From fc05554d86b7eba3e7f7cb7de6b51280c3305cc4 Mon Sep 17 00:00:00 2001
From: Michele Esposito <34438276+mikesposito@users.noreply.github.com>
Date: Fri, 15 Dec 2023 17:42:17 +0100
Subject: [PATCH] Fix updated vault decryption (#63)

---
 app/lib.js                                    |  20 ++++++++++--
 app/lib.test.js                               |   5 +++
 bundle.js                                     |  30 +++++++++++++++++-
 jest.config.js                                |   4 +--
 .../000003.log                                | Bin 0 -> 19849 bytes
 5 files changed, 53 insertions(+), 6 deletions(-)
 create mode 100644 test/fixtures/chromium-120.0.6099.71-macos-arm64/000003.log

diff --git a/app/lib.js b/app/lib.js
index c488317..cd7e495 100644
--- a/app/lib.js
+++ b/app/lib.js
@@ -64,11 +64,25 @@ function extractVaultFromFile (data) {
     // attempt 4: chromium 000006.log on MacOS
     // this variant also contains a 'keyMetadata' key in the vault, which should be
     // a nested object.
-    const matches = data.match(/KeyringController":(\{"vault":".*=\\"\}"\})/);
+    const matches = data.match(/KeyringController":(\{"vault":".*?=\\"\}"\})/);
     if (matches && matches.length) {
-      keyringControllerState = matches[1];
       try {
-        return JSON.parse(JSON.parse(keyringControllerState).vault);
+        const keyringControllerStateFragment = matches[1];
+        const dataRegex = /\\"data\\":\\"([A-Za-z0-9+\/]*=*)/u
+        const ivRegex = /,\\"iv\\":\\"([A-Za-z0-9+\/]{10,40}=*)/u
+        const saltRegex = /,\\"salt\\":\\"([A-Za-z0-9+\/]{10,100}=*)\\"/
+        const keyMetaRegex = /,\\"keyMetadata\\":(.*}})/
+
+        const vaultParts = [dataRegex, ivRegex, saltRegex, keyMetaRegex]
+          .map(reg => keyringControllerStateFragment.match(reg))
+          .map(match => match[1]);
+
+        return {
+          data: vaultParts[0],
+          iv: vaultParts[1],
+          salt: vaultParts[2],
+          keyMetadata: JSON.parse(vaultParts[3].replaceAll('\\', '')),
+        };
       } catch (err) {
         // Not valid JSON: continue
       }
diff --git a/app/lib.test.js b/app/lib.test.js
index 8475e36..d0141dc 100644
--- a/app/lib.test.js
+++ b/app/lib.test.js
@@ -32,6 +32,11 @@ const FIXTURES = [
     path: 'chrome-119.0.6045.199-macos-arm64/000006.log',
     mnemonic: 'position ship hill notice replace truth science angle merit reunion direct steak',
     passphrase: 'r!chSloth14',
+  },
+  {
+    path: 'chromium-120.0.6099.71-macos-arm64/000003.log',
+    mnemonic: 'because carpet thought flame ride regular wink weather lazy spice unveil device',
+    passphrase: 'correct horse battery staple',
   }
 ]
 
diff --git a/bundle.js b/bundle.js
index ccb246a..abd7873 100644
--- a/bundle.js
+++ b/bundle.js
@@ -67,7 +67,35 @@ function extractVaultFromFile(data) {
       return JSON.parse(JSON.parse(vaultBody));
     }
   }
-  // attempt 4: chromium 000005.ldb on windows
+  {
+    // attempt 4: chromium 000006.log on MacOS
+    // this variant also contains a 'keyMetadata' key in the vault, which should be
+    // a nested object.
