Neura Market
xaitax/Chrome-App-Bound-Encryption-Decryption logo

xaitax/Chrome-App-Bound-Encryption-Decryption

Free

Bypass Chromium's App-Bound Encryption via Direct Syscall-based Reflective Process Hollowing. Extract cookies, passwords, payment methods & tokens from Chrome, Edge, Brave & Avast - fileless, user-mode, no admin required.

FreeFree tier
Type
Open Source
Visit Website GitHub (38 stars)

About xaitax/Chrome-App-Bound-Encryption-Decryption

Chrome-App-Bound-Encryption-Decryption (ChromElevator) is a post-exploitation tool that demonstrates a complete in-memory bypass of Chromium's App-Bound Encryption (ABE). It uses Direct Syscall-based Reflective Process Hollowing to launch a legitimate browser process in a suspended state, inject a payload, and hijack its identity and security context. The fileless payload is embedded as a ChaCha20-encrypted compile-time byte array, decrypted in-memory, and reflectively loaded to bypass static scanners. The tool extracts cookies, passwords, payment methods, IBANs, and Google OAuth tokens from Chrome, Edge, Brave, and Avast browsers. It discovers all user profiles, exports data to structured JSON, and includes comprehensive browser fingerprinting. Stealth features include Hell's Gate syscall resolution to evade EDR/AV user-land hooks, reflective DLL injection, and target-context COM invocation to satisfy ABE path-validation security checks. No administrator privileges are required.

Key Features

Full user-mode decryption of cookies, passwords, payment methods, IBANs, and Google OAuth tokens
Direct Syscall-based Reflective Process Hollowing for stealthy process creation and injection
Fileless payload delivery using ChaCha20-encrypted compile-time byte arrays
Hell's Gate technique for dynamic syscall number resolution without plaintext names
Reflective DLL Injection to bypass LoadLibrary monitoring
Target-context COM invocation to satisfy App-Bound Encryption security checks
Discovers and processes all user profiles (Default, Profile 1, etc.)
Exports extracted data into structured JSON files organized by profile
Comprehensive browser fingerprinting with system information
Supports Chrome, Edge, Brave, and Avast browsers

Pros & Cons

Pros
  • Operates entirely in-memory with no files written to disk
  • No administrator privileges required
  • Bypasses EDR/AV user-land API hooks via direct syscalls
  • Supports multiple Chromium-based browsers (Chrome, Edge, Brave, Avast)
  • Exports structured JSON output for easy analysis
  • Living-off-the-Land technique minimizes forensic footprint
Cons
  • Windows-only tool due to reliance on WinAPI and process hollowing
  • Requires initial access to the target system (post-exploitation)
  • May be detected by advanced EDR that monitors syscall patterns or reflective DLL loading
  • Only targets Chromium-based browsers, not other browsers or applications
  • Intended for authorized security testing; misuse could be illegal

Best For

Post-exploitation credential extraction for authorized penetration testing and red teamingSecurity research into Chromium App-Bound Encryption vulnerabilitiesAssessment of browser security and data protection mechanismsForensic recovery of browser-stored credentials in incident response

FAQ

Which browsers are supported?
Chrome, Edge, Brave, and Avast for Browser (and likely other Chromium-based browsers).
Does it require administrator privileges?
No, it operates entirely in user-mode and does not require admin rights.
How does the tool evade detection?
It uses direct syscalls to bypass user-land API hooks, fileless payload delivery (ChaCha20-encrypted embed), reflective DLL injection, and Hell's Gate syscall resolution to avoid static and behavioral detection.
What types of data can be extracted?
Cookies, passwords, payment methods, IBANs, and Google OAuth tokens.
Is this tool intended for malicious use?
No, it is designed for security research and authorized penetration testing to demonstrate the vulnerabilities in Chromium's App-Bound Encryption.