From 35b3b5f1082dc5747f40bd9854045e6205487bf3 Mon Sep 17 00:00:00 2001 From: Aquilao Date: Thu, 11 Feb 2021 16:06:22 +0800 Subject: [PATCH 1/4] add parse Firefox download history --- core/browser.go | 6 ++++- core/data/parse.go | 58 +++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 62 insertions(+), 2 deletions(-) diff --git a/core/browser.go b/core/browser.go index 2749a25..7c25505 100644 --- a/core/browser.go +++ b/core/browser.go @@ -52,7 +52,7 @@ const ( ) var ( - errItemNotSupported = errors.New(`item not supported, default is "all", choose from history|password|bookmark|cookie`) + errItemNotSupported = errors.New(`item not supported, default is "all", choose from history|download|password|bookmark|cookie`) errBrowserNotSupported = errors.New("browser not supported") errChromeSecretIsEmpty = errors.New("chrome secret is empty") errDbusSecretIsEmpty = errors.New("dbus secret key is empty") @@ -105,6 +105,10 @@ var ( mainFile: data.FirefoxDataFile, newItem: data.NewHistoryData, }, + download: { + mainFile: data.FirefoxDataFile, + newItem: data.NewDownloads, + }, password: { mainFile: data.FirefoxKey4File, subFile: data.FirefoxLoginFile, diff --git a/core/data/parse.go b/core/data/parse.go index 75f73c8..8045856 100644 --- a/core/data/parse.go +++ b/core/data/parse.go @@ -9,6 +9,7 @@ import ( "path/filepath" "sort" "time" + "strings" "hack-browser-data/core/decrypt" "hack-browser-data/log" @@ -55,6 +56,7 @@ var ( queryChromiumDownload = `SELECT target_path, tab_url, total_bytes, start_time, end_time, mime_type FROM downloads` queryChromiumCookie = `SELECT name, encrypted_value, host_key, path, creation_utc, expires_utc, is_secure, is_httponly, has_expires, is_persistent FROM cookies` queryFirefoxHistory = `SELECT id, url, last_visit_date, title, visit_count FROM moz_places` + queryFirefoxDownload = `SELECT place_id, GROUP_CONCAT(content) , url, dateAdded FROM (SELECT * FROM moz_annos INNER JOIN moz_places ON moz_annos.place_id=moz_places.id) t GROUP BY place_id` queryFirefoxBookMarks = `SELECT id, fk, type, dateAdded, title FROM moz_bookmarks` queryFirefoxCookie = `SELECT name, value, host, path, creationTime, expiry, isSecure, isHttpOnly FROM moz_cookies` queryMetaData = `SELECT item1, item2 FROM metaData WHERE id = 'password'` @@ -500,9 +502,63 @@ func (d *downloads) ChromeParse(key []byte) error { } func (d *downloads) FirefoxParse() error { + var ( + err error + keyDB *sql.DB + downloadRows *sql.Rows + tempMap map[int64]string + ) + tempMap = make(map[int64]string) + keyDB, err = sql.Open("sqlite3", FirefoxDataFile) + if err != nil { + return err + } + _, err = keyDB.Exec(closeJournalMode) + if err != nil { + log.Error(err) + } + defer func() { + if err := keyDB.Close(); err != nil { + log.Error(err) + } + }() + downloadRows, err = keyDB.Query(queryFirefoxDownload) + if err != nil { + log.Error(err) + return err + } + defer func() { + if err := downloadRows.Close(); err != nil { + log.Error(err) + } + }() + for downloadRows.Next() { + var ( + content, url string + place_id, dateAdded int64 + ) + err = downloadRows.Scan(&place_id, &content, &url, &dateAdded) + if err != nil { + log.Warn(err) + } + contentList := strings.Split(content, ",{") + if len(contentList) > 1 { + path := contentList[0] + json := "{" + contentList[1] + endTime := gjson.Get(json, "endTime") + fileSize:= gjson.Get(json, "fileSize") + d.downloads = append(d.downloads, download{ + TargetPath: path, + Url: url, + TotalBytes: fileSize.Int(), + StartTime: utils.TimeStampFormat(dateAdded / 1000000), + EndTime: utils.TimeStampFormat(endTime.Int() / 1000000), + }) + } + tempMap[place_id] = url + } return nil } - func (d *downloads) CopyDB() error { return copyToLocalPath(d.mainPath, filepath.Base(d.mainPath)) } From c935b1e36bc2938bdbf360fdbf8a12e9ea4576aa Mon Sep 17 00:00:00 2001 From: Aquilao Date: Thu, 11 Feb 2021 16:18:06 +0800 Subject: [PATCH 2/4] correct the wrong word --- core/data/parse.