I'm currently working on a script to extract and decrypt saved passwords from Google Chrome using Python. I successfully handled the decryption of older versions that use CryptUnprotectData, but now I’m trying to deal with the v20 password format introduced in newer Chrome versions (after M112), which uses app-bound encryption with an AES-GCM key tied to the elevation_service.exe process. I’ve already retrieved the app_bound_encrypted_key from the Local State file and understand that this key must be decrypted using the elevation service COM interface, which is used internally by Chrome for decryption. Here’s what I’ve tried so far: Parsed the Login Data SQLite file and filtered entries with password_value starting with v20. Used Python to extract the app_bound_encrypted_key but I'm unable to decrypt it directly via DPAPI (returns None or error). I found a C++ project that uses the elevation_service.exe COM interface to decrypt the key, but I want to do this entirely in Python if possible. My main question is: Is there any known way to call or interface with the Chrome elevation service from Python to decrypt v20 passwords? Or should I write a C++ helper DLL or executable and invoke it from Python instead? I would appreciate any guidance, example code, or references to documentation or projects that have already tackled this. Thanks in advance! Continue reading...
