meckazin/chromekatz

How meckazin/chromekatz works

ChromeKatz is a Windows toolset for recovering Chromium browser cookies and profile encryption keys. Its user workflows are live-process cookie extraction (standalone, Beacon BOF, or in-process PIC), offline extraction from a minidump, and ElevationKatz’s suspended-browser/debugger workflow for obtaining a key and optionally parsing profile databases. The groups distinguish these product variants and the shared process/memory work. Edges reflect shown imports, sampled calls, and README-described behavior; unsampled implementations are represented only where the README establishes the capability.

Main entry points: CookieKatz/Main.cpp CookieKatz CLI · CookieKatz-PIC/Main.cpp PIC Entry · CookieKatzBOF.cpp Cookie BOF · ElevationKatz/Main.cpp ElevationKatz CLI

Components 24

Live Cookie Extraction

CookieKatz CLI CookieKatz/Main.cpp
Process Targeting CookieKatz/Process.cpp
Cookie Memory Scan CookieKatz/Memory.cpp
Cookie Output CookieKatz/Helper.cpp
PIC Entry CookieKatz-PIC/Main.cpp
PIC Memory Scan CookieKatz-PIC/Memory.cpp
Dynamic API Resolution CookieKatz-PIC/GetProcAddress.cpp
PIC File Output CookieKatz-PIC/FileIO.cpp

Beacon Integrations

Cookie BOF CookieKatz-BOF/CookieKatzBOF.cpp
BOF Process Targeting CookieKatz-BOF/ChromeKatz/Process.cpp
BOF Cookie Scan CookieKatz-BOF/ChromeKatz/Memory.cpp
Process Listing BOF CookieKatz-BOF/ListChromeProcessCookies.cpp

Minidump Parsing

Minidump CLI CookieKatzMinidump/Main.cpp
Minidump Parser CookieKatzMinidump/udmp-parser.h
Dump Cookie Scan CookieKatzMinidump/Memory.cpp

Key Recovery

ElevationKatz CLI ElevationKatz/Main.cpp
ElevationKatz BOF ElevationKatz-BOF/ElevationKatzBOF.cpp
SQLite Interface ElevationKatz/sqlite3.h

Other components

Operator
Browser Process
Beacon Runtime
Minidump File
Browser Profile Databases
Suspended Browser

Connections 27

Operator → CookieKatz CLI: selects target
CookieKatz CLI → Process Targeting: selects process CookieKatz/Main.cpp
CookieKatz CLI → Cookie Memory Scan: scans memory CookieKatz/Main.cpp
Process Targeting → Browser Process: opens process
Cookie Memory Scan → Browser Process: reads memory
CookieKatz CLI → Cookie Output: writes results
Operator → PIC Entry: runs in process
PIC Entry → PIC Memory Scan: scans memory CookieKatz-PIC/Main.cpp
PIC Entry → Dynamic API Resolution: resolves APIs CookieKatz-PIC/Main.cpp
PIC Entry → PIC File Output: writes output CookieKatz-PIC/Main.cpp
Operator → Cookie BOF: invokes BOF
Cookie BOF → BOF Process Targeting: finds target CookieKatz-BOF/CookieKatzBOF.cpp
Cookie BOF → BOF Cookie Scan: scans cookies CookieKatz-BOF/CookieKatzBOF.cpp
Cookie BOF → Beacon Runtime: formats output
Operator → Process Listing BOF: lists targets
Process Listing BOF → BOF Process Targeting: finds processes CookieKatz-BOF/ListChromeProcessCookies.cpp
Operator → Minidump CLI: supplies dump
Minidump CLI → Minidump Parser: parses dump CookieKatzMinidump/Main.cpp
Minidump CLI → Dump Cookie Scan: scans dump CookieKatzMinidump/Main.cpp
Minidump File → Minidump CLI: provides input
Operator → ElevationKatz CLI: configures recovery
ElevationKatz CLI → Suspended Browser: starts suspended ElevationKatz/Main.cpp
ElevationKatz CLI → SQLite Interface: uses database API ElevationKatz/Main.cpp
ElevationKatz CLI → Browser Profile Databases: parses in-memory data
Suspended Browser → Browser Profile Databases: supplies memory data
Operator → ElevationKatz BOF: invokes BOF
ElevationKatz BOF → Beacon Runtime: uses Beacon API ElevationKatz-BOF/ElevationKatzBOF.cpp

Drawn by GitDiagram on November 10, 2026 from the repository's file tree, README and source files. Read as Markdown ·