Does someone know what they use instead of CryptUnprotectData on the Mac?
I checked skindle and a few things that are different for sure:
The kindle.info is located here:
Code:
/Users/x/Library/Application Support/Amazon/Kindle For Mac/storage/.kindle-info
string_32 is the same, but string_64 is different. The correct string is:
Code:
"ZB0bYyc1xDdW2wEV3Ff7KkPpL8UuGA4gz-Tme9Nn_tHh5SvXCsIiR6rJjQaqlOoM"
From there I just have no clue what they use instead of CryptUnprotectData. The other info was available using lsof/opensnoop and strings.