+    var _matches2 = data.match(/KeyringController":(\{"vault":".*?=\\"\}"\})/);
+    if (_matches2 && _matches2.length) {
+      try {
+        var keyringControllerStateFragment = _matches2[1];
+        var _dataRegex = /\\"data\\":\\"([\+\/-9A-Za-z]*=*)/;
+        var _ivRegex = /,\\"iv\\":\\"([\+\/-9A-Za-z]{10,40}=*)/;
+        var _saltRegex = /,\\"salt\\":\\"([A-Za-z0-9+\/]{10,100}=*)\\"/;
+        var keyMetaRegex = /,\\"keyMetadata\\":(.*}})/;
+        var vaultParts = [_dataRegex, _ivRegex, _saltRegex, keyMetaRegex].map(function (reg) {
+          return keyringControllerStateFragment.match(reg);
+        }).map(function (match) {
+          return match[1];
+        });
+        return {
+          data: vaultParts[0],
+          iv: vaultParts[1],
+          salt: vaultParts[2],
+          keyMetadata: JSON.parse(vaultParts[3].replaceAll('\\', ''))
+        };
+      } catch (err) {
+        // Not valid JSON: continue
+      }
+    }
+  }
+  // attempt 5: chromium 000005.ldb on windows
   var matchRegex = /Keyring[0-9](?:[\0-\|~-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])*(\{(?:[\0-z\|~-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])*\\"\})/g;
   var captureRegex = /Keyring[0-9](?:[\0-\|~-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])*(\{(?:[\0-z\|~-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])*\\"\})/;
   var ivRegex = /\\"iv(?:[\0-\t\x0B\f\x0E-\u2027\u202A-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF]){1,4}(?:[\0-\*,-\.:-@\[-`\{-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF]){1,10}([\+\/-9A-Za-z]{10,40}=*)/;
diff --git a/jest.config.js b/jest.config.js
index 15c15c1..e361be4 100644
--- a/jest.config.js
+++ b/jest.config.js
@@ -43,8 +43,8 @@ module.exports = {
     global: {
       branches: 94.73,
       functions: 100,
-      lines: 98.03,
-      statements: 98.18,
+      lines: 98.27,
+      statements: 98.38,
     },
   },
 
diff --git a/test/fixtures/chromium-120.0.6099.71-macos-arm64/000003.log b/test/fixtures/chromium-120.0.6099.71-macos-arm64/000003.log