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/data/parse.go b/core/data/parse.go index 8045856..97d098e 100644 --- a/core/data/parse.go +++ b/core/data/parse.go @@ -491,7 +491,7 @@ func (d *downloads) ChromeParse(key []byte) error { TotalBytes: totalBytes, StartTime: utils.TimeEpochFormat(startTime), EndTime: utils.TimeEpochFormat(endTime), - MimiType: mimeType, + MimeType: mimeType, } if err != nil { log.Error(err) @@ -953,7 +953,7 @@ type ( TotalBytes int64 StartTime time.Time EndTime time.Time - MimiType string + MimeType string } card struct { GUID string From adef21275c067ff95867284dff02bbc0e2add155 Mon Sep 17 00:00:00 2001 From: Aquilao Date: Thu, 11 Feb 2021 16:54:28 +0800 Subject: [PATCH 3/4] fix bug about firefox download endtime --- core/data/parse.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/data/parse.go b/core/data/parse.go index 97d098e..50caae4 100644 --- a/core/data/parse.go +++ b/core/data/parse.go @@ -552,7 +552,7 @@ func (d *downloads) FirefoxParse() error { Url: url, TotalBytes: fileSize.Int(), StartTime: utils.TimeStampFormat(dateAdded / 1000000), - EndTime: utils.TimeStampFormat(endTime.Int() / 1000000), + EndTime: utils.TimeStampFormat(endTime.Int() / 1000), }) } tempMap[place_id] = url From a064f4a46caf066f882eec9d6ee94e574b7cba20 Mon Sep 17 00:00:00 2001 From: moond4rk Date: Thu, 18 Feb 2021 10:37:34 +0800 Subject: [PATCH 4/4] format firefox download code --- core/data/parse.go | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/core/data/parse.go b/core/data/parse.go index 50caae4..86d08b9 100644 --- a/core/data/parse.go +++ b/core/data/parse.go @@ -8,8 +8,8 @@ import ( "os" "path/filepath" "sort" - "time" "strings" + "time" "hack-browser-data/core/decrypt" "hack-browser-data/log" @@ -56,7 +56,7 @@ var ( queryChromiumDownload = `SELECT target_path, tab_url, total_bytes, start_time, end_time, mime_type FROM downloads` queryChromiumCookie = `SELECT name, encrypted_value, host_key, path, creation_utc, expires_utc, is_secure, is_httponly, has_expires, is_persistent FROM cookies` queryFirefoxHistory = `SELECT id, url, last_visit_date, title, visit_count FROM moz_places` - queryFirefoxDownload = `SELECT place_id, GROUP_CONCAT(content) , url, dateAdded FROM (SELECT * FROM moz_annos INNER JOIN moz_places ON moz_annos.place_id=moz_places.id) t GROUP BY place_id` + queryFirefoxDownload = `SELECT place_id, GROUP_CONCAT(content), url, dateAdded FROM (SELECT * FROM moz_annos INNER JOIN moz_places ON moz_annos.place_id=moz_places.id) t GROUP BY place_id` queryFirefoxBookMarks = `SELECT id, fk, type, dateAdded, title FROM moz_bookmarks` queryFirefoxCookie = `SELECT name, value, host, path, creationTime, expiry, isSecure, isHttpOnly FROM moz_cookies` queryMetaData = `SELECT item1, item2 FROM metaData WHERE id = 'password'` @@ -503,10 +503,10 @@ func (d *downloads) ChromeParse(key []byte) error { func (d *downloads) FirefoxParse() error { var ( - err error - keyDB *sql.DB - downloadRows *sql.Rows - tempMap map[int64]string + err error + keyDB *sql.DB + downloadRows *sql.Rows + tempMap map[int64]string ) tempMap = make(map[int64]string) keyDB, err = sql.Open("sqlite3", FirefoxDataFile) @@ -534,10 +534,10 @@ func (d *downloads) FirefoxParse() error { }() for downloadRows.Next() { var ( - content, url string - place_id, dateAdded int64 + content, url string + placeID, dateAdded int64 ) - err = downloadRows.Scan(&place_id, &content, &url, &dateAdded) + err = downloadRows.Scan(&placeID, &content, &url, &dateAdded) if err != nil { log.Warn(err) } @@ -546,19 +546,20 @@ func (d *downloads) FirefoxParse() error { path := contentList[0] json := "{" + contentList[1] endTime := gjson.Get(json, "endTime") - fileSize:= gjson.Get(json, "fileSize") + fileSize := gjson.Get(json, "fileSize") d.downloads = append(d.downloads, download{ - TargetPath: path, - Url: url, + TargetPath: path, + Url: url, TotalBytes: fileSize.Int(), - StartTime: utils.TimeStampFormat(dateAdded / 1000000), - EndTime: utils.TimeStampFormat(endTime.Int() / 1000), + StartTime: utils.TimeStampFormat(dateAdded / 1000000), + EndTime: utils.TimeStampFormat(endTime.Int() / 1000), }) } - tempMap[place_id] = url + tempMap[placeID] = url } return nil } + func (d *downloads) CopyDB() error { return copyToLocalPath(d.mainPath, filepath.Base(d.mainPath)) }