Well I'm super late to this, but since no one ever responded I'll give it a shot!
(FYI, the answer is "really hard")
The thing to realize about ENS is that domains aren't actually stored in plaintext but as hashes (the function they use is namehash).
Read this: https://www.npmjs.com/package/eth-ens-namehash
So in order to do this, you would need to:
- Look at the ENS smart contract to determine all the addresses that have a domain.
- Retrieve the hash that these addresses have registered
- Determine what possible human-readable name could have resulted in this hash
3 is the part that will surely mess you up, because you basically have no other way to do it other than pre-computing hashes of known values and looking for a hit among all known eth addresses. (brute force)
However, this is SOMEWHAT doable because of a couple of contraints:
- The number of registered domains IS PUBLIC at all times (thanks blockchain!), so you will always know both the number of addresses and how many of them you have decoded into human-readable.
- The number of registered domains is still relatively small (40kish), so brute force isn't completely out of the realm of possibility
- It isn't practical to register an .eth longer than the address that registered it... so at least you can set an upper bound on your dictionary that should cover 99% of registration cases.