#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *, ...);
void usage(char *cmd) {
  printf("%s v.%s by pschmidt (philipp(>_AT_<)pschmidt.it)\n",
         "pswRecovery4Moz", "0.1");
  printf("\n");
  printf("Usage: %s MODE OPT [OPT ...]\n", cmd);
  printf("\n");
  printf("Description:\n");
  printf("  This program will decrypt the mozilla database "
         "(signons.sqlite,key3.db)\n");
  printf("  where username and password of logins are stored.\n");
  printf("\n");
  printf("MODE:\n");
  printf("  -n  - Normal mode using libnss (DEFAULT)\n");
  printf("  -f  - Special mode w/o libnss (use %s and %s directly)\n",
         "key3.db", "signons.sqlite");
  printf("  -s  - Just calculate SHA1-HMAC for key (-k) and text (-t)\n");
  printf("  -a  - Invoke minimalistic ASN.1 parser for hexadecimal text "
         "specified by -a option\n");
  printf("\n");
  printf("OPT:\n");
  printf("  -r  - Enable raw output (output w/o description)\n");
  printf("  -k  - Key to use for SHA1-HMAC generation (see -s and -t)\n");
  printf(
      "  -t  - Text/message to use for SHA1-HMAC generation (see -s and -k)\n");
  printf("  -g  - Global salt in hex format (e.g \"01 ef 64 ...\") for des3 "
         "decryption \n");
  printf("  -e  - Entry salt in hex format (e.g \"63 53 64 ...\") for des3 "
         "decryption\n");
  printf("  -m  - Master key mozilla password\n");
  printf("  -u  - Encrypted username string (base64 encoded)\n");
  printf("  -p  - Encrypted password string (base64 encoded)! NOT the MASTER "
         "password (see -m)\n");
  printf("  -R  - Private key entry (RSA key,see -f)\n");
  printf("  -P  - Mozilla profile path\n");
  printf("  -l  - Mozilla (or OS) library path\n");
  printf("  -a  - Hexadecimal string (e.g. 30 59 01 ...) to be tested with the "
         "minimalistic ASN.1 parser (\n");
  printf("\n");
  printf("Example usage:\n");
  printf("  %s\n", cmd);
  printf("  %s -n -m \"pAsSw0rd\"\n", cmd);
  printf("  %s -f\n", cmd);
  printf("  %s -f -g \"3b 28 75 c2 a9 0d 40 2b 84 b6 83 e0 de a5 41 49 55 07 "
         "f3 d4\" \\\n",
         cmd);
  printf("     -e \"32 73 a0 bf e4 03 39 86 13 33 9e ff 24 cc 26 4b c2 ef 7c "
         "1a\" (use this together w/ -R)\n");
  printf("  %s -a \"30 13 02 01 05 16 0e 41 6e 79 62 6f 64 79 20 74 68 65 72 "
         "65 3f\"\n",
         cmd);
  printf("  %s -s -t \"15 96 bb 81 12 65 2a 43 e7 bd fb 2f dc 87 99 e5 00 00 "
         "00 00\" \\\n",
         cmd);
  printf("     -k \"8e 1e 3a 52 36 ab c3 44 55 2d 6e 1a 00 67 1a ed 69 2d 48 "
         "25\"\n");
  printf("\n");
  printf("CREDITS:\n");
  printf("   ...go especially to Dr Stephen Henson from drh-consultancy who "
         "did some research on key3.db which\n");
  printf("   was very useful for me to get started (see "
         "http://www.drh-consultancy.demon.co.uk/key3.html)\n");
  printf("\n");
  printf("KNOWN DEFICIENCIES/PROBLEMS/BUGS:\n");
  printf("   Since this tool was designed in a very restricted amount of time, "
         "it lacks of a good design.\n");
  printf("   There may be some borderline cases (e.g if you supply "
         "malicious/unexpected input etc.) where the tool failes/crashes\n");
  printf("   The project was more about the research of how Mozilla encrypts "
         "passwords and not so much on the tool itself\n");
  printf("   Use of more secure functions (as snprintf,strncpy,strncmp etc) "
         "would be great, but you know as of know it is a\n");
  printf("   quick-done tool\n");
  printf("\n");
  printf("AUTHORS/CONTRIBUTORS/CONTACT:\n");
  printf("   Please contact me at ph i lipp (AT] ps ch mi dt.it, w/o spaces "
         "and (AT] replaced\n");
  printf("   Contributors wanted\n");
  printf("   Please just drop me a mail if you find this tool useful and if "
         "you use this (or some of this) code\n");
  printf("   (for any purpose whatsoever,except malicious)\n");
  printf("   Also fixes and other suggestions are VERY welcome. Since the "
         "testing phase was NOT so ample,there may be some problems\n");
  printf("   that we can encounter and (hopefully easily) FIX.\n");
}


x86 assembly (clang, -O0):
<usage>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %rdi,-0x8(%rbp)