new file mode 100644
index 0000000000000000000000000000000000000000..9b0848460125f4ffd0da0e2a4104dad10377891f
GIT binary patch
literal 19849
zcmeHP%WfM@cK)6G*(Jy;7!Aw-fkms?yom;8K}w=TOO$Alk}Y2#6uXOLi_NZ9b@OIN
zZ!oVhyV=b$4-o`GR(YBEPIYy&o1z^150ET|HVlb%JEzY5oI3Q2*Z=az>Mt)|{1X59
zJN$U@tHUDpPu~n%_(OMOy!rO{_~O?okJvwdGv-`|uJDaFMYHnwXHodqfB)T!zt@}T
zka+XIoqaPJwk>9U)R)YjaEVh47LSDVySc2D2WDkx*^FDYL3wC9m2$aaRqcv%V6w7V
zH+g9=7@AD&bR5Y;Z2Xyhd&Yoy%(uDPW*U!=dnpRd)!~@Ae%pz0DgM8q1f1-dl-!S+
zp0Fn;EIfCoZlq8y+I72hU>e((JiP*llWd{8Y6gUd!jGizyqF2DA93k3FPT;3%`m1`
z9Xi~!c%fXY)C*;^#0m#PUM<wDidp5gGOx3P{{>52P~7+-7<&eZ9El=<oA8x%eG*0^
zS_Q<?)1#MXeD$&~IX7@ykA+c>d)$sVKonosOsiV5Y8A77z+V-uJ;P^H+NSUQvPhc%
zVJsZT)h8o>U<=UYE_6peNRFA!Um?nV$n1#Zf4!g&betogc{eX^A1-YlE*oF=3=z<A
zq!K_!-;BFKu~K=%1yeE`>RV~df0TYo1Y*5u3Ngt`0b5THXuxhjKBA39G<58<fyW(R
zsoyta=EExZipnWIk(}{8W5EZd-q@X9hin8w(;$w0x?Tb5jm5&hl<vq)?w;G8nIY7C
zAC|=CQ)tNshM5^<R+J(`W{A_4X%!1*sZgwe{v>xr{Fo}_z8Pcgj>e>BR>=&OSP*#3
z=53m8a!)LdcxX#kF(<yuo)JnL>(vS2{!|QHj~6`GpA;VC>u^5884K5m#_5^B+zr)5
zjW<K)g+z{`NfNw9&?=bqLa~w{Xl5|Xfs4e1`vr$bpgiPd176WIe@Ei{6x;?qHoy@<
zo?vJ_!LU*&9wZn-ky0AwFm#xlOohV>0|xn!uLCISnj+6*Sb733OOVnw49nl$Qr@<u
z^4%?!ZCk4AE&j~&u!KaYx@~D~>(bh`rOI~3{Lh?vfTf9K=BO$Hus!4q|KKLvXjKTL
zn7a-LoEN$030&WbT>UwS{xAxE^lU35&FkA(B*mLzWo0BWvox!cxr>Jj7K8=K9ZvT6
zhY`vMZwAV<LOb#VVuS(=%d9XU|6Ab8z!OrFcbiIC8G+4!AVJ;AL3J#1o!`zuD<kh2
zh}-1c%E)<U={EVcw#v6f^1byQh#RDEW;UE~A@sqVALhwc?XXBYwgQ5?^X>+-C=&kN
zV$7n@=Zhb;Ce~K<vPiu)1v10N)Ki#=ncHS|GF;FbU>C{blU*QYY`=||NgIAbj6_%%
zg!Ye8EyG9+tqND6p>5-5hMg&T;Bk!JHmj9ki{1dko4Cqtwkt#1cta8HH6g$@5@#%r
z-T?oTKzP;wMN7m4<eb9|t{-f5aw>KSf{u<A^YMWWts6mbljJQ%vG}_BnnE%?*>Ojb
zkyA~VAhkg}Ao<)CvoN<8yOQyz+f0}XtnNh!Kk{e{q*#Pp9{Y1w3ZKFlvdMZB@q#^;
z0>LSwK?E_zl-cCW(>RL`oP}Kx2qa&pENpV_>#!n@yc|AcGcP*D84ZL7bKYlz3l;6g
zHed+%)w2;N`$#Xk$OQTnO#sxVFMGzAISpq{X_AB47UyA)M_uU(*%#>@>((9gMFlYk
zq~Rfsl1Su2M6S(`+;HlKAw}NVMN$L~;ygtW+!&Ygv3%&-ir!n05wnPVqtlED_MS-}
z_U4>IdkPpcaecXt_&yHo0};%EEr&gTSkhTAiC~amOKuYdSKYB>A;02N*M}d?6I5fr
zed+&zM+g*~5W`c>aBfNo8ty978TDZd(r6OHeI7<Wk2;905qGxzBTcY$%}mbu>Krj9
zfj;zHWYW&1JoJPjb<AC)bJOs0cpY+D)EI%!6sW8dpo*z8ph)tsLUs_OdB&S~^9%=F
