|
|
|
@ -1,7 +1,7 @@
|
|
|
|
|
#!/usr/bin/env python3 |
|
|
|
|
# |
|
|
|
|
# Copyright (C) 2016,2017 The University of Sheffield, UK |
|
|
|
|
# |
|
|
|
|
# |
|
|
|
|
# This program is free software: you can redistribute it and/or modify |
|
|
|
|
# it under the terms of the GNU General Public License as published by |
|
|
|
|
# the Free Software Foundation, either version 3 of the License, or |
|
|
|
@ -13,20 +13,20 @@
|
|
|
|
|
# GNU General Public License for more details. |
|
|
|
|
# |
|
|
|
|
# You should have received a copy of the GNU General Public License |
|
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. |
|
|
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>. |
|
|
|
|
# |
|
|
|
|
"""Utility functions for working with Chrome extensionsx archives, |
|
|
|
|
i.e., *.crx files.""" |
|
|
|
|
|
|
|
|
|
import io |
|
|
|
|
import zipfile |
|
|
|
|
import binascii |
|
|
|
|
|
|
|
|
|
from Crypto.PublicKey import RSA |
|
|
|
|
from Crypto.Hash import SHA |
|
|
|
|
from Crypto.Signature import PKCS1_v1_5 |
|
|
|
|
|
|
|
|
|
import zipfile |
|
|
|
|
import io |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class CrxFile: |
|
|
|
|
"""Record class for storing crx files.""" |
|
|
|
|
def __init__(self, filename, magic, version, pk_len, sig_len, pk, sig, |
|
|
|
|
header_len, data): |
|
|
|
|
self.file = filename |
|
|
|
@ -41,11 +41,12 @@ class CrxFile:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def is_valid_magic(magic): |
|
|
|
|
return (b'Cr24' == magic) |
|
|
|
|
"""Check magic matches the magic bytes of the crx specificaton.""" |
|
|
|
|
return magic == b'Cr24' |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def is_crxfile(filename): |
|
|
|
|
"Check magic number: crx files should start with \"Cr24\"." |
|
|
|
|
"""Check magic number: crx files should start with \"Cr24\".""" |
|
|
|
|
file = open(filename, 'rb') |
|
|
|
|
magic = file.read(4) |
|
|
|
|
file.close() |
|
|
|
@ -53,13 +54,14 @@ def is_crxfile(filename):
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def check_signature(pk, sig, data): |
|
|
|
|
"""Check validity of signature contained in the crx file.""" |
|
|
|
|
key = RSA.importKey(pk) |
|
|
|
|
hash = SHA.new(data) |
|
|
|
|
return PKCS1_v1_5.new(key).verify(hash, sig) |
|
|
|
|
crxhash = SHA.new(data) |
|
|
|
|
return PKCS1_v1_5.new(key).verify(crxhash, sig) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def read_crx(filename): |
|
|
|
|
"Read header of an crx file (https://developer.chrome.com/extensions/crx)." |
|
|
|
|
"""Read header of an crx file (https://developer.chrome.com/extensions/crx).""" |
|
|
|
|
file = open(filename, 'rb') |
|
|
|
|
magic = file.read(4) |
|
|
|
|
version = int.from_bytes(file.read(4), byteorder='little') |
|
|
|
@ -75,6 +77,7 @@ def read_crx(filename):
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def print_crx_info(verbose, crx): |
|
|
|
|
"""Print information extracted from a crx file.""" |
|
|
|
|
if is_valid_magic(crx.magic): |
|
|
|
|
magic = "valid" |
|
|
|
|
else: |
|
|
|
@ -96,15 +99,16 @@ def print_crx_info(verbose, crx):
|
|
|
|
|
if verbose: |
|
|
|
|
print("Signature [" + str(crx.sig_len) + "]: " + str( |
|
|
|
|
binascii.hexlify(crx.sig))) |
|
|
|
|
out = f = io.BytesIO(crx.data) |
|
|
|
|
zf = zipfile.ZipFile(out, 'r') |
|
|
|
|
out = io.BytesIO(crx.data) |
|
|
|
|
ziparchive = zipfile.ZipFile(out, 'r') |
|
|
|
|
print("Zip content:") |
|
|
|
|
for info in zf.infolist(): |
|
|
|
|
for info in ziparchive.infolist(): |
|
|
|
|
print('{:8d} {:8d}'.format(info.file_size, info.compress_size), |
|
|
|
|
info.filename) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def verify_crxfile(verbose, filename): |
|
|
|
|
"""Verify integrity of a crx file.""" |
|
|
|
|
if is_crxfile(filename): |
|
|
|
|
if verbose: |
|
|
|
|
print("Found correct magic bytes.") |
|
|
|
@ -117,17 +121,21 @@ def verify_crxfile(verbose, filename):
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def extract_crxfile(verbose, force, filename, destdir): |
|
|
|
|
"""Extract crxfile into specified destdir.""" |
|
|
|
|
crx = read_crx(filename) |
|
|
|
|
if is_valid_magic(crx.magic) | force: |
|
|
|
|
if ("" == destdir) | (destdir is None): |
|
|
|
|
if (destdir == "") | (destdir is None): |
|
|
|
|
destdir = "." |
|
|
|
|
if filename.endswith(".crx"): |
|
|
|
|
dirname = filename[0:len(filename) - 4] |
|
|
|
|
else: |
|
|
|
|
dirname = filename |
|
|
|
|
out = f = io.BytesIO(crx.data) |
|
|
|
|
zf = zipfile.ZipFile(out, 'r') |
|
|
|
|
zf.extractall(destdir + "/" + dirname) |
|
|
|
|
print("Content extracted into: " + destdir + "/" + dirname) |
|
|
|
|
out = io.BytesIO(crx.data) |
|
|
|
|
ziparchive = zipfile.ZipFile(out, 'r') |
|
|
|
|
ziparchive.extractall(destdir + "/" + dirname) |
|
|
|
|
if verbose: |
|
|
|
|
print("Content extracted into: " + destdir + "/" + dirname) |
|
|
|
|
return 0 |
|
|
|
|
else: |
|
|
|
|
print("Input file not valid.") |
|
|
|
|
return -1 |
|
|
|
|