EndFrame was not read: backup is probably incomplete

[hugodu69]

hello @bepaald , i was having issue with my signal backup, and i saw your posts on signal's github, and came here to try your tool, but I cannot succeed :/

I wonder if you could help me ?

• I don't have the original signal app to try and make more backups see if they have the same issue
• the issue in signal is that signal crashes after I enter my passphrase
• and the issue in your program is the warning message of this issue title
• but I still have my last 12 backups from the last ten days, and they all generate the same error in your program
• backups size are between 350 Mb and 370 Mb

the complete prompt and log of your program :

➜  signalbackup-tools/a.out signal_backups/signal-2023-08-31-10-03-03.backup xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx --output decrypted_dump --overwrite

signalbackup-tools (signalbackup-tools/a.out) source version 20230830.163759 (Op
enSSL)
IV: (hex:) 2f 13 f6 65 0f 5a ff 3a f5 da e0 27 b0 d5 e0 b5 (size: 16)
SALT: (hex:) 63 15 df 1a ab f4 97 ba 9a 46 f0 df f0 c5 d8 1e 83 74 e2 48 d9 77 4
9 62 dc 12 d2 bf 5e c4 9d a3 (size: 32)
BACKUPKEY: (hex:) f7 37 fd 37 95 3e 51 a7 33 be e7 82 34 1f a2 b8 3c f2 c1 4e a3
 1e eb e3 4f 4d 1d 70 ba f6 01 8a (size: 32)
CIPHERKEY: (hex:) b2 85 be 45 44 6c 49 f8 20 f2 97 a2 21 63 57 db 2e 17 19 d9 81
 48 96 81 50 b4 fe 13 8a b4 26 e6 (size: 32)
MACKEY: (hex:) ac a7 d2 85 37 1e ee 89 7a aa 11 16 bb 61 fa 06 a1 42 8d ef b7 73
 c8 25 c3 5a 82 7e 4b a2 6c e5 (size: 32)
BACKUPFILE VERSION: 1
COUNTER: 789837413
Reading backup file...
FRAME 0 (000.0%)... Failed to read next frame (1208086385 bytes at filepos 60)

done!
WARNING EndFrame was not read: backup is probably incomplete
Database version: 4294967295

Exporting backup into 'decrypted_dump/'
Clearing contents of directory 'decrypted_dump'...
Writing HeaderFrame...
Writing DatabaseVersionFrame...
Error: asked to write nullptr frame to disk
Failed to export backup to 'decrypted_dump'

I don't really need to have those messages inside signal, any extract is good, and i will figure out how to store them encrypted elsewhere as a searchable archive, maybe import them inside matrix somehow ? but I really hope that I can recover them, and I will definitely never trust signal backups again, they sucks a lot on this one :( I thought that always keeping ten days of backup was enough, I'm now consulting forums on how to backup anything and i see my very basic mistake : always verify the validity of a backup, otherwise it can be worth nothing :/

anyway, whether you can help me or not, thx a lot for your help on the forums and with this program, that's awesome !

[bepaald]

Hi, I'm so sorry for the bad news, but I'm afraid from what I can tell, as things are, there is little chance of recovering anything from the backup.

BUT I must say, in this case I think (almost 100% sure actually) the reason this is failing is that you are using the wrong passphrase. I realize the error messages aren't very clear (for a variety of reasons, but mostly because of the fairly new backup file format BACKUPFILE VERSION: 1), I will try to improve them.

What happens in the case of a bad passphrase is the very first encrypted byte, which encodes the size of the next (first encrypted) frame fails to decode properly, gives a nonsense value (in your case an impossibly large 1.1gb) and reading fails. (in the old backup file format the frame sizes were not encrypted, which both enabled me to more easily warn about incorrect passphrases and gave this program options for recovery)

Unfortunately, if you don't have the correct passphrase anywhere, this knowledge will not help you. And I assume – since you checked 12 backups – it is not a simple typo. If you have any other passphrases, old ones you think are no longer correct, I suggest you try them because apart from that all that's left is brute forcing.

Let me know of there is anything more I can do.

[hugodu69]

that's awesome news ! thx ! fortunately, i know how dumb i am sometimes, so i have kept all the supposedly old passphrases, of course one of them was actually the new one, i mixed them up by mistake :p That wasn't Signal's fault after all ;)

You helped me a lot, thank you very much !

[bepaald]

that's awesome news ! thx ! fortunately, i know how dumb i am sometimes, so i have kept all the supposedly old passphrases, of course one of them was actually the new one, i mixed them up by mistake :p That wasn't Signal's fault after all ;)

Don't worry, you were by far not the first, and you won't be the last 😀

You helped me a lot, thank you very much !

Happy to help, and very glad you didn't loose any messages.