UserPreferencesTool

UserPreferencesExplorer is a tool that was created to provide an insight into the encrypted data being stored on your personal computer in the form of 'Userpreferences.bag'.

{  
   "username":"[email protected]",
   "refresh_token":"<refresh_token>",
   "scope_string":"email,persona_info,persona_create,user_info,sansar_login,read_marketplace,write_marketplace,read_subscription_json,read_subscription,persona_id:01234567-89AB-CDEF-0123-456789ABCDEF"
}

Description

UserPreferences.bag is stored under the current user's local app data C:\Users\<username>\AppData\Local\LindenLab\SansarClient and is encrypted with a combination of a unique machine ID and a constant salt. The unique machine ID is generated by Windows on installation and can be found in the registry under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography key as MachineGuid.

Decryption process

1. Read MachineGuid from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography

2. Mangle the MachineGuid using the the following algorithm

for(size_t index = 0; index < MachineGuid.size(); ++i)
{
    MachineGuid[index] = ((index + 2) * MachineGuid[index]) % 128 
}

3. Generate a key and initialization vector using the constant salt and mangled data via EVP_BytesToKey
   • Cipher: AES 256 CBC cipher
   • Digest: SHA-1
   • Iterations: 5
   • Salt: 0x6E3F032949637D2E
   • Data: MangledData

auto derived_key_length = EVP_BytesToKey(
    EVP_aes_256_cbc(),
    EVP_sha1(),
    kSalt,
    mangled_data,
    mangled_data.size(),
    5,
    &out_key,
    &out_initialization_vector
);

4. Decrypt the contents of UserPreferences.bag with the generated key and initialization vector

auto cipher = EVP_aes_256_cbc();
auto ctx = EVP_CIPHER_CTX_new();

EVP_CIPHER_CTX_init(ctx);
EVP_EncryptInit_ex(ctx, cipher, nullptr, &key, &initialization_vector);
EVP_EncryptUpdate(ctx, &out_plaintext, &plaintext_length, &plaintext, plaintext.size());
EVP_EncryptFinal_ex(ctx, &out_plaintext[plaintext_length], &additional_length);
EVP_CIPHER_CTX_free(ctx);

5. out_plaintext now contains the decrypted contents