how to extract and decrypt WeChat EnMicromsg.db on Android phone
One of my friend came to me with an Android phone. She saild somehting wrong with the hardware of her friend's phone, and her friend are eager to backup his data,especially WeChat chat messages..unfortunatelly her friend forgot the accoutn/password to logon WeChat....What can I say..she is one of my best firend..I should do her a favor...
I took a look at this phone, and I found it "Rooted" already. That is a good news~ Some people root his/her phone in order to gain full access,but..guest what..There is an old saying:"Water is a boon in ther desert, but the drowning man cursed it". Rooted phones are easier to do physical extraction because Root privilege has been realeased. Those who try to operate full function of smartphones by Rooting his/her Android phone actually make smartphones more insecure..but to forensic guys, couldn't be better...
First I interviewed her to gather some basic info about the case. The scenario was that the version of WeChat is 6.0.1, but she had no WeChat account/password to logon to...That's all what I know about this case, and now I'd like to explain what I'm going to do.
1.Locate the WeChat EnMicromsg.db and export it to the forensics workstation you use.
2.Take a look at EnMicromsg.db..It's an encrypted database..we could not see what is inside..so we have to decrypt it...
3.Let me explian the encryption algorithm of WeChat EnMicromsg.db. The pragma key is the first 7 character of MD5(IMEI+WeChat UIN). That is it,very easy to calculate it. first figure out the IMEI,you have to options:
a. Dial *#06#
b. Take off back cover and battery and you could see some info including IMEI
4.Find out the WeChat UIN. UIN is the unique id# of WeChat account. The UIN is inside the file system_config_prfs.xml
5.Get the UIN value
6.Input the IMEI and UIN string,be carefully there is no need to add any symbol between these two string...Generate the MD5 value.. the key is the first 7 character as below: 9C751DC
7.Now the most import step. You need a tool - SQLCipher to decrypte the EnMicromsg.db with the pragma key we found. Since the SQLCipher is opensource, you could find some resource by searching the Gurdian Project on the internet. I show you the Windwos solution first. Notice that the version is 2.1
8. Use SQLCipher 2.1 to open EnMicromsg.db and input the pragam key
9.You could see the chat messages now...
10.You also could export those chat messages so you don't have to open database more often.
Finally, I encrypted the WeChat Enmicromsg.db for her. She's very happy with that. Couple days later I realized that it's her boy friend's smartphone...What a tradegy, I did not do it on purpose...Sorry buddy..Hope you will be alright this time...I think she will kill you if she found some ambigious chat messages in you phone..God bless you...
how to extract and decrypt WeChat EnMicromsg.db on Android phone的更多相关文章
- 微信破解,解密?How To Decrypt WeChat EnMicroMsg.db Database?
20元现金领取地址:http://jdb.jiudingcapital.com/phone.html内部邀请码:C8E245J (不写邀请码,没有现金送) 国内私募机构九鼎控股打造,九鼎投资是在全国股 ...
- 【转】Android动态破解微信本地数据库(EnMicroMsg.db)
最近在公司接了一个任务,需要在几百台手机上安装一个app,目的是获取微信里面的通讯录,并且定时的把他发送到我们的服务器上.当时依次尝试的如下几个方案: 1.通过群控,将好友截图发送到服务端(pytho ...
- 大型博彩公司招聘 .net,DB,tester,android
大型博彩公司招聘 .net,DB,tester,android,ios等. 等拿完年终奖的朋友,可以先发简历给我,先面试,年后上班. emai:sjchen1203@126.com 要求: 1. 全职 ...
- Ubuntu下编译SqlCipher以及解密微信数据库EnMicroMsg.db过程和坑
wget https://codeload.github.com/sqlcipher/sqlcipher/zip/v3.4.2 ./configure --enable-tempstore=yes C ...
- 通过settings.db自定义Android系统默认设置
Android的系统设置数据存放在/data/data/com.android.providers.settings/databases/settings.db 中 数据库结构如下: 数据库中的默认数 ...
- 移动安全初探:窃取微信聊天记录、Hacking Android with Metasploit
在这篇文章中我们将讨论如何获取安卓.苹果设备中的微信聊天记录,并演示如何利用后门通过Metasploit对安卓设备进行控制.文章比较基础.可动手性强,有设备的童鞋不妨边阅读文章边操作,希望能激发大家对 ...
- A look at WeChat security
原文地址:http://blog.emaze.net/2013/09/a-look-at-wechat-security.html TL;DR: Any (unprivileged) applicat ...
- 凡聊过必留下痕迹-破解加密的WeChat数据库
有个朋友上门寻求协助,带着她朋友的朋友的手机,说是手机硬件有问题,想把手机内的资料都备份出来,尤其是WeChat的聊天内容…我跟她说,那iTool等工具不就可以帮上忙了吗?没想到她早就试过了, 说iT ...
- Dig out WeChat deleted chat messages on Android Phone
As we know that WeChat will wipe deleted chat messages. That's why forensic guys could not dig out ...
随机推荐
- Python中split()函数的用法及实际使用示例
Python中split()函数,通常用于将字符串切片并转换为列表. 一.函数说明: split():语法:str.split(str="",num=string.count(st ...
- 斑马打印机网卡ZebraNet配置(有线)
实图: 抽象图: 说明: 1.并口,用于连接斑马打印机一端 2.网络连接状态指示灯 3.打印状态指示灯 4.测试按钮,在连接打印机的情况下,按下此键,会打印出网卡信息. 5.网线接口 按下测试按钮之后 ...
- 区分listview的item和Button的点击事件
这两天修改领导通的ListView widget,在ListView中加入Button这类的有 “点击” 事件的widget,发现原来listview的itemclick居然失效了, 后来在网上查资料 ...
- WebView用法
在Android手机中内置了一款高性能webkit内核浏览器,在SDK中封装为一个叫做WebView组件. 什么是webkit WebKit是Mac OS X v10.3及以上版本所包含的软件框架(对 ...
- Maven pom.xml 配置详解
http://niuzhenxin.iteye.com/blog/2042102 http://blog.csdn.net/u012562943/article/details/51690744 po ...
- struts2的异常
index.jsp <%@ page language="java" import="java.util.*" contentType="tex ...
- 查看maven项目的依赖关系 mvn dependency:tree
maven-dependency-plugin最大的用途是帮助分析项目依赖,dependency:list能够列出项目最终解析到的依赖列表,dependency:tree能进一步的描绘项目依赖树,de ...
- Django 的 CSRF 保护机制
转自:http://www.cnblogs.com/lins05/archive/2012/12/02/2797996.html 用 django 有多久,我跟 csrf 这个概念打交道就有久了. 每 ...
- 加载网络映射盘中的assembly失败
我有一个网络映射盘,盘符是Z:.在Z盘下面,放了一个assembly,名为test.dll.然后,我在VS2010中建立了一个.NET 4.0的工程,程序中有下面一段代码: string dll = ...
- reverse list
public void reverse (){ Node end =null,p,q; p=head; //p代表当前节点,end代表翻转后p后面的,q代表翻转前p后面的 while(p!=null) ...