lea    0xedd(%rip),%rdi
lea    0xf08(%rip),%rsi
lea    0xf11(%rip),%rdx
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x11d2(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0xef5(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x11b2(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xef7(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xef7(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf34(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x117a(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf4d(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf46(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf64(%rip),%rdi
lea    0xf97(%rip),%rsi
lea    0xf98(%rip),%rdx
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf99(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xfc8(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1118(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1002(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xffa(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1020(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x104f(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1087(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x10c6(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1103(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x111a(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1140(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1188(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x11a6(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x11b6(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x11ce(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1054(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1214(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x1212(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x1206(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x120b(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x1202(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1240(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x128f(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x12c7(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1305(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xfb0(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1330(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x132c(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1384(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf78(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x13c9(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x13de(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1431(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x149c(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x14ff(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1564(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf16(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x155c(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x156d(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x15b4(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x15be(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1617(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x163b(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x16a8(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<usage>:
push   %rbx
mov    %rdi,%rbx
lea    0xec5(%rip),%rdi
lea    0xef0(%rip),%rsi
lea    0xef9(%rip),%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0xee5(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0x1041(%rip),%rdi
call   1040 <puts@plt>
lea    0x1042(%rip),%rdi
call   1040 <puts@plt>
lea    0x1080(%rip),%rdi
call   1040 <puts@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0x109e(%rip),%rdi
call   1040 <puts@plt>
lea    0x1098(%rip),%rdi
call   1040 <puts@plt>
lea    0xea2(%rip),%rdi
lea    0xed5(%rip),%rsi
lea    0xed6(%rip),%rdx
xor    %eax,%eax
call   1050 <printf@plt>
lea    0x109b(%rip),%rdi
call   1040 <puts@plt>
lea    0x10cb(%rip),%rdi
call   1040 <puts@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0x110a(%rip),%rdi
call   1040 <puts@plt>
lea    0x1103(%rip),%rdi
