retrieve Chrome cookies on Windows then decrypt

decrypt.js

const dpapi = require("win-dpapi")
const sqlite3 = require("sqlite3")
const os = require("os")
const fs = require("fs")
const crypto = require("crypto")

const path =
  os.homedir() + `\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies`

db = new sqlite3.Database(path)

function decryptAES256GCM(key, enc, nonce, tag) {
  const algorithm = "aes-256-gcm"
  const decipher = crypto.createDecipheriv(algorithm, key, nonce)
  decipher.setAuthTag(tag)
  let str = decipher.update(enc, "base64", "utf8")
  str += decipher.final("utf-8")
  return str
}

db.serialize(function () {
  db.each(
    "SELECT host_key, path, is_secure, expires_utc, name, value, encrypted_value, creation_utc, is_httponly, has_expires, is_persistent FROM cookies ORDER BY LENGTH(path) DESC, creation_utc ASC",
    function (err, cookie) {
      if (cookie.value === "" && cookie.encrypted_value.length > 0) {
        let encryptedValue = cookie.encrypted_value
        if (
          encryptedValue[0] == 0x01 &&
          encryptedValue[1] == 0x00 &&
          encryptedValue[2] == 0x00 &&
          encryptedValue[3] == 0x00
        ) {
          cookie.value = dpapi
            .unprotectData(encryptedValue, null, "CurrentUser")
            .toString("utf-8")
          console.log({ name: cookie.name, value: cookie.value })
        } else if (
          encryptedValue[0] == 0x76 &&
          encryptedValue[1] == 0x31 &&
          encryptedValue[2] == 0x30
        ) {
          const localState = JSON.parse(
            fs.readFileSync(
              os.homedir() +
                "/AppData/Local/Google/Chrome/User Data/Local State"
            )
          )
          const b64encodedKey = localState.os_crypt.encrypted_key
          const encryptedKey = new Buffer.from(b64encodedKey, "base64")
          const key = dpapi.unprotectData(
            encryptedKey.slice(5, encryptedKey.length),
            null,
            "CurrentUser"
          )
          const nonce = encryptedValue.slice(3, 15)
          const tag = encryptedValue.slice(
            encryptedValue.length - 16,
            encryptedValue.length
          )
          encryptedValue = encryptedValue.slice(15, encryptedValue.length - 16)
          cookie.value = decryptAES256GCM(
            key,
            encryptedValue,
            nonce,
            tag
          ).toString("utf-8")
          console.log({ name: cookie.name, value: cookie.value })
        }
      }
    }
  )
})