Decrypting SQLite Database with key

Question

I have a SQLite database that contains a dictionary (just words and definitions) that can be opened with free but proprietary software. To use with the software, it requires an 'unlock' key, which I have. I'm able to see it in this program, but I'd like to manipulate the data and re-arrange it. Currently, I'm paying freelancers on Fiverr to copy/paste every entry to a text document. Old-School Scraping.

I can open these documents in a SQL viewer like DBBrowser for SQLite. The entry listings are in plaintext, but the definitions are in BLOBs. I've tried hex(), which didn't work. I thought there was somewhere I could paste my key in to decrypt this, but I can't find that. What should I do here?

• I have the database
• I have the key required for unlocking it within the software that reads it
• I have the software that reads it

This is my first venture into reverse engineering, so I appreciate your help and patience.

Answer 1

There exists an official encryption addon for SQLite but from your description it sounds more like the data is simply stored encrypted in the blobs and the application decrypts it internally before displaying its content, however:

• we don’t know the exact encryption algorithm
• we don’t know how the password you enter is converted into the decryption key
• we don’t know how the decrypted data is converted to what you see on the screen

To solve your problem you need to find the answers to these questions (and possibly others I did not think of). You can try doing it by guessing and trying different algorithms but I doubt you’ll get lucky with just that.

If I had to do it, I would probably proceed like this:

1. Disassemble or debug the binary and identify the SQLite API functions, possibly by looking at references to the database/ tables/column names and/or comparing the compiled code against the SQLite source.
2. check what is done with the data retrieved from the DB and see if any functions handling it look like decryption functions (e.g. use standard crypto constants or have a particular loop structure).
3. see where the decryption key comes from and try to figure out how it’s derived from the password (optional, since we can just use the final key from the debugger)
4. if the structure of the decrypted data is non-obvious, check how it’s parsed and outputted.

P.S. for a more low-tech solution you could try some UI automation solutions (e.g. possibly AutoIt) but this is out of scope on this site.