Export database

[Blacklands]

Is there an option to export the decrypted database itself, too? I couldn't find any, so I think there currently isn't?

If not, could that be added?

[carderne]

The --manual option does this but:

• It deletes the decrypted file afterwards
• It will only work inside the Docker container (on a machine with the sqlcipher dependencies installed) and currently the argument isn’t passed on to Docker, nor any mechanism made to retrieve the file.

To make this work, you’d need to:

• in data.py make it not delete the file
• in main.py when it calls out to Docker, make it pass the --manual CLI argument and mount a volume somewhere so you can retrieve the file
• Rebuild the Docker image

If you’re keen to try all that I can provide some better instructions.

[Blacklands]

Thanks for writing this down!

I don't really know anything about Docker. I wouldn't know how to mount a volume or rebuild a Docker image. Could this be all done from the Python code, without significant changes? Or would it need manual steps by the user?

[carderne]

The docker image would need to be rebuilt, because you'd need to change the code that runs inside the container to not delete the decrypted db.

But you can try the following instead, which should give you a bash prompt inside a running docker container. (Note that you might need to correct the %HOMEPATH stuff. Basically you want this to point to your-home-dir\AppData\Roaming\Signal.

docker run --rm -it --entrypoint='' \
  --volume=%HOMEPATH%\AppData\Roaming\Signal:/Signal \
  carderne/sigexport:latest bash

Then run the following (inside the container) to check that the volume mounted correctly:

ls /Signal/sql
# should print: db.sqlite

Then run the following:

tail  /usr/local/lib/python3.10/site-packages/sigexport/data.py

That should print the bottom few lines of the data.py file, among which you should see:

    if db_file_decrypted.exists():
        db_file_decrypted.unlink()

Then run the following to remove the unlink bit:

sed -i 's/db_file_decrypted.unlink()/pass/g' /usr/local/lib/python3.10/site-packages/sigexport/data.py

Now if you run tail again, you should see it just says pass after the if.

Now you can try run sigexport:

sigexport --source=/Signal --manual /tmp/foo

Now if you run ls /Signal/sql again, you should see an additional db-decrypt.sqlite, and you can check from your host machine that it should also be present in home-dir\AppData\Roaming\Signal\sql. If so you can exit the docker shell. There might be some permission/file ownership issues but I'll leave you to figure that out...