z@Mt0A1oA*>Is9}iRpt^lDE+krWmX|Q2niua5W>8ikYoIi*<<i7PP#YJPCGZ3g8I2a
z0MMf}o<Kp5?!_R7fq?<Kgql}5wY|zOh&A3`T|vgwb&va}gbGv*f<bkSBb7Q7ljPBQ
zU8=wouIFhdh+8ue<IF+_$Lo#j2?DQ8%b~^sN{z*&)JNQwt03Wc4m->q`)U?=bY}x_
z8~N?iB^!i=B46=Pcr%qpHdl?LRHEn*t90%V140L11ucsw`|gxCkzY|7OlmS>;jvyp
zsV#8#g-^x_6EF|S+<J9(Fk6%$Lf{6Jw&xL;leNOR-#$|&#6BBuJ{uS1!!eSl&cUnO
zlD!-|Vfp-_WA-oYTCX(t5XqBLFs|0$fAE|4ZC)SPC!=0azBF5t)A#0dSgVz|_%M2P
z(Qu{xwNr5}?%y{))^1Jr9V_>EzcsizJGo!nd;2FHcYYw)m`_(Dvwz^<EQdU(zwPY5
z8}U=m6n=|+=*h#`)l4i()lvJQ7#vl~U#sQz*=h5p|8^i3a(?@++6(qCDi`H_|JJh2
zhikra->*)iE9Yvze<dHTznbrssAatpVdrfBwz&8>-M{X(&ug#FUVXeR_vQzDaO2$9
zkJ$cj)#<iw!m(ei41&S<*y>D%)pPgq)nN5u;w+k{6T5NL>(ma$mFCw*6r9ZDwd@ZT
z2X7b76)#z>)yWwTjt8s#Yis^?HdvH{(>cFr9Ur+TPT24Fc{D1P8!gAW^eO>63Eo~E
z934%sug?!!HxFmmvOcYe>-xlhIO^WscB&sv-t}6Ow_V=oOzrCBduw9XKG?QD_F6)=
zqI-UE6*!mH;<WW~eksllBiAbqZw{*sYgxP(#l^*JaNF}v__920o8G(Qd81hQS`Wv;
z*W0s>S3Ei7Q_=l;UpJ2*TJG_+82K%+3_i^7m&5ZFyYS`PlO~hXQE@bEyKZ~X_`@GQ
z8+)G(cdq1Qw7jj2XNTqGstG$@tTl?kNpGRoph%R&0ay(2V%|s~YZ_10-fr{ksAZ|s
z0w&osj2F4Epvoc9=c-A6AiAH8ka>~X*9_WW>tz4zzBuW;8?$zQ-fmd0&h`)9o-gOT
zbk=<P@l~~ca{b}z7`Q%?o}Y^mN*fz;k03CyPlP7^N!Q*~=Q*MSxcDKG5WV0sh}v*{
zpJ1n;wYbm<x&s>wmE^QK{`9i#hY>@S&rv}N5=R-i%E~=He%UjIl8q?v&}utf!*9b|
z#LfUjfirglKxz9K3{zK@#6Ivf62&lAoo47-(%k@6raOR;3M?goF-CXf((m|^5JgP}
z1sN+Yc>vcDmv?qtP=eLF(*-cpg2srd5iV%gbO#vZ)hJ*|#};5L0){)_tP0F(av0sQ
zSp*lSD<wck)vwY!__OH%K*jKmrBzR4q3dCUH$Vx5RFxLc3pdHlZVsv1Ogxxm>32z%
zj$uM8g1sS2iujH`z(s>v%O|+0lkT3!9Y&fDT|W)8AZQ_1Y;6SYA(#(vs*afQ=KCxl
z3$49>-a=~{V-ODjGp!x**$MecKFE4w6cMY7nh*H<%{Xp%d-M|pOhgPx*$a}15EcYr
zbLM))5LMYss1(DYZFW+XSCI&4rFm<Rr%nr`2|RWGxa6B$!*d~lB+@BT>pNab#AW%5
z3K~j7pmR6GB|d4`=91Tt5q_ZqhMR>)&r8No5Y}V|12CvRplSgXcH)6g>X1zAo5vy>
z6|3z4dFc-X!q+E8#1_-QgLFIV1xc7TbY&QkJ8z+YseL!XerO*^C(`qf9cUawgo<%A
z+@wbu=Q_|q-k#CzUUqUw0;Mh@O+@)n)ZB~_&Ib3;mIU+lGFZX<N*E=5f=X0S&%%;e
zMb=ZN;DR!8DuU^b-EjPb3S$v@SVj?Vi$@f8s;Eqr{L4r!1HFql3cN@M$vX1yZd#1t
z3TOpwp!-TbgmfS^+Az|vMm>~3bOBsf$Wsf$a_JPL8b|4X@LbqH0>a7Z1;KGcWt*-7
z8`^}2hzvkdhV%&{)g$a6`t`s!;@EYNWHBl5A=o{WkN_6@8d!cIM<R;2-(_KlKp&LS
zSq{pGe&lK|0ipjtc#-ocmHW9@8c@&0qXV+FQRV?A+@RHSi3?+;DnqFwNo1hX<=iJ!
