[subhobroto]

The details are interesting! How did you find all of this out? Did you download the tool in a VM and disasm it?

I assumed the OP was literally making throttled, batched, parallel IMAP FETCH calls with the BODYSTRUCTURE parameter to the mailbox, inspecting the `Content-Type` and/or `Content-Disposition` for image fingerprints and then grabbing the real payload.

However, from what you said here, it's a bit less sophisticated than that?

[KomoD]

> The details are interesting! How did you find all of this out? Did you download the tool in a VM and disasm it?

I downloaded the installer, opened it with 7zip, and extracted the app.asar file from resources/app.asar. All Electron apps have this, it's where the app code really lives.

Then I used asar to extract it. That gives you a few folders, including dist, which contains 5 .jsc files. Nearly everything related to fetching is in a file called engine.jsc. The jsc files are bytecode instead of raw JS because he didn't want anyone to reverse it, but with a little work you can figure it out (or you can just dump the strings and see that imapflow is in there)

Didn't need to run it at all.

> However, from what you said here, it's a bit less sophisticated than that?

Indeed. And re the image fingerprinting, it just checks the file names of "message parts", not content-type or content-disposition (even though imapflow exposes those)

[subhobroto]

> Indeed. And re the image fingerprinting, it just checks the file names of "message parts", not content-type or content-disposition (even though imapflow exposes those)

Thank You for the explanation. This sheds some light on why the OP kept saying this tool works only on GMail while also saying this is IMAP based. An IMAP solution should be mostly provider agnostic but because of all of this GMail filter business, it's not.