{"id":30444944,"url":"https://github.com/00nx/chrome-app-bound-encryption-bypass","last_synced_at":"2026-05-03T12:32:14.275Z","repository":{"id":309912898,"uuid":"1038000575","full_name":"00nx/Chrome-App-Bound-Encryption-Bypass","owner":"00nx","description":"Bypasses and decrypts App-Bound Encryption (ABE) to retrieve cookies, passwords, browsing history, autofill data, and payment information from Chromium-based browsers (Chrome, Brave, Edge) — all executed entirely in user mode, with no administrator privileges required.","archived":false,"fork":false,"pushed_at":"2025-08-14T13:22:23.000Z","size":3263,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-14T15:12:33.400Z","etag":null,"topics":["app-bound-bypass","autofill","brave","browser","chrome","chromium","cookies","decrypt","dll-injection","edge","history","password","payment","process-hollowing"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/00nx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-14T13:10:06.000Z","updated_at":"2025-08-14T13:22:26.000Z","dependencies_parsed_at":"2025-08-14T15:22:42.324Z","dependency_job_id":null,"html_url":"https://github.com/00nx/Chrome-App-Bound-Encryption-Bypass","commit_stats":null,"previous_names":["00nx/chrome-app-bound-encryption-bypass"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/00nx/Chrome-App-Bound-Encryption-Bypass","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/00nx%2FChrome-App-Bound-Encryption-Bypass","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/00nx%2FChrome-App-Bound-Encryption-Bypass/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/00nx%2FChrome-App-Bound-Encryption-Bypass/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/00nx%2FChrome-App-Bound-Encryption-Bypass/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/00nx","download_url":"https://codeload.github.com/00nx/Chrome-App-Bound-Encryption-Bypass/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/00nx%2FChrome-App-Bound-Encryption-Bypass/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":271746667,"owners_count":24813576,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-23T02:00:09.327Z","response_time":69,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["app-bound-bypass","autofill","brave","browser","chrome","chromium","cookies","decrypt","dll-injection","edge","history","password","payment","process-hollowing"],"created_at":"2025-08-23T10:39:12.188Z","updated_at":"2026-05-03T12:32:14.261Z","avatar_url":"https://github.com/00nx.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Chrome App-Bound Encryption Decryption – Enhanced Fork\n\n![Build Status](https://img.shields.io/badge/build-passing-brightgreen)\n![License](https://img.shields.io/badge/license-MIT-blue)\n![Platform](https://img.shields.io/badge/platform-Windows%20x64%20%7C%20ARM64-lightgrey)\n![Languages](https://img.shields.io/badge/code-C%2B%2B%20%7C%20ASM-9cf)\n\n---\n\u003e [!CAUTION]\n\u003e this specific version has some issues as of now, will be fixing soon with new updates\n\u003e \n## 📌 Overview\n\nThis is a **fork** of [@xaitax’s original Chrome App-Bound Encryption Decryption project](https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryption).  \nIt has been updated to:\n\n- 🛠  **Get Autofills and History** fully.  \n- 🔒 **Evade some static detections** in Windows Defender and other AV tools.  \n- 📄 **Improve clarity and organization** of the README for easier usage.  \n- ⛓  **Concurrency** for injecting into all 3 browsers together at the same time.  \n\nThe tool demonstrates an **in-memory bypass** of **Chromium’s App-Bound Encryption (ABE)** using  \n**Direct Syscall-based Reflective Process Hollowing**.  \nIt launches a legitimate browser in a suspended state, injects a payload to hijack its security context, and operates filelessly to extract:\n\n- Cookies  \n- Passwords  \n- Browsing history  \n- Autofill data  \n- Payment information  \n\n\u003e **Disclaimer:** This project is for **educational and security research purposes only**.  \n\u003e Do **not** use it for malicious activities.  \n\n---\n## ⚙️ All Features\n\n### Core Functionality\n- 🔓 Full user-mode decryption of cookies, passwords, autofills, history and payment methods.\n- 📁 Discovers and processes all user profiles (Default, Profile 1, etc.).\n- 📝 Exports all extracted data into structured JSON files, organized by profile.\n\n### Stealth \u0026 Evasion\n- 💼 **No Admin Privileges Required:** Operates entirely within the user's security context.\n- 🛡️ **Fileless Payload Delivery:** In-memory decryption and injection of an encrypted resource.\n- 🛡️ **Direct Syscall Engine:** Bypasses common endpoint defenses by avoiding hooked user-land APIs for all process operations.\n- 🤫 **Process Hollowing:** Creates a benign, suspended host process for the payload, avoiding injection into potentially monitored processes.\n- 👻 **Reflective DLL Injection:** Stealthily loads the payload without suspicious `LoadLibrary` calls.\n- 🔒 **Proactive File-Lock Mitigation:** Automatically terminates browser utility processes that hold locks on target database files.\n\n\n### Compatibility \u0026 Usability\n- 🌐 Works on **Google Chrome**, **Brave**, \u0026 **Edge**.\n- 💻 Natively supports **x64** and **ARM64** architectures.\n- 🚀 **Standalone Operation:** Automatically creates a new browser process to host the payload, requiring no pre-existing running instances.\n- 📁 Customizable output directory for extracted data.\n\n\n---\n\n## 📦 Supported \u0026 Tested Versions\n\n| Browser            | Tested Version (x64 \u0026 ARM64) |\n| ------------------ | ---------------------------- |\n| **Google Chrome**  | 143.0.7499.170               |\n| **Brave**          | 143.0.7499.169               |\n| **Microsoft Edge** | 143.0.7499.169               |\n---\n\n\n## 🔧 Build Instructions \n\nThis project uses a simple, robust build script that handles all compilation and resource embedding automatically.\n\n1. **Clone** this repository. using :\n```bash\ngit clone https://github.com/00nx/Chrome-App-Bound-Encryption-Bypass.git\n```\n\n2. Open a **Developer Command Prompt for VS** (or any MSVC‑enabled shell).\n\n3. Run the build script ( make.bat ) from the project root:\n\n   ```bash\n    PS\u003e make.bat\n    --------------------------------------------------\n    |          Chrome Injector Build Script          |\n    --------------------------------------------------\n\n    [INFO] Verifying build environment...\n    [ OK ] Developer environment detected.\n    [INFO] Target Architecture: arm64\n\n    [INFO] Performing pre-build setup...\n    [INFO]   - Creating fresh build directory: build\n    [ OK ] Setup complete.\n\n    -- [1/6] Compiling SQLite3 Library ------------------------------------------------\n    [INFO]   - Compiling C object file...\n    cl /nologo /W3 /O2 /MT /GS- /c libs\\sqlite\\sqlite3.c /Fo\"build\\sqlite3.obj\"\n    sqlite3.c\n    [INFO]   - Creating static library...\n    lib /NOLOGO /OUT:\"build\\sqlite3.lib\" \"build\\sqlite3.obj\"\n    [ OK ] SQLite3 library built successfully.\n\n    -- [2/6] Compiling Payload DLL (chrome_decrypt.dll) ------------------------------------------------\n    [INFO]   - Compiling C file (reflective_loader.c)...\n    cl /nologo /W3 /O2 /MT /GS- /c src\\reflective_loader.c /Fo\"build\\reflective_loader.obj\"\n    reflective_loader.c\n    [INFO]   - Compiling C++ file (chrome_decrypt.cpp)...\n    cl /nologo /W3 /O2 /MT /GS- /EHsc /std:c++17 /Ilibs\\sqlite /c src\\chrome_decrypt.cpp /Fo\"build\\chrome_decrypt.obj\"\n    chrome_decrypt.cpp\n    [INFO]   - Linking objects into DLL...\n    link /NOLOGO /DLL /OUT:\"build\\chrome_decrypt.dll\" \"build\\chrome_decrypt.obj\" \"build\\reflective_loader.obj\" \"build\\sqlite3.lib\" bcrypt.lib ole32.lib oleaut32.lib shell32.lib version.lib comsuppw.lib /IMPLIB:\"build\\chrome_decrypt.lib\"\n      Creating library build\\chrome_decrypt.lib and object build\\chrome_decrypt.exp\n    [ OK ] Payload DLL compiled successfully.\n\n    -- [3/6] Compiling Encryption Utility (encryptor.exe) ------------------------------------------------\n    [INFO]   - Compiling and linking...