1

I was trying to extract data from an Android app which uses SQLcipher. SQLcipher is an extension of SQLite that encrypts database files with 256-bit AES.

Within the APK, the library lies in lib/libsqlcipher.so. I'm curious if I can extract the encryption key simply by modifying libsqlcipher.so(e.g. modify sqlite3_key function so that it logs the encryption key to file). The plan is to compile my own version of libsqlcipher.so, repack APK, install it, and run it on a device.

Will this method work as expected? It sounds too easy to be true:)

Improve this question
1
  • It will work, you don't need modifing the library, you can use some sort of dynamic instrumentation like Frida. – morsisko Sep 27 '20 at 11:23
-1

Ok, it worked. Used Frida to hook sqlite3_key and got the encryption key.

Improve this answer
4
  • 3
    Hi and welcome to RE.SE. Could you please provide some detail on how you did that. I'm sure it would be appreciated by future visitors. – 0xC0000022L♦ Sep 28 '20 at 9:49
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review – perror Sep 28 '20 at 15:31
  • @perror the inquirer and the author are the same. So we can probably reason that the author of both assumed that the question is answered this way, but it doesn't really provide any value to future visitors as it stands, that I agree with. – 0xC0000022L♦ Sep 28 '20 at 19:42
  • 1
    @yizhe Can you please edit your answer and include the relevant code you used in Frida for hooking the sqlite3_key method? – Robert Oct 28 '20 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.