Iam doing WhatsApp DB Extraction task for an experiment based demo application for my team. I have searched on this forum and have found a helpful link Here. It logs as success but the result file is not accessible by Sqlite browser Below is Some code I used
My WhatsApp backup file msgstore-**. size can reach up to 380MB+ for a single file. Because WhatsApp automatically backup chats every day and will keep the 7 most recent backups, my phone will store up to 2GB worth of these files. In case anyone's wondering, my phone is not rooted, but I have the WhatsApp key and files, so I can decrypt and re-encrypt the file. What I have tried is to manually delete some messages in the messages table in the file, it sure reduces the file size, but then it fails when I try to restore WhatsApp chats using that file. Also, I have tried to clear chats in some groups that have a lot of messages using the Clear chat feature, this deletes the messages in the messages table, but doesn't reduce the file size, I guess the deleted messages are moved to another table which I don't know where. I don't need a trick to stop WhatsApp auto backup, I just want to reduce the file size, is it possible?
Ihave recently installed WhatsApp on my pc and synchronised it with my mobile phone. However, I would like to access the database from my old phone, so I can read back some of my old conversations. I have already copied the file to my pc. It is called "msgstore.db.crypt12" and was last edited in november 2017. How can I read it? WhatsApp backup conversation files are now saved with the .crypt12 extension. From crypt9, they seem to be using a modified version of Spongy Castle – a cryptography API library for the findings below are based on reverse engineering work done on WhatCrypt and Omni-Crypt. I would like to highlight that IGLogger proved to be a very useful tool when it came to smali code debugging. Extract Key File To decrypt the crypt12 files, you will first need the key file. The key file stores the encryption key, K. WhatsApp stores the key file in a secure location /data/data/ If your phone is rooted, extracting this file is easy. I will not go through the steps again, as it’s already mentioned in the crypt8 decryption article. If your phone is not rooted, refer to instructions from WhatCrypt and Omni-Crypt for details on extracting the key file. The idea is to install an older version of WhatsApp, where Android ADB backup was still working and extract the key file from the backup. Extract crypt12 Backup File Pull the encrypted WhatsApp messages file from your phone using ADB. $ adb pull /sdcard/WhatsApp/Databases/ Decryption Keys This section is just for your information and you can skip this section. The encryption method being used is AES with a key K length of 256 bits and an initialisation vector IV size of 128 bits. The 256-bit AES key is saved from offset 0x7E till 0x9D in the file. Offsets start from 0x00. You can extract the AES key with hexdump and assign the value to variable $k. $ k=$hexdump -ve '2/1 "%02x"' key cut -b 253-316 The $k variable will hold a 64-digit hexadecimal value in ASCII that is actually 256 bits in length. The IV or the initialisation vector is saved from offset 0x33 till 0x42 in the crypt12 file. The IV value will be different for every crypt12 file. $ iv=$hexdump -n 67 -ve '2/1 "%02x"' cut -b 103-134 The K and IV extraction method is similar to what we have done for crypt8 files before. Strip Header / Footer in crypt12 File Again, this section is just for your information and you can skip this section. Before we start the decryption process, we will need to strip the 67 byte header and 20 byte footer from the crypt12 file. $ dd if= of= ibs=67 skip=1$ truncate -s -20 The above dd command will strip the the first 67 bytes from the crypt12 file and save it to a file with extension The truncate command will strip the last 20 bytes from the crypt12 file. As the WhatsApp AES cryptography API library seems to be a modified version, we will no longer be able to use openssl to decrypt the crypt12 file. I have yet to determine what has been modified. To decrypt crypt12 files, I have written a simple Java program that will use the modified cryptography API library instead. For the cryptography API library, I have extracted the modified Spongy Castle cryptography class files from the Omni-Crypt APK file using dex2jar. You can find the Java program and crypto library over here at GitLab. The Java program will create 3 output files – encrypted file with header and footer stripped. – decrypted file in zlib format. – decrypted sqlite3 database file. Below is how you can compile and run the Java program. 12345678910111213141516171819202122232425262728293031323334353637383940 $ git clone cd whatsapp-crypt12/$ javac -classpath "lib/ cp ../ .$ cp ../ .$ java -cp "lib/ crypt12KXXXXXXXXXXIVYYYYcreating encrypted file with header/footer stripped zlib output file sqlite3 output file ls -ltotal 136724-rw-r-r- 1 ibrahim staff 4339 Oct 9 1605 1 ibrahim staff 5459 Oct 9 1605 1 ibrahim staff 158 Oct 9 1605 keydrwxr-xr-x 2 ibrahim staff 4096 Oct 9 1605 lib-rw-r-r- 1 ibrahim staff 1089 Oct 9 1605 LICENSE-rw-r-r- 1 ibrahim staff 62692352 Oct 9 1606 1 ibrahim staff 25757610 Oct 9 1605 1 ibrahim staff 25757523 Oct 9 1605 1 ibrahim staff 25757507 Oct 9 1606 1 ibrahim staff 1376 Oct 9 1605 file * compiled Java class data, version Java C source, ASCII textkey Java serialization data, version 5lib SQLite database, user version raw G3 data, zlib compressed data Final Words To use the Java decryption tool, you will need to use OpenJDK. Oracle require JCE Provider libraries to be signed. OpenJDK does not have this requirement. If you try running the Java program on Oracle JDK, you will most likely get the following exception. Exception in thread "main" JCE cannot authenticate the provider SC There are some workarounds to bypass the error, but it has not worked for me so far. Decryption failed when using the modified cryptography API library from WhatsApp and WhatCrypt. Only Omni-Crypt library is working. I have yet to determine the reason for this. If you have any further information on this, leave a = { interested_inunix, linux, android, open_source, reverse_engineering; codingc, shell, php, python, java, javascript, nodejs, react; plays_onxbox, ps4; linux_desktop_usertrue; }Msgstoredb.crypt12 adalah sebuah file yang menjadi database penyimpanan semua aktivitas Whatsapp, mulai dari riwayat chat, foto, video, voice note, dan dokumen penting yang pernah kita gunakan saat saling berkirim file.. Bagi yang ingin mengembalikan chat Whatsapp, kamu juga bisa pakai file msgstore.db.crypt12 ini.Untuk panduannya sendiri sudah kami bahas di artikel sebelumnya oleh penulisTheres no point in deleting any of those chat backups. Your most current backup will be stored as msgstore.db.crypt8. After tonight they will rename it msgstore-(T+1).db.crypt8. T will be date of original backup. Databases longer than a week will only be deleted. PrgQ.