call   1040 <puts@plt>
lea    0x112a(%rip),%rdi
call   1040 <puts@plt>
lea    0x115a(%rip),%rdi
call   1040 <puts@plt>
lea    0x1193(%rip),%rdi
call   1040 <puts@plt>
lea    0x11d3(%rip),%rdi
call   1040 <puts@plt>
lea    0x1211(%rip),%rdi
call   1040 <puts@plt>
lea    0x1229(%rip),%rdi
call   1040 <puts@plt>
lea    0x1250(%rip),%rdi
call   1040 <puts@plt>
lea    0x1299(%rip),%rdi
call   1040 <puts@plt>
lea    0x12b8(%rip),%rdi
call   1040 <puts@plt>
lea    0x12c9(%rip),%rdi
call   1040 <puts@plt>
lea    0x12e2(%rip),%rdi
call   1040 <puts@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0x132d(%rip),%rdi
call   1040 <puts@plt>
lea    0xe03(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xdf8(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xdfe(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xdf6(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0x12ec(%rip),%rdi
call   1040 <puts@plt>
lea    0xe25(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xe5e(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0x131e(%rip),%rdi
call   1040 <puts@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0x134e(%rip),%rdi
call   1040 <puts@plt>
lea    0x134b(%rip),%rdi
call   1040 <puts@plt>
lea    0x13a4(%rip),%rdi
call   1040 <puts@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0x13ee(%rip),%rdi
call   1040 <puts@plt>
lea    0x1404(%rip),%rdi
call   1040 <puts@plt>
lea    0x1458(%rip),%rdi
call   1040 <puts@plt>
lea    0x14c4(%rip),%rdi
call   1040 <puts@plt>
lea    0x1528(%rip),%rdi
call   1040 <puts@plt>
lea    0x158e(%rip),%rdi
call   1040 <puts@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0x158b(%rip),%rdi
call   1040 <puts@plt>
lea    0x159d(%rip),%rdi
call   1040 <puts@plt>
lea    0x15e5(%rip),%rdi
call   1040 <puts@plt>
lea    0x15f0(%rip),%rdi
call   1040 <puts@plt>
lea    0x164a(%rip),%rdi
call   1040 <puts@plt>
lea    0x166f(%rip),%rdi
call   1040 <puts@plt>
lea    0x16dd(%rip),%rdi
pop    %rbx
jmp    1040 <puts@plt>

LLVM IR (-O0):
@.str = [50 x i8] c"%s v.%s by pschmidt (philipp(>_AT_<)pschmidt.it)\0A\00"
@.str.1 = [16 x i8] c"pswRecovery4Moz\00"
@.str.2 = [4 x i8] c"0.1\00"
@.str.3 = [2 x i8] c"\0A\00"
@.str.4 = [30 x i8] c"Usage: %s MODE OPT [OPT ...]\0A\00"
@.str.5 = [14 x i8] c"Description:\0A\00"
@.str.6 = [75 x i8] c" This program will decrypt the mozilla database (signons.sqlite,key3.db)\0A\00"
@.str.7 = [53 x i8] c" where username and password of logins are stored.\0A\00"
@.str.8 = [7 x i8] c"MODE:\0A\00"
@.str.9 = [44 x i8] c" -n - Normal mode using libnss (DEFAULT)\0A\00"
@.str.10 = [58 x i8] c" -f - Special mode w/o libnss (use %s and %s directly)\0A\00"
@.str.11 = [8 x i8] c"key3.db\00"
@.str.12 = [15 x i8] c"signons.sqlite\00"
@.str.13 = [61 x i8] c" -s - Just calculate SHA1-HMAC for key (-k) and text (-t)\0A\00"
@.str.14 = [86 x i8] c" -a - Invoke minimalistic ASN.1 parser for hexadecimal text specified by -a option\0A\00"
@.str.15 = [6 x i8] c"OPT:\0A\00"
@.str.16 = [52 x i8] c" -r - Enable raw output (output w/o description)\0A\00"
@.str.17 = [61 x i8] c" -k - Key to use for SHA1-HMAC generation (see -s and -t)\0A\00"
@.str.18 = [70 x i8] c" -t - Text/message to use for SHA1-HMAC generation (see -s and -k)\0A\00"
@.str.19 = [77 x i8] c" -g - Global salt in hex format (e.g \2201 ef 64 ...\22) for des3 decryption \0A\00"
@.str.20 = [75 x i8] c" -e - Entry salt in hex format (e.g \2263 53 64 ...\22) for des3 decryption\0A\00"
@.str.21 = [37 x i8] c" -m - Master key mozilla password\0A\00"
@.str.22 = [52 x i8] c" -u - Encrypted username string (base64 encoded)\0A\00"
@.str.23 = [86 x i8] c" -p - Encrypted password string (base64 encoded)! NOT the MASTER password (see -m)\0A\00"
@.str.24 = [44 x i8] c" -R - Private key entry (RSA key,see -f)\0A\00"
@.str.25 = [30 x i8] c" -P - Mozilla profile path\0A\00"
@.str.26 = [38 x i8] c" -l - Mozilla (or OS) library path\0A\00"
@.str.27 = [98 x i8] c" -a - Hexadecimal string (e.g. 30 59 01 ...) to be tested with the minimalistic ASN.1 parser (\0A\00"
@.str.28 = [16 x i8] c"Example usage:\0A\00"
@.str.29 = [6 x i8] c" %s\0A\00"
@.str.30 = [23 x i8] c" %s -n -m \22pAsSw0rd\22\0A\00"
@.str.31 = [9 x i8] c" %s -f\0A\00"
