IDM- integration addon

The function `P()` calls `browser.cookies.getAll({url})` to retrieve all cookies for a given URL, then `Q()` serializes them into a `name=value; name=value` string. This serialized cookie string is packed into field index 51 of the message payload and transmitted to the native IDM process via the WebSocket/native-messaging channel (function `O()`). This means session tokens, auth cookies, and tracking cookies for every URL the user downloads are exfiltrated to the native application with no user visibility.

function P(a, b) {  w && a.startsWith("ftp:") ? b([]) : (a = {    url: a  }, ma && (a.firstPartyDomain = null), browser.cookies.getAll(a, b))}function Q(a) {  var b = "";  if (a && a.length)    for (var c = 0; c < a.length; c++) b && (b += "; "), b += a[c].name, b += "=", b += a[c].value;  return b}// Called at line 1211 before processing requests, and at line 1294:n.Ga = function(a, b, c) {  ...  e[51] = Q(b); // Q(b) is all serialized cookies  ...  return O(this, 13, 1, 129, d, e) || gc(this, a.id)};

The extension registers blocking `webRequest` listeners on all URLs (`*://*/*`) capturing request bodies, full request headers, and full response headers for every network request made by any tab. POST request bodies (`a.requestBody`) are stored at `a.f` and later serialized with `hc()` and sent in field 14 of messages to IDM. Response bodies are similarly captured in certain cases (e.g. M3U8/F4F streams via `XMLHttpRequest` at line 1198). This constitutes comprehensive man-in-the-middle surveillance of all browser traffic.

a.I(4, browser.webRequest.onBeforeRequest, a.La, {  urls: G,  types: b}, ["requestBody"]);a.I(4, browser.webRequest.onBeforeSendHeaders, a.vb, {  urls: G,  types: b}, ["requestHeaders"].concat(c, d));a.I(4, browser.webRequest.onHeadersReceived, a.xb, {  urls: G,  types: b}, ["responseHeaders"].concat(c));a.I(4, browser.webRequest.onResponseStarted, a.yb, {  urls: G,  types: b});a.I(4, browser.webRequest.onErrorOccurred, a.wb, {  urls: G,  types: b})

The extension establishes a persistent WebSocket connection to localhost ports 127.0.0.1:1001 or 0.1.0.1:1001 and falls back to native messaging (`connectNative('com.tonec.idm')`). All intercepted request/response data, cookies, headers, and page metadata are streamed through this channel to the IDM native application. While the stated purpose is download interception, the channel is bidirectional and can receive commands from the native app that drive extension behavior, creating a native-controlled backdoor into the browser.

n.na = function() {  var a = this.S % (F.length + 1);  if (a < F.length) this.A = a = new WebSocket("ws://" + F[a] + "/?cid=" + Math.random().toString().substr(2, 9), "plugin.v3.internetdownloadmanager.com"), a.onopen = this.pa, a.onclose = this.N, a.onmessage = this.pb, 1 == a.readyState ? this.pa() : 3 == a.readyState && this.N();  else if (w) this.N();  else {    this.da = a = browser.runtime.connectNative("com.tonec.idm");    try {      a.postMessage("")    } catch (b) {      a = null    }    a ? (a.onDisconnect.addListener(this.N), a.onMessage.addListener(this.cb), this.pa()) : this.N()  }};

The extension uses the `management` permission to look up a competing IDM extension by ID (`jeaohhlajejodfjadcponpnjgkiikocn`) and, if found enabled, calls `browser.management.setEnabled(d.id, false)` to forcibly disable it without user consent. It also conditionally self-disables in Edge-based browsers based on the detected version. Silently disabling other installed extensions is a privilege escalation and interference behavior not disclosed to users.

n.Aa = J[J.length] = function wc(a, b, c, d, e) {    var h = ia && "llbjbkhnmlidjebalopleeepgdfgcpec" == browser.runtime.id && "ngpampappnmepgilojfohadhhmbhlaek";    if (!a) return this.ma = !1, browser.storage.local.get("version", b = R()), ...      u && browser.management.get("jeaohhlajejodfjadcponpnjgkiikocn", d = R()),      ia && browser.management.get(h || "llbjbkhnmlidjebalopleeepgdfgcpec", e = R()), S(wc, this, !0, b, c, d, e);    N(d) && d.enabled && browser.management.setEnabled(d.id, !1);    N(e) && e.enabled && browser.management.setEnabled(h || browser.runtime.id, !1);

This script is injected into every page's DOM via `content.js` (appended to `document.head`) and monkey-patches `XMLHttpRequest.prototype.open` and the global `fetch` function. The patches intercept XHR/fetch responses matching a configurable URL regex, read the response text/body, and relay them via `window.postMessage` back to the content script and ultimately to background.js. The regex patterns are provided dynamically from background.js, meaning the IDM native app can direct which response bodies are captured.