zHB?>$D8Vp1fwC+ZIamiy=rxu1!6+Axaz1CB*vwr4e<YBgV|?huM`{`~5a|OMM4%k|
zHid8?WTdq*b!^DsV5KtT#}=yf_Bh)VCpg_i3P~v782Lvog-)}QR9>@`lFgRO5HRT6
z62hOEqCssb*AuglUm*UO^CVqqfVjvI<SH3RNtF0E^@bB}VwyfwB`L_y$P^S5Ds{z2
z&_9Wsm$Z-wscMZ#YBCCk43>FMOAdJ_yMC+d>C*Y(nA?+0oN@Vba}}W+kmOJaTQLK$
z^z4jy^f;SkWmc$1TNfIwiHuDN(I_KSAT!H5NPJvvHZ%j(5-JzO!bHp%MrnB^d+>#T
zC2G0cTWc^@EBhF)&zy0^A7<e7yBVM5kn6D_kb)dTqQmHhc`kf740>j(lBi7tz=%X`
z6Hl9aRdxjVWby#&)pp9lN!|s+ydSAGdb_?DoeNK?Y*x-y&;&$~+6R(1*9{{aZcZm<
zCS!;qmexW@b^LM}Q}@XpLRgs&7<`I`NXl|}DEU(->m!vs#;4DG_y$VnxsuNHDt!<V
z^H`b*3dKqTn2jXZCQEo7V3Z6A#ox3kcBDyYwSh=}l2D*6^iHy|kcLuXFjcJK{pC8&
zw`Xv$)3}O*iP&fvuygSQ$^y`TYMY4Df_SvUmPqvB+cEuQMvbjcz*<#7gnxgshf66W
z$^sA%Kpc|u?y6)gIrL#B;_3`;7yq8~@-a^F1l2O(7F5T?reaH^23%8tAcbtsb*S)8
zLr4r`^1ePAt!bp*pIWgqZ9`e+AcvMABCk3^xgg*V6t4IXmSRl7m(C#pF<toVY%f|i
z8BQQPXAqanA$ZWEB9l4<%T9Ps6~4DL=9Dru0m5OJ7QBC{bFPuMfg$He8&LryswBBf
zOw~vPjVuu&iAv^La!B5kbs*c3mpM2oN<}q8E`6=#u&NQ1I3b;awl?iC@Yo!w+M$+d
z1%u4zhG5%dau9AGFOeqrBd(Ujs<?G(vlyk$-8d65du;2t6HmwIVYnR!@EfDqkB&+*
z*BdFy)M0<JOeKG5wVmj<wr6<?l0DG!shrA%%2Tz`nX2$GR#ctfrB+b~tDt~x)`C_g
zi9p*Q3S3Ax9Hcd2DxO<$@m!ZLAr1On<ni%8zy9S<{P!<@ebUwSALqNSu5Ar!PaDm^
zXdUq@Ucx-?y1L@dv0Yc!uB$7KTy|Yu`_ZneD=lplk(MWpips=j705P%ZR>VH-`w}M
zZ0nLJX4)j;m<M&{U00WSTUX&QJlC$PE9v&Lc3oZ1b(UJ0_Mx>R?Yg>D|L?QSm>UKQ
z{ZqTHu3cBxW)o6eXV`Uh?Yg>lU0vUHU0r^->+0Hdb?v&k;#R?3SJ$qq%YV{2wQkVb
zb#>7*&DKX+KklZ(yTh)l>kAQS*VP3o;7NDa)kTHGT~}Aq%8S>)pXdhrP2atT;O)A)
z;@(1%y<JyVwCn21G?DGPy7Ygvv2JAgTj}aD#!(c!+21c(wbv&87T?tCRrPFzuTbFI
zUg*|aw<)=3`?!|r*ZK7SaY7Ab9kk%RyrFMez0_Yi6A}$S_&N-}m;wX89SRzS;x@B&
z!)l18==e)_y<M-_uGcKzmbU9P(`{(GUbElSYj*SB{J;M3mlyw_d(G&_-{{a^0kY{P
Ae*gdg

literal 0
HcmV?d00001