ppwwyyxx / wechat-dump

Cracking encrypted wechat message history from android
GNU General Public License v3.0
1.66k stars 307 forks source link

getting "Failed to pull database by adb" #16

Closed magichand closed 8 years ago

magichand commented 8 years ago

Dear Dev,

After struggling to setup all environment requirement, I finally managed to run this script but still stuck at the end of "./android-interactive.sh db-decrypt"

Please help to look at what else am I missing.

UBuntu 3.19.0-25-generic #26~14.04.1-Ubuntu SMP Fri Jul 24 21:16:20 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

ppwwyyxx commented 8 years ago

Well, the script cannot get the message database from your phone. You can check if the following files or directory exists, by running several adb command:

adb root  # start adb daemon as root
adb ls /data/data/com.tencent.mm/MicroMsg  # wechat data directory, this directory should contain one or more sub directories with a long random name
adb pull /data/data/com.tencent.mm/MicroMsg/long-long-name/EnMicroMsg.db  # copy the database file

You can manually check if the above files & directories exists, and see if you can successfully copy the database file. If not, probably in your phone files are not in usual location. Then I have no idea. You can look at those directories to figure out the correct location, or list some directory contents for others to take a look.

magichand commented 8 years ago

So i managed to pull my desired directory from the phone manually, but I am still stuck at decrypt.db

adb is running as root

able to list and pull directories from /data/data/com.tencent.mm/

darwis@SuperUBuntu:~/Downloads/wechat-dump-master$ ls -al f2ba62bb17665aa44591d034444c0c80/ total 6104 drwxrwxr-x 5 darwis darwis 4096 Nov 2 14:59 . drwxrwxr-x 11 darwis darwis 4096 Nov 2 15:05 .. -rw-r--r-- 1 darwis darwis 11127 Nov 2 14:59 bssidcache.bin drwxrwxr-x 2 darwis darwis 4096 Nov 2 14:59 cdn drwxrwxr-x 2 darwis darwis 4096 Nov 2 14:59 cdndnsinfo -rw-r--r-- 1 darwis darwis 50 Nov 2 14:59 checkmsgid.ini -rw-r--r-- 1 darwis darwis 12288 Nov 2 14:59 CommonOneMicroMsg.db -rw-r--r-- 1 darwis darwis 81 Nov 2 14:59 CommonOneMicroMsg.db.ini -rw-r--r-- 1 darwis darwis 1314 Nov 2 14:59 eggingfo.ini -rw-r--r-- 1 darwis darwis 12288 Nov 2 14:59 enFavorite.db -rw-r--r-- 1 darwis darwis 81 Nov 2 14:59 enFavorite.db.ini -rw-r--r-- 1 darwis darwis 4131840 Nov 2 14:59 EnMicroMsg.db -rw-r--r-- 1 darwis darwis 81 Nov 2 14:59 EnMicroMsg.db.ini -rw-r--r-- 1 darwis darwis 675840 Nov 2 14:59 IndexMicroMsg.db drwxrwxr-x 2 darwis darwis 4096 Nov 2 14:59 sfs -rw-r--r-- 1 darwis darwis 0 Nov 2 14:59 snsAsyncQueue.data -rw-r--r-- 1 darwis darwis 1355776 Nov 2 14:59 SnsMicroMsg.db -rw-r--r-- 1 darwis darwis 81 Nov 2 14:59 SnsMicroMsg.db.ini -rw-r--r-- 1 darwis darwis 9 Nov 2 14:59 version_history.cfg darwis@SuperUBuntu:~/Downloads/wechat-dump-master$ darwis@SuperUBuntu:~/Downloads/wechat-dump-master$ darwis@SuperUBuntu:~/Downloads/wechat-dump-master$ ./decrypt-db.sh /home/darwis/Downloads/wechat-dump-master/f2ba62bb17665aa44591d034444c0c80/EnMicroMsg.db 864587027433102 1999880747 decrypted.db already exists. removed? (y/n)y removed ‘decrypted.db’ KEY: 966b7db Use 64bit sqlcipher of linux. Dump decrypted database... (Don't worry about libcrypt.so version warning.) Error: near line 3: file is encrypted or is not a database Error: near line 4: file is encrypted or is not a database Error: near line 5: no such database: db darwis@SuperUBuntu:~/Downloads/wechat-dump-master$

Am i missing any step?

ppwwyyxx commented 8 years ago

The error is indicating a broken database or wrong password to decrypt the database. This is either due to a wrong IMEI, wrong UIN, or that things may be different on different phones/OS. I also received similar complaints here: #12, and he managed to solve it by migrating to another phone. There are different ways of getting IMEI from a phone listed in README.md. I'm not sure if they are equivalent but you can have a try.

wang0109 commented 8 years ago

I used my own sqlcipher (3.8.8.3) on Mac and have to add PRAGMA cipher_page_size = 1024 and PRAGMA kdf_iter = 4000 to make it decrypt. Maybe you could try that by modifying the decrypt-db.sh. Ref this article

ppwwyyxx commented 8 years ago

@wang0109 Thanks for your note! Did you test my version of sqlcipher and did it work? I want to make sure is it a different method of encryption, or just two version doing the same thing.

Also, from that article, it looks like UIN could be a negative number, which I didn't know about. This can also cause error in decryption.

wang0109 commented 8 years ago

@ppwwyyxx I did try the included sqlcipher first, unfortunately I got:

KEY: fe05521
Use 64bit sqlcipher of darwin.
Dump decrypted database... (Don't worry about libcrypt.so version warning.)
SQLite header and source version mismatch
2014-08-15 22:37:57 c8ade949d4a2eb3bba4702a4a0e17b405e9b6ace
2012-10-04 19:37:12 091570e46d04e84b67228e0bdbcd6e1fb60c6bdb

I didn't figure out how to fix that mismatch error, so in the end I figured I just use my own sqlcipher instead. Thanks for the great tool btw!

ppwwyyxx commented 8 years ago

Thanks! I tested the method in that article, and it also works for my database. Looks like it might be a better approach since it works for both of us. I updated the code for this.

magichand commented 8 years ago

@ppwwyyxx So by updating this decrypt_db should be able to eliminate my db issue?

ppwwyyxx commented 8 years ago

@magichand I don't know what's the exact problem in your case, but you can give it a try. Start from the very beginning because I also changed the code for getting UIN. I didn't know it could be negative before.

ppwwyyxx commented 8 years ago

Also, could you add your device and OS information at wiki so people may have an idea of the exact reason in the future? @magichand @wang0109 Thanks a lot!

magichand commented 8 years ago

I'm using OnePlus One, loaded with CM12.1 (Temasek flavor).