dashlane2john.py not properly recognizing compression in Dashlane .aes files

🥇 👍

A bug has emerged for dashlane2john.py, now producing incorrect results due to a change in Dashlane's ".aes" file compression.

The "2john" utility used to extract hashes from Dashlane ".aes" files looks for the ascii string literal "KWC3" indicating compression. If it finds that string in bytes 33-36 (after the salt), then it sets v=1, skips those four bytes, and writes the hash as the 220 bytes following byte 36.

However Dashlane ".aes" files which use compression now set bytes 33-36 = 4b574336 (ascii "KWC6"). As a result, the dashlane2john.py utility now fails to match the compression code "KWC6" and incorrectly writes the hash to stdout as 224 bytes starting with "KWC6", with v=0 indicating compression is not in use.

To fix this bug, dashlane2john.py should also recognize KWC6 in Dashlane ".aes" files, set v=1, skip these four bytes, and write the hash as 220 bytes starting with byte 37.

My Command Line: python dashlane2john.py mydata\personaldataDatabase.aes > mydata\mydash2.hash

Inspect dashlane2john.py and its existing KWC3 handling first. Run the reported command with a Dashlane .aes file using KWC6 and verify that compression is detected, v=1 is emitted, and the extracted hash is 220 bytes beginning after the marker.