mirror of
https://github.com/moonD4rk/HackBrowserData.git
synced 2026-05-19 18:58:03 +02:00
Roger
12436217ae
* feat: add filemanager session and crypto version detection * refactor: move copy logic into filemanager, remove fileutil dependency * fix: apply review suggestions for filemanager * feat: add Windows locked file tests, fix readFileContent with ReadFile+FileMapping fallback * fix: remove self-PID skip in findFileHandle to fix Windows CI test * fix: seek to file start before reading duplicated handle * fix: use full path matching in findFileHandle to avoid cross-app handle collision * test: enhance Windows copyLocked tests with write-then-read, large file, and normal copy scenarios * fix: check all errors in Windows tests, use bytes.Equal for large file comparison * fix: use stable path suffix matching to handle Windows short path names in CI
42 lines
1.1 KiB
Go
42 lines
1.1 KiB
Go
package crypto
|
|
|
|
// CipherVersion represents the encryption version used by Chromium browsers.
|
|
type CipherVersion string
|
|
|
|
const (
|
|
// CipherV10 is Chrome 80+ encryption (AES-GCM on Windows, AES-CBC on macOS/Linux).
|
|
CipherV10 CipherVersion = "v10"
|
|
|
|
// CipherV20 is Chrome 127+ App-Bound Encryption.
|
|
CipherV20 CipherVersion = "v20"
|
|
|
|
// CipherDPAPI is pre-Chrome 80 raw DPAPI encryption (no version prefix).
|
|
CipherDPAPI CipherVersion = "dpapi"
|
|
)
|
|
|
|
// DetectVersion identifies the encryption version from a ciphertext prefix.
|
|
func DetectVersion(ciphertext []byte) CipherVersion {
|
|
if len(ciphertext) < 3 {
|
|
return CipherDPAPI
|
|
}
|
|
prefix := string(ciphertext[:3])
|
|
switch prefix {
|
|
case "v10":
|
|
return CipherV10
|
|
case "v20":
|
|
return CipherV20
|
|
default:
|
|
return CipherDPAPI
|
|
}
|
|
}
|
|
|
|
// StripPrefix removes the version prefix (e.g. "v10") from ciphertext.
|
|
// Returns the ciphertext unchanged if no known prefix is found.
|
|
func StripPrefix(ciphertext []byte) []byte {
|
|
ver := DetectVersion(ciphertext)
|
|
if ver == CipherV10 || ver == CipherV20 {
|
|
return ciphertext[3:]
|
|
}
|
|
return ciphertext
|
|
}
|