I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example:

Blob extracted from Google Maps Android database

I'm saying serialised, as from the header 0xACED it appears to be a Java serialised object. However, as I have no idea what the serialised class actually looks like, I've been unable to deserialise it.

I'm also not entirely sure it's standard Java serialisation, as I've tried a number of different tools, and Java itself, and all of them report that the stream is corrupt.

You can see some references to standard Java classes, such as java/util/Set, but also a lot of smaller references to things like 'fic', or 'vot'. I'm guessing these are either obfuscated class names, or they are part of some kind of lookup/offset table.

My other guess is that as it's a Google product, it's probably using a Google serialisation library, like GSON or protobuf, but the data doesn't look like either of those.

Anyone come across this before, or can shine some light on it?

  • Have you tried decompiling the app and finding the code which reads this db?
    – Igor Skochinsky
    Oct 23 '19 at 21:40
  • I haven't no. I was hoping to avoid doing that, but it's certainly an option.
    – Tony
    Oct 23 '19 at 21:48
  • @IgorSkochinsky Are we allowed to reverse eng. Google Maps? If yes I'm on!
    – Biswapriyo
    Oct 24 '19 at 9:54
  • @Biswapriyo check your local laws but AFAIK in most jurisdictions reverse engineering is allowed for interoperability purposes etc.
    – Igor Skochinsky
    Oct 24 '19 at 10:00
  • @Tony Where and how did you get the database file?
    – Biswapriyo
    Oct 24 '19 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.