search

andreas-mausch / whatsapp-viewer

Small tool to display chats from the Android msgstore.db database (crypt12)
https://andreas-mausch.de/whatsapp-viewer/
MIT License
1.28k stars 385 forks source link

Crypt14 #114

Closed nirhen closed 3 years ago

nirhen commented 3 years ago

Hi - I installed new whatsapp today 4.2 . Chats backup are saved as crypt14. whatsapp-viewer support only crypt12 .The key i got seems to be invalid. i'm sure its valid and they change the way they encrypt DBs.

andreas-mausch commented 3 years ago

Thank you. Yes, you are right. crypt14 is currently not supported. I need to test it myself and hope it is a minor change.

torsade commented 3 years ago

It is a minor change, it still uses AES-256 in counter mode with a 16-byte IV. The offsets are: WHATSAPP_DBFILE_SERVERSALT_OFFSET = 14 WHATSAPP_DBFILE_IV_OFFSET = 66 WHATSAPP_DBFILE_CT_OFFSET = 99 WHATSAPP_DBFILE_FOOTER_SIZE = 0

torsade commented 3 years ago

I have included the necessary changes into a pull request: https://github.com/andreas-mausch/whatsapp-viewer/pull/115

nirhen commented 3 years ago

awesome you guys - thanks for the quick response

andreas-mausch commented 3 years ago

Thank you @torsade

cript0nauta commented 3 years ago

Hi! Do you think it will be possible to migrate a .crypt12 file to a .crypt14 in order to migrate old data to another phone? Based on the crypt14 changes, I think it would just be a matter of changing the header and footer of the file, but I'm not sure about that.

Note: I also have the contents of the old phone's /data/data/com.whatsapp/ including the unencrypted message database, but I don't know how to import it into a new, non-rooted phone.

ElDavoo commented 3 years ago

Did your offset change again in this night's backup? I noticed IV now starts at byte 67, but don't know about the rest. edit: offsets updated here

cript0nauta commented 3 years ago

Hi! Do you think it will be possible to migrate a .crypt12 file to a .crypt14 in order to migrate old data to another phone? Based on the crypt14 changes, I think it would just be a matter of changing the header and footer of the file, but I'm not sure about that.

I tried to solve this by installing the newest Whatsapp version in the older phone so it creates a .crypt14 backup. Even after that, importing the data into the new phone failed with an unknown error. I ended up copying the entire unencrypted /data/data/com.whatsapp/ contents into the new phone and that worked ok.

Did your offset change again in this night's backup? I noticed IV now starts at byte 67, but don't know about the rest.

I'm surprised abouth how WA doesn't care about backwards compatibility at all and requires rooting my phone just to migrate the messages. So thanks a lot for maintaining an open-source workaround on that, it must be a very difficult task!