:57:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: per-tier master-key retrievers for mixed-cipher profiles (#579)

Browse Source 
* fix: per-tier master-key retrievers for mixed-cipher profiles
This commit is contained in:
Roger
2026-04-20 17:33:38 +08:00
committed by GitHub
parent e50c623db0
commit 7b9a973c9c
29 changed files with 699 additions and 227 deletions
Download Patch File Download Diff File Expand all files Collapse all files
browser/chromium/decrypt_test.go
+48 -2
View File
@@ -10,6 +10,7 @@ import (
"github.com/stretchr/testify/require"
"github.com/moond4rk/hackbrowserdata/crypto"
"github.com/moond4rk/hackbrowserdata/crypto/keyretriever"
)
func TestDecryptValue_V10(t *testing.T) {
@@ -39,7 +40,7 @@ func TestDecryptValue_V10(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := decryptValue(tt.key, v10Ciphertext)
got, err := decryptValue(keyretriever.MasterKeys{V10: tt.key}, v10Ciphertext)
if tt.wantErrMsg != "" {
require.Error(t, err)
assert.Contains(t, err.Error(), tt.wantErrMsg)
@@ -59,7 +60,52 @@ func TestDecryptValue_V11(t *testing.T) {
require.NoError(t, err)
v11Ciphertext := append([]byte("v11"), cbcEncrypted...)
got, err := decryptValue(testAESKey, v11Ciphertext)
// v11 ciphertexts route to the V11 slot (Linux's keyring-derived kV11Key) — not V10 (peanuts).
got, err := decryptValue(keyretriever.MasterKeys{V11: testAESKey}, v11Ciphertext)
require.NoError(t, err)
assert.Equal(t, plaintext, got)
}
// TestDecryptValue_V10_V11_SlotSeparation is the Linux analog of the #578 regression test: a
// profile carrying both v10 (peanuts) and v11 (keyring) ciphertexts must route each prefix to
// its own slot, not share a single key. Build-tag scoped to darwin/linux because v10/v11 use
// AES-CBC on these platforms; Windows uses AES-GCM for v10 and is covered separately by
// decrypt_windows_test.go.
func TestDecryptValue_V10_V11_SlotSeparation(t *testing.T) {
k10 := bytes.Repeat([]byte{0x10}, 16) // V10 slot key (peanuts-derived kV10Key)
k11 := bytes.Repeat([]byte{0x11}, 16) // V11 slot key (keyring-derived kV11Key)
iv := bytes.Repeat([]byte{0x20}, 16) // matches crypto.chromiumCBCIV on darwin/linux
v10plain := []byte("password-from-v10-era")
v11plain := []byte("password-from-v11-era")
v10Enc, err := crypto.AESCBCEncrypt(k10, iv, v10plain)
require.NoError(t, err)
v10Ciphertext := append([]byte("v10"), v10Enc...)
v11Enc, err := crypto.AESCBCEncrypt(k11, iv, v11plain)
require.NoError(t, err)
v11Ciphertext := append([]byte("v11"), v11Enc...)
keys := keyretriever.MasterKeys{V10: k10, V11: k11}
t.Run("v10 ciphertext decrypts via V10 slot", func(t *testing.T) {
got, err := decryptValue(keys, v10Ciphertext)
require.NoError(t, err)
assert.Equal(t, v10plain, got)
})
t.Run("v11 ciphertext decrypts via V11 slot", func(t *testing.T) {
got, err := decryptValue(keys, v11Ciphertext)
require.NoError(t, err)
assert.Equal(t, v11plain, got)
})
t.Run("swapped keys fail both directions", func(t *testing.T) {
swapped := keyretriever.MasterKeys{V10: k11, V11: k10}
_, err := decryptValue(swapped, v10Ciphertext)
require.Error(t, err, "v10 with V11's key must fail")
_, err = decryptValue(swapped, v11Ciphertext)
require.Error(t, err, "v11 with V10's key must fail")
})
}