@.str.32 = [76 x i8] c" %s -f -g \223b 28 75 c2 a9 0d 40 2b 84 b6 83 e0 de a5 41 49 55 07 f3 d4\22 \\\0A\00"
@.str.33 = [97 x i8] c" -e \2232 73 a0 bf e4 03 39 86 13 33 9e ff 24 cc 26 4b c2 ef 7c 1a\22 (use this together w/ -R)\0A\00"
@.str.34 = [74 x i8] c" %s -a \2230 13 02 01 05 16 0e 41 6e 79 62 6f 64 79 20 74 68 65 72 65 3f\22\0A\00"
@.str.35 = [76 x i8] c" %s -s -t \2215 96 bb 81 12 65 2a 43 e7 bd fb 2f dc 87 99 e5 00 00 00 00\22 \\\0A\00"
@.str.36 = [71 x i8] c" -k \228e 1e 3a 52 36 ab c3 44 55 2d 6e 1a 00 67 1a ed 69 2d 48 25\22\0A\00"
@.str.37 = [10 x i8] c"CREDITS:\0A\00"
@.str.38 = [102 x i8] c" ...go especially to Dr Stephen Henson from drh-consultancy who did some research on key3.db which\0A\00"
@.str.39 = [97 x i8] c" was very useful for me to get started (see http://www.drh-consultancy.demon.co.uk/key3.html)\0A\00"
@.str.40 = [35 x i8] c"KNOWN DEFICIENCIES/PROBLEMS/BUGS:\0A\00"
@.str.41 = [97 x i8] c" Since this tool was designed in a very restricted amount of time, it lacks of a good design.\0A\00"
@.str.42 = [121 x i8] c" There may be some borderline cases (e.g if you supply malicious/unexpected input etc.) where the tool failes/crashes\0A\00"
@.str.43 = [113 x i8] c" The project was more about the research of how Mozilla encrypts passwords and not so much on the tool itself\0A\00"
@.str.44 = [115 x i8] c" Use of more secure functions (as snprintf,strncpy,strncmp etc) would be great, but you know as of know it is a\0A\00"
@.str.45 = [20 x i8] c" quick-done tool\0A\00"
@.str.46 = [31 x i8] c"AUTHORS/CONTRIBUTORS/CONTACT:\0A\00"
@.str.47 = [85 x i8] c" Please contact me at ph i lipp (AT] ps ch mi dt.it, w/o spaces and (AT] replaced\0A\00"
@.str.48 = [24 x i8] c" Contributors wanted\0A\00"
@.str.49 = [103 x i8] c" Please just drop me a mail if you find this tool useful and if you use this (or some of this) code\0A\00"
@.str.50 = [50 x i8] c" (for any purpose whatsoever,except malicious)\0A\00"
@.str.51 = [123 x i8] c" Also fixes and other suggestions are VERY welcome. Since the testing phase was NOT so ample,there may be some problems\0A\00"
@.str.52 = [54 x i8] c" that we can encounter and (hopefully easily) FIX.\0A\00"
define void @usage(i8* %0) {
%2 = alloca i8*
store i8* %0, i8** %2
%3 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([50 x i8], [50 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0))
%4 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%5 = load i8*, i8** %2
%6 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.4, i64 0, i64 0), i8* %5)
%7 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%8 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.5, i64 0, i64 0))
%9 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([75 x i8], [75 x i8]* @.str.6, i64 0, i64 0))
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([53 x i8], [53 x i8]* @.str.7, i64 0, i64 0))
%11 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.8, i64 0, i64 0))
%13 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.9, i64 0, i64 0))
%14 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([58 x i8], [58 x i8]* @.str.10, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.11, i64 0, i64 0), i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.12, i64 0, i64 0))
%15 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([61 x i8], [61 x i8]* @.str.13, i64 0, i64 0))
%16 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([86 x i8], [86 x i8]* @.str.14, i64 0, i64 0))
%17 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.15, i64 0, i64 0))
%19 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([52 x i8], [52 x i8]* @.str.16, i64 0, i64 0))
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([61 x i8], [61 x i8]* @.str.17, i64 0, i64 0))
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([70 x i8], [70 x i8]* @.str.18, i64 0, i64 0))
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([77 x i8], [77 x i8]* @.str.19, i64 0, i64 0))
%23 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([75 x i8], [75 x i8]* @.str.20, i64 0, i64 0))
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.21, i64 0, i64 0))
%25 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([52 x i8], [52 x i8]* @.str.22, i64 0, i64 0))
