Update README.md

Author: nooperation

README.md

@@ -1,3 +1,60 @@
 [![Build status](https://ci.appveyor.com/api/projects/status/6p494gy556gjat6d?svg=true)](https://ci.appveyor.com/project/nooperation/userpreferencesexplorer)
 # UserPreferencesTool
-Tools for interacting with the encrypted UserPreferences.bag for Project Sansar
+UserPreferencesExplorer is a tool that was created to provide an insight into the encrypted data being stored on your personal computer in the form of 'Userpreferences.bag'.
+
+```json
+{  
+   "username":"example@example.com",
+   "refresh_token":"<refresh_token>",
+   "scope_string":"email,persona_info,persona_create,user_info,sansar_login,read_marketplace,write_marketplace,read_subscription_json,read_subscription,persona_id:01234567-89AB-CDEF-0123-456789ABCDEF"
+}
+```
+
+# Description
+
+UserPreferences.bag is stored under the current user's local app data `C:\Users\<username>\AppData\Local\LindenLab\SansarClient` and is encrypted with a combination of a unique machine ID and a constant salt. The unique machine ID is generated by Windows on installation and can be found in the registry under the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography` key as `MachineGuid`.
+
+# Decryption process
+
+1. Read `MachineGuid` from `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography`
+
+2. Mangle the `MachineGuid` using the the following algorithm
+```cpp
+for(size_t index = 0; index < MachineGuid.size(); ++i)
+{
+    MachineGuid[index] = ((index + 2) * MachineGuid[index]) % 128 
+}
+```
+
+3. Generate a key and initialization vector using the constant salt and mangled data via EVP_BytesToKey
+    * Cipher: AES 256 CBC cipher
+    * Digest: SHA-1
+    * Iterations: 5
+    * Salt: 0x6E3F032949637D2E
+    * Data: MangledData
+```cpp
+auto derived_key_length = EVP_BytesToKey(
+    EVP_aes_256_cbc(),
+    EVP_sha1(),
+    kSalt,
+    mangled_data,
+    mangled_data.size(),
+    5,
+    &out_key,
+    &out_initialization_vector
+);
+```
+
+4. Decrypt the contents of UserPreferences.bag with the generated key and initialization vector
+```cpp
+auto cipher = EVP_aes_256_cbc();
+auto ctx = EVP_CIPHER_CTX_new();
+
+EVP_CIPHER_CTX_init(ctx);
+EVP_EncryptInit_ex(ctx, cipher, nullptr, &key, &initialization_vector);
+EVP_EncryptUpdate(ctx, &out_plaintext, &plaintext_length, &plaintext, plaintext.size());
+EVP_EncryptFinal_ex(ctx, &out_plaintext[plaintext_length], &additional_length);
+EVP_CIPHER_CTX_free(ctx);
+```
+
+5. out_plaintext now contains the decrypted contents