\n    cl /nologo /W3 /O2 /MT /GS- /EHsc /std:c++17 /Ilibs\\chacha src\\encryptor.cpp /Fo\"build\\encryptor.obj\" /link /NOLOGO /DYNAMICBASE /NXCOMPAT /OUT:\"build\\encryptor.exe\"\n    encryptor.cpp\n    [ OK ] Encryptor utility compiled successfully.\n\n    -- [4/6] Encrypting Payload DLL ------------------------------------------------\n    [INFO]   - Running encryption process...\n    build\\encryptor.exe build\\chrome_decrypt.dll build\\chrome_decrypt.enc\n    Successfully ChaCha20-encrypted build\\chrome_decrypt.dll to build\\chrome_decrypt.enc\n    [ OK ] Payload encrypted to chrome_decrypt.enc.\n\n    -- [5/6] Compiling Resource File ------------------------------------------------\n    [INFO]   - Compiling .rc to .res...\n    rc.exe /i \"build\" /fo \"build\\resource.res\" src\\resource.rc\n    Microsoft (R) Windows (R) Resource Compiler Version 10.0.10011.16384\n    Copyright (C) Microsoft Corporation.  All rights reserved.\n\n    [ OK ] Resource file compiled successfully.\n\n    -- [6/6] Compiling Final Injector (chrome_inject.exe) ------------------------------------------------\n    [INFO]   - Assembling syscall trampoline (arm64)...\n    armasm64.exe -nologo \"src\\syscall_trampoline_arm64.asm\" -o \"build\\syscall_trampoline_arm64.obj\"\n    [INFO]   - Compiling C++ source (chrome_inject.cpp)...\n    cl /nologo /W3 /O2 /MT /GS- /EHsc /std:c++17 /Ilibs\\chacha /c src\\chrome_inject.cpp /Fo\"build\\chrome_inject.obj\"\n    chrome_inject.cpp\n    [INFO]   - Compiling C++ source (syscalls.cpp)...\n    cl /nologo /W3 /O2 /MT /GS- /EHsc /std:c++17 /c src\\syscalls.cpp /Fo\"build\\syscalls.obj\"\n    syscalls.cpp\n    [INFO]   - Linking final executable...\n    cl /nologo /W3 /O2 /MT /GS- /EHsc /std:c++17 \"build\\chrome_inject.obj\" \"build\\syscalls.obj\" build\\syscall_trampoline_arm64.obj \"build\\resource.res\" version.lib shell32.lib /link /NOLOGO /DYNAMICBASE /NXCOMPAT /OUT:\".\\chrome_inject.exe\"\n    [ OK ] Final injector built successfully.\n\n    --------------------------------------------------\n    |                 BUILD SUCCESSFUL               |\n    --------------------------------------------------\n\n      Final Executable: .\\chrome_inject.exe\n\n    [INFO] Build successful. Final artifacts are ready.\n   ```\n\nThis single command will compile all components and produce a self-contained `chrome_inject.exe` in the root directory.\n\n## 🚀 Usage\n\n```bash\nUsage: chrome_inject.exe [options]\nExample : chrome_inject.exe -o .\\output\n```\n\n### Options\n\n- `--output-path \u003cpath\u003e` or `-o \u003cpath\u003e`\n  Specifies the base directory for output files.\n  Defaults to `.\\output\\` relative to the injector's location.\n  Data will be organized into subfolders: `\u003cpath\u003e/\u003cBrowserName\u003e/\u003cProfileName\u003e/`.\n\n- `--verbose` or `-v`\n  Enable extensive debugging output from the injector.\n\n- `--help` or `-h`\n  Show this help message.\n\nFuture Updates will be Documented in : \n[**FORK_CHANGES.md**](FORK_CHANGES.md)\n\n---\n\n## 📜 License\n\nThis project is licensed under the [MIT License](LICENSE).  \nAttribution to the original author is maintained.\n\n---\n\n\n\n\u003e [!CAUTION]\n\u003e This project is an **educational proof-of-concept** showing how the new ABE bypass works.  \n\u003e It is **not** intended for malicious use.\n\u003e\n\u003e **This is not a full-featured infostealer or a guaranteed EDR evasion tool.**  \n\u003e While it uses advanced techniques, its sole purpose is to demonstrate and analyze the ABE mechanism—not to provide operational stealth.  \n\u003e Use only in compliance with applicable legal and ethical guidelines.\n\u003e\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F00nx%2Fchrome-app-bound-encryption-bypass","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F00nx%2Fchrome-app-bound-encryption-bypass","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F00nx%2Fchrome-app-bound-encryption-bypass/lists"}