extracting cache data from FF 4.0

entz · 05-27-2011, 06:02 PM

HI folks,

well probably most of you have switched to FF 4.0

my major problem with it however , is the way the cache is stored on the hdd , now everything is sort of "sorted" into an endless number of folders.

i'm wondering why did they do it that way ?
how are we supposed to browse the cache folders from now?

btw i've always resorted to the cache folder for extracting all kinds of things the browser downloads...

cheers

almatic · 05-28-2011, 10:47 AM

type 'about:cache' in firefox

entz · 05-30-2011, 11:24 AM

Quote:

Originally Posted by almatic

type 'about:cache' in firefox

well this "about:cache" is just plain nasty , it sucks all the cpu and HDD power , takes like 5 minutes to render and produces nothing but garbage !

there is no way to filter or sort this data that is being spit on the screen ....

in short this is just horrible , what were the devs thinking ???!

almatic · 05-30-2011, 01:43 PM

the devs are saying that this, along with most other changes concerning the cache, has security reasons. Those other changes include, for example, that you won't easily find videos in the cache, as before. Instead they are obfuscated and immediately deleted in /tmp.
However you can still use the file descriptors from the procfs to copy the downloaded videos (in case videos are your problem...).

entz · 06-01-2011, 10:02 AM

Quote:

Originally Posted by almatic

the devs are saying that this, along with most other changes concerning the cache, has security reasons. Those other changes include, for example, that you won't easily find videos in the cache, as before. Instead they are obfuscated and immediately deleted in /tmp.
However you can still use the file descriptors from the procfs to copy the downloaded videos (in case videos are your problem...).

AHA , that's what i thought , yes i've read about those "security concerns" i think they are just bogus anyways (and i hate it when devs force decisions on us , would have been nice if they gave us an option to toggle on/off or something).

yes i was trying to find videos in the cache among other things such as flash objects and so forth , btw they are not obfuscated , it's just that they are scattered over a huge directory of directories....aaarrrg !

anyways ,how do i do this procfs magic that you're talking about ?

EDIT: ok looks like i figured out the first part
/proc/PID/fdinfo (PID being FF's pid)

now what? how do i access the files via fd's from the command line?

kind regards

almatic · 06-01-2011, 01:09 PM

Quote:

Originally Posted by entz

now what? how do i access the files via fd's from the command line?

the flash-plugin has its own process.

Code:

almatic@scotch:~$ ps -ef | grep flash
almatic    4364  3722  0 16:35 ?        00:00:05 /opt/firefox4/plugin-container /usr/lib/flashplugin-nonfree/libflashplayer.so -omnijar /opt/firefox4/omni.jar 3722 true plugin
almatic    5538  3620  0 19:49 pts/0    00:00:00 grep flash

now look at the fd's

Code:

almatic@scotch:~$ ll /proc/4364/fd
insgesamt 0
lr-x------ 1 almatic almatic 64  1. Jun 16:35 0 -> pipe:[9655]
l-wx------ 1 almatic almatic 64  1. Jun 16:35 1 -> /home/almatic/.xsession-errors
lrwx------ 1 almatic almatic 64  1. Jun 16:35 10 -> socket:[17000]
lrwx------ 1 almatic almatic 64  1. Jun 16:35 11 -> socket:[17001]
lrwx------ 1 almatic almatic 64  1. Jun 16:35 12 -> pipe:[17002]
lrwx------ 1 almatic almatic 64  1. Jun 16:35 13 -> pipe:[17002]
lrwx------ 1 almatic almatic 64  1. Jun 16:35 14 -> socket:[17005]
l-wx------ 1 almatic almatic 64  1. Jun 16:35 15 -> /home/almatic/.mozilla/firefox/kjrej1g4.default/cert8.db
lrwx------ 1 almatic almatic 64  1. Jun 16:35 16 -> /home/almatic/.mozilla/firefox/kjrej1g4.default/key3.db
lrwx------ 1 almatic almatic 64  1. Jun 16:35 17 -> /tmp/FlashXXeT97gR (deleted)
lr-x------ 1 almatic almatic 64  1. Jun 16:35 19 -> /dev/snd/pcmC0D0p
l-wx------ 1 almatic almatic 64  1. Jun 16:35 2 -> /home/almatic/.xsession-errors
lrwx------ 1 almatic almatic 64  1. Jun 16:35 3 -> socket:[16912]
lrwx------ 1 almatic almatic 64  1. Jun 16:35 4 -> socket:[16913]
l-wx------ 1 almatic almatic 64  1. Jun 16:35 5 -> pipe:[17767]
lr-x------ 1 almatic almatic 64  1. Jun 16:35 6 -> pipe:[17767]
l-wx------ 1 almatic almatic 64  1. Jun 16:35 7 -> pipe:[17768]
lr-x------ 1 almatic almatic 64  1. Jun 16:35 8 -> pipe:[17768]
l-wx------ 1 almatic almatic 64  1. Jun 16:35 9 -> anon_inode:[eventpoll]

You can just copy the video (the red one) to a directory of your choice.

cp /proc/4364/fd/17 /dir/of/choice/video.flv

entz · 06-01-2011, 03:56 PM

alright ,

but how come that the file is still accessible when it says that it has been deleted ?

if i attempt to access the actual /tmp pathname that the soft link references , i don't get anything ...how is that possible?
so if it's not deleted then where exactly is being held ? in the labyrinthian cache directoy ? in Ram ?

regards

almatic · 06-01-2011, 05:36 PM

deleted files are not really deleted. They are just 'unlinked' from its inode while the data is still there.
In the above case you are using the fact, that a process still has a file descriptor for that file (e.g. "has that file open"), which contains the necessary information to access the data on the disk.

If you have lsof installed, you can use that too (lsof -p <pid>).