%26 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([86 x i8], [86 x i8]* @.str.23, i64 0, i64 0))
%27 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.24, i64 0, i64 0))
%28 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.25, i64 0, i64 0))
%29 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.26, i64 0, i64 0))
%30 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([98 x i8], [98 x i8]* @.str.27, i64 0, i64 0))
%31 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%32 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.28, i64 0, i64 0))
%33 = load i8*, i8** %2
%34 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.29, i64 0, i64 0), i8* %33)
%35 = load i8*, i8** %2
%36 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.30, i64 0, i64 0), i8* %35)
%37 = load i8*, i8** %2
%38 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.31, i64 0, i64 0), i8* %37)
%39 = load i8*, i8** %2
%40 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([76 x i8], [76 x i8]* @.str.32, i64 0, i64 0), i8* %39)
%41 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([97 x i8], [97 x i8]* @.str.33, i64 0, i64 0))
%42 = load i8*, i8** %2
%43 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([74 x i8], [74 x i8]* @.str.34, i64 0, i64 0), i8* %42)
%44 = load i8*, i8** %2
%45 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([76 x i8], [76 x i8]* @.str.35, i64 0, i64 0), i8* %44)
%46 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([71 x i8], [71 x i8]* @.str.36, i64 0, i64 0))
%47 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%48 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.37, i64 0, i64 0))
%49 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([102 x i8], [102 x i8]* @.str.38, i64 0, i64 0))
%50 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([97 x i8], [97 x i8]* @.str.39, i64 0, i64 0))
%51 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%52 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.40, i64 0, i64 0))
%53 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([97 x i8], [97 x i8]* @.str.41, i64 0, i64 0))
%54 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([121 x i8], [121 x i8]* @.str.42, i64 0, i64 0))
%55 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([113 x i8], [113 x i8]* @.str.43, i64 0, i64 0))
%56 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([115 x i8], [115 x i8]* @.str.44, i64 0, i64 0))
%57 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.45, i64 0, i64 0))
%58 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%59 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.46, i64 0, i64 0))
%60 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([85 x i8], [85 x i8]* @.str.47, i64 0, i64 0))
%61 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.48, i64 0, i64 0))
%62 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([103 x i8], [103 x i8]* @.str.49, i64 0, i64 0))
%63 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([50 x i8], [50 x i8]* @.str.50, i64 0, i64 0))
%64 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([123 x i8], [123 x i8]* @.str.51, i64 0, i64 0))
%65 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([54 x i8], [54 x i8]* @.str.52, i64 0, i64 0))
ret void
}

LLVM IR (-O2):
@.str = [50 x i8] c"%s v.%s by pschmidt (philipp(>_AT_<)pschmidt.it)\0A\00"
@.str.1 = [16 x i8] c"pswRecovery4Moz\00"
@.str.2 = [4 x i8] c"0.1\00"
@.str.4 = [30 x i8] c"Usage: %s MODE OPT [OPT ...]\0A\00"
@.str.10 = [58 x i8] c" -f - Special mode w/o libnss (use %s and %s directly)\0A\00"
@.str.11 = [8 x i8] c"key3.db\00"
@.str.12 = [15 x i8] c"signons.sqlite\00"
@.str.29 = [6 x i8] c" %s\0A\00"
@.str.30 = [23 x i8] c" %s -n -m \22pAsSw0rd\22\0A\00"
@.str.31 = [9 x i8] c" %s -f\0A\00"
@.str.32 = [76 x i8] c" %s -f -g \223b 28 75 c2 a9 0d 40 2b 84 b6 83 e0 de a5 41 49 55 07 f3 d4\22 \\\0A\00"
@.str.34 = [74 x i8] c" %s -a \2230 13 02 01 05 16 0e 41 6e 79 62 6f 64 79 20 74 68 65 72 65 3f\22\0A\00"
@.str.35 = [76 x i8] c" %s -s -t \2215 96 bb 81 12 65 2a 43 e7 bd fb 2f dc 87 99 e5 00 00 00 00\22 \\\0A\00"
@str = [13 x i8] c"Description:\00"
@str.53 = [74 x i8] c" This program will decrypt the mozilla database (signons.sqlite,key3.db)\00"
