CN107563215A - A kind of Android system wechat chat record decryption method - Google Patents

Abstract

The invention discloses a kind of Android system wechat chat record decryption method, its step is：S1：" com.tencent.mm " catalogue is found in mobile phone；S2：Travel through WeChat accounts directory number；S3：Look for path for " cdn cdninfo.txt " file, or the file looked in " cdndnsinfo " catalogue；S4：UIN is found according to S4 file；S5：Obtain the IMEI that wechat uses mobile phone；S6：The clear crytpographic key of 7 characters is calculated by the UIN characters and IMEI characters that get.Beneficial effects of the present invention are as follows：Wechat database decruption key is fast and accurately found, Android wechat chat record is decrypted, can completely recover encryption data, helps the police to solve a case, reduces victim's loss.

Description

A kind of Android system wechat chat record decryption method

Technical field

The present invention relates to field of information security technology, more particularly to a kind of Android system wechat chat record decryption method.

Background technology

Information data epoch communication APP is conventional social tool, and these social tools store in long-term use Substantial amounts of user profile, is the data of the emphasis extraction of data evidence obtaining；But due to the consideration of its personal secrets, usual social work The data of tool have all carried out encryption storage, and this causes no small trouble to loss of data evidence obtaining.Wherein in substantial amounts of social work In tool, wechat customer volume is preeminent, and Android wechat chat record database is deposited for encryption.And can there is presently no a kind of technology So that wechat encryption data to be decrypted.

The content of the invention

The defects of present invention is directed to prior art, there is provided a kind of Android system wechat chat record decryption method, can have Solution the above-mentioned problems of the prior art of effect.

A kind of Android system wechat chat record decryption method, comprises the following steps：

S1：Judge to whether there is " com.tencent.mm " mesh in " data " catalogue of Android mobile phone user data subregion Record, if there may be wechat chat record data in the Android mobile phone if expression being present, perform S2；Otherwise in the Android mobile phone not Wechat chat record data be present, terminate；

S2：" MicroMsg " catalogue in recursive scanning " com.tencent.mm " catalogue, find the entitled MD5 values of catalogue, Length is the catalogue of 32 character strings, and the number by counting above-mentioned catalogue can obtain what the historical log in Android mobile phone was crossed WeChat accounts number, also need to find " EnMicroMsg.db " file；

S3：Look for path for " cdn cdninfo.txt " file, or the file looked in " cdndnsinfo " catalogue；

S4：The UIN of file in " cdninfo.txt " file or " cdndnsinfo " catalogue, UIN is looked for be recorded in keyword After " 0x010102010102 ", the key bytes latter one byte is byte length shared by UIN, by specifying after length byte Length byte is converted into after the binary data character string of symbol 10 being the UIN for decryption；

S5：The IMEI that wechat uses mobile phone is obtained, detailed step is as follows：

S51：Judge whether there is the file of one entitled " CompatibleInfo.cfg " in " MicroMsg " catalogue, if should File, which exists, to be continued to parse this document, performs S52；Terminate if this document is not present；

S52：" CompatibleInfo.cfg " file is that a Java serializes file, the side serialized by anti-Java