0

TL;DR: What file format is this (if it's not a private file format) and how do I parse it?


Before I say anything I want to say that I am new to reverse engineering and StackExchange.

I am trying to reverse-engineer the Yandex iOS app's call blocking function. I know how the iOS call blocking API works and I know that, in summary, the app gives the system a list of numbers and the action to do with them — there is no code ran by the app when a call comes in and it never even gets to see incoming phone numbers. My end goal is to then write a privacy-conscious version of this for my Android phone (yes there is an Android version of the app, but it requires you to set it as the device's assistant, allowing it to see the phone's screen, notifications, calls, etc.)

I have put the app in a MITM proxy and found this URL it was downloading the phone database from: https://storage.mds.yandex.net/get-cid-offline/1995371/cid.full.large.ru.1.1633994274.pb.gz After extracting, I get a .pb file. If I look at it in a text editor, I can see the messages for the phone numbers, like scam likely, delivery driver, company names, etc. But the actual phone numbers are encoded in a binary format.

It's not sqlite and it's not encrypted, 010 Editor incorrectly recognizes this as a "TensorFlow Model" format and shows nothing. file command just says "data" (I assume unknown file format). I'm thinking it's a custom file format but I am not sure. Can someone please explain to me how to parse this file or even how to convert this file format into something like JSON or XML? Thank you in advance

1
  • If pb stands for phone book, is it possible that the iphone has an encoded structure for storing phone numbers it is using? can you pass the values into that? Sorry, not so strong on iphone api.
    – ricka777
    Oct 12 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.