@str.54 = [52 x i8] c" where username and password of logins are stored.\00"
@str.55 = [6 x i8] c"MODE:\00"
@str.56 = [43 x i8] c" -n - Normal mode using libnss (DEFAULT)\00"
@str.57 = [60 x i8] c" -s - Just calculate SHA1-HMAC for key (-k) and text (-t)\00"
@str.58 = [85 x i8] c" -a - Invoke minimalistic ASN.1 parser for hexadecimal text specified by -a option\00"
@str.59 = [5 x i8] c"OPT:\00"
@str.60 = [51 x i8] c" -r - Enable raw output (output w/o description)\00"
@str.61 = [60 x i8] c" -k - Key to use for SHA1-HMAC generation (see -s and -t)\00"
@str.62 = [69 x i8] c" -t - Text/message to use for SHA1-HMAC generation (see -s and -k)\00"
@str.63 = [76 x i8] c" -g - Global salt in hex format (e.g \2201 ef 64 ...\22) for des3 decryption \00"
@str.64 = [74 x i8] c" -e - Entry salt in hex format (e.g \2263 53 64 ...\22) for des3 decryption\00"
@str.65 = [36 x i8] c" -m - Master key mozilla password\00"
@str.66 = [51 x i8] c" -u - Encrypted username string (base64 encoded)\00"
@str.67 = [85 x i8] c" -p - Encrypted password string (base64 encoded)! NOT the MASTER password (see -m)\00"
@str.68 = [43 x i8] c" -R - Private key entry (RSA key,see -f)\00"
@str.69 = [29 x i8] c" -P - Mozilla profile path\00"
@str.70 = [37 x i8] c" -l - Mozilla (or OS) library path\00"
@str.71 = [97 x i8] c" -a - Hexadecimal string (e.g. 30 59 01 ...) to be tested with the minimalistic ASN.1 parser (\00"
@str.72 = [15 x i8] c"Example usage:\00"
@str.73 = [96 x i8] c" -e \2232 73 a0 bf e4 03 39 86 13 33 9e ff 24 cc 26 4b c2 ef 7c 1a\22 (use this together w/ -R)\00"
@str.74 = [70 x i8] c" -k \228e 1e 3a 52 36 ab c3 44 55 2d 6e 1a 00 67 1a ed 69 2d 48 25\22\00"
@str.75 = [9 x i8] c"CREDITS:\00"
@str.76 = [101 x i8] c" ...go especially to Dr Stephen Henson from drh-consultancy who did some research on key3.db which\00"
@str.77 = [96 x i8] c" was very useful for me to get started (see http://www.drh-consultancy.demon.co.uk/key3.html)\00"
@str.78 = [34 x i8] c"KNOWN DEFICIENCIES/PROBLEMS/BUGS:\00"
@str.79 = [96 x i8] c" Since this tool was designed in a very restricted amount of time, it lacks of a good design.\00"
@str.80 = [120 x i8] c" There may be some borderline cases (e.g if you supply malicious/unexpected input etc.) where the tool failes/crashes\00"
@str.81 = [112 x i8] c" The project was more about the research of how Mozilla encrypts passwords and not so much on the tool itself\00"
@str.82 = [114 x i8] c" Use of more secure functions (as snprintf,strncpy,strncmp etc) would be great, but you know as of know it is a\00"
@str.83 = [19 x i8] c" quick-done tool\00"
@str.84 = [30 x i8] c"AUTHORS/CONTRIBUTORS/CONTACT:\00"
@str.85 = [84 x i8] c" Please contact me at ph i lipp (AT] ps ch mi dt.it, w/o spaces and (AT] replaced\00"
@str.86 = [23 x i8] c" Contributors wanted\00"
@str.87 = [102 x i8] c" Please just drop me a mail if you find this tool useful and if you use this (or some of this) code\00"
@str.88 = [49 x i8] c" (for any purpose whatsoever,except malicious)\00"
@str.89 = [122 x i8] c" Also fixes and other suggestions are VERY welcome. Since the testing phase was NOT so ample,there may be some problems\00"
@str.90 = [53 x i8] c" that we can encounter and (hopefully easily) FIX.\00"
define void @usage(i8* %0) {
%2 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([50 x i8], [50 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0))
%3 = tail call i32 @putchar(i32 10)
%4 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.4, i64 0, i64 0), i8* %0)
%5 = tail call i32 @putchar(i32 10)
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @str, i64 0, i64 0))
%7 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([74 x i8], [74 x i8]* @str.53, i64 0, i64 0))
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([52 x i8], [52 x i8]* @str.54, i64 0, i64 0))
%9 = tail call i32 @putchar(i32 10)
%10 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @str.55, i64 0, i64 0))
%11 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([43 x i8], [43 x i8]* @str.56, i64 0, i64 0))
%12 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([58 x i8], [58 x i8]* @.str.10, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.11, i64 0, i64 0), i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.12, i64 0, i64 0))
%13 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([60 x i8], [60 x i8]* @str.57, i64 0, i64 0))
%14 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([85 x i8], [85 x i8]* @str.58, i64 0, i64 0))
%15 = tail call i32 @putchar(i32 10)
%16 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([5 x i8], [5 x i8]* @str.59, i64 0, i64 0))
%17 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([51 x i8], [51 x i8]* @str.60, i64 0, i64 0))
%18 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([60 x i8], [60 x i8]* @str.61, i64 0, i64 0))
%19 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([69 x i8], [69 x i8]* @str.62, i64 0, i64 0))
%20 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([76 x i8], [76 x i8]* @str.63, i64 0, i64 0))
%21 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([74 x i8], [74 x i8]* @str.64, i64 0, i64 0))
%22 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @str.65, i64 0, i64 0))
%23 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([51 x i8], [51 x i8]* @str.66, i64 0, i64 0))
%24 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([85 x i8], [85 x i8]* @str.67, i64 0, i64 0))
%25 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([43 x i8], [43 x i8]* @str.68, i64 0, i64 0))
%26 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @str.69, i64 0, i64 0))
%27 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @str.70, i64 0, i64 0))
%28 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([97 x i8], [97 x i8]* @str.71, i64 0, i64 0))
%29 = tail call i32 @putchar(i32 10)
%30 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([15 x i8], [15 x i8]* @str.72, i64 0, i64 0))
%31 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str.29, i64 0, i64 0), i8* %0)
%32 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.30, i64 0, i64 0), i8* %0)
%33 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.31, i64 0, i64 0), i8* %0)
%34 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([76 x i8], [76 x i8]* @.str.32, i64 0, i64 0), i8* %0)
%35 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([96 x i8], [96 x i8]* @str.73, i64 0, i64 0))
%36 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([74 x i8], [74 x i8]* @.str.34, i64 0, i64 0), i8* %0)
%37 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([76 x i8], [76 x i8]* @.str.35, i64 0, i64 0), i8* %0)
%38 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([70 x i8], [70 x i8]* @str.74, i64 0, i64 0))
%39 = tail call i32 @putchar(i32 10)
%40 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @str.75, i64 0, i64 0))
%41 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([101 x i8], [101 x i8]* @str.76, i64 0, i64 0))
%42 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([96 x i8], [96 x i8]* @str.77, i64 0, i64 0))
%43 = tail call i32 @putchar(i32 10)
%44 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @str.78, i64 0, i64 0))
%45 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([96 x i8], [96 x i8]* @str.79, i64 0, i64 0))
%46 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([120 x i8], [120 x i8]* @str.80, i64 0, i64 0))
%47 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([112 x i8], [112 x i8]* @str.81, i64 0, i64 0))
%48 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([114 x i8], [114 x i8]* @str.82, i64 0, i64 0))
%49 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @str.83, i64 0, i64 0))
%50 = tail call i32 @putchar(i32 10)
%51 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @str.84, i64 0, i64 0))
%52 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([84 x i8], [84 x i8]* @str.85, i64 0, i64 0))
%53 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @str.86, i64 0, i64 0))
%54 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([102 x i8], [102 x i8]* @str.87, i64 0, i64 0))
%55 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([49 x i8], [49 x i8]* @str.88, i64 0, i64 0))
%56 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([122 x i8], [122 x i8]* @str.89, i64 0, i64 0))
%57 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([53 x i8], [53 x i8]* @str.90, i64 0, i64 0))
ret void
}