Global-metadata.dat: Decrypt

Once you have a decrypted global-metadata.dat :

Interceptor.attach(Module.findExportByName(null, "fread"), onLeave: function(retval) if (this.file) var buffer = this.context.rdi; // adjust for architecture console.log(hexdump(buffer, length: 64 )); decrypt global-metadata.dat

Look for EVP_CIPHER_CTX_new , EVP_DecryptInit_ex , EVP_DecryptUpdate . Then extract the key. Once you have a decrypted global-metadata

To understand global-metadata.dat , one must first understand . // adjust for architecture console.log(hexdump(buffer