(function() {  function n(a, b) {    try {      h.test(b) && this.addEventListener("loadend", p.bind(this))    } catch (c) {}    return e.apply(this, arguments)  }  function p() {    try {      var a = this.getResponseHeader("X-IDM-Request-ID");      if (a) {        var b = k.exec(this.responseText);        g([1229212979, a, b && (b[1] || this.responseText)], "/")      }    } catch (c) {}  }  function q(a, b) {    var c = f.apply(this, arguments);    try {      if (h.test(a.url || a)) return c.then(r)    } catch (d) {}    return c  }  ...  window.addEventListener("message", function(a) {    ...    switch (b[0]) {      case 1229212978:        a = b[1];        var c = b[2],          d = b[3];        b = b[4];        d ? (h = RegExp(d), k = RegExp(b)) : a = c = !1;        try {          a ? e || (e = XMLHttpRequest.prototype.open) && (XMLHttpRequest.prototype.open = n) : e && (XMLHttpRequest.prototype.open = e, e = null),            c ? f || (f = fetch) && (fetch = q) : f && (fetch = f, f = null)        } catch (m) {}    }  }, !1);  g([1229212977], "/")})();

The extension reads the system proxy configuration on startup and subscribes to all changes via `browser.proxy.settings.onChange`. The extracted proxy mode, PAC script data/URL, and proxy server addresses are stored in `this.m` and transmitted to the IDM native process in the connection handshake (field 121 of the initial `pa()` message). Transmitting proxy configuration to a native application leaks network topology and could allow the native app to route traffic through the same proxy.

n.Ka = function(a) {  browser.runtime.lastError;  if (a) {    var b = a.value;    a = ab[b.mode];    ...    if (5 == a && (d = b.pacScript)) d.data && 5E4 < d.data.length ? a = 4 : (c = d.data) ? (a = 6, c = c.replace(...)) : c = d.url, this.U.fill(!0);    else if (7 == a) {      b = b.rules;...c = L(this, b.singleProxy);...    }    b = 5 > a ? a.toString() : c ? a + ":" + c : null;    b != this.m && (this.m && this.za(), this.m = b)  }};// registered at line 882:u && this.I(1, browser.proxy.settings.onChange, this.Ka);u && browser.proxy.settings.get({}, this.Ka);

On every page load and navigation event, the content script sends message type 21 containing the full current URL (`location.href`) and `document.referrer` to the background script, which forwards it to IDM. The page title (including OG title fallback) is also extracted and transmitted. This systematically builds a browsing history profile in the native IDM application, collecting every URL and referrer the user visits across all tabs.

f.wa = function(b) {  if (this.D(arguments)) {    var a = [21, this.tb || location.href, document.referrer];    b && a.push(document.getElementsByTagName("video").length, document.getElementsByTagName("audio").length);    this.a.postMessage(a)  }};// Called at f.Ra (message type 17 from background) and on DOMContentLoaded.// Also:f.l = function() {  var b = I ? 80 : 90;  try {    var a = window.top.document.title  } catch (c) {}  a || (a = (a = document.head.querySelector('meta[property="og:title"]')) && a.getAttribute("content"), b = 70);  a && (a = a.replace(...), a = new String(a.trim()), a.src = b);  return a;};

Upon establishing connection to the IDM process (WebSocket or native messaging), the extension immediately transmits a fingerprint containing browser version (`D` / `y`), platform window class name (`ya`, e.g. `Chrome_RenderWidgetHostHWND`), UI locale, and the full install/update event object (`this.Sa`). This device/environment fingerprint is sent on every reconnect and uniquely identifies the user's browser installation to the local IDM process, which may log or forward it.

n.pa = function() {  this.v = !0;  this.qa = 1;  var a = browser.i18n.getUILanguage().replace("_", "-");  "sr" == a && (a += "-Cyrl-CS");  var b = [15, 41, Na ? 1028 : 1031, 0],    c = {};  c[112] = D; // browser version  c[113] = la; // another version field  c[114] = ya; // window class name  c[125] = JSON.stringify(this.Sa); // install event info  c[116] = a; // UI language  O(this, 2, 1, Na ? 0 : 1024, b, c)};