decrypto_chrome_cookie_file.py

import binascii
from Crypto.Cipher import AES
import datetime
import os
import pathlib
import sqlite3
 
def decrypt(decrypted_key, db_path, output):
    key = binascii.unhexlify(decrypted_key)
    url = pathlib.Path(db_path).as_uri() + "?mode=ro"
    print(url)
    con = sqlite3.connect(url, uri=True)
    cur = con.cursor()
    r = cur.execute("SELECT host_key, path, name, CAST(encrypted_value AS BLOB), is_secure, is_httponly, samesite, creation_utc, expires_utc,last_access_utc from cookies;")
    cookies = cur.fetchall()
    cookies_v20 = [c for c in cookies if c[3][:3] == b"v20"]
    con.close()
    with open(output, "a", encoding="utf-8") as w:
        w.write("host_key\tpath\tname\tvalue\tis_secure\tis_httponly\tsamesite\tcreation_utc\texpires_utc\tlast_access_utc\n")
        for c in cookies_v20:
            w.write("\t".join(c[:3]) + "\t" + decrypt_cookie_v20(key, c[3]) +"\t" + "\t".join([str(v) for v in c[4:]]) +"\n")
 
def convert_17bit_to_unix_timestamp(seventeen_bit_timestamp):
    try:
        fourteen_bit_timestamp = seventeen_bit_timestamp // 1000
        EPOCH_DIFFERENCE = 11644473600
        unix_timestamp = fourteen_bit_timestamp / 1000 - EPOCH_DIFFERENCE
        return datetime.datetime.utcfromtimestamp(unix_timestamp)
    except Exception as e:
        return seventeen_bit_timestamp
 
def decrypt_cookie_v20(key, encrypted_value):
    cookie_iv = encrypted_value[3:3 + 12]
    encrypted_cookie = encrypted_value[3 + 12:-16]
    cookie_tag = encrypted_value[-16:]
    cookie_cipher = AES.new(key, AES.MODE_GCM, nonce=cookie_iv)
    decrypted_cookie = cookie_cipher.decrypt_and_verify(encrypted_cookie,cookie_tag)
    return decrypted_cookie[32:].decode('utf-8')
 
if __name__ == "__main__":
    key = "AES_KEY"
    # LOCAL_APP_DATA = os.environ['LOCALAPPDATA']
    # db_path = rf"{LOCAL_APP_DATA}\Google\Chrome\User Data\Default\Network\Cookies"
    db_path = 'C:\\xxx\\xx\\Cookies'
    output = "Cookies.txt"
    decrypt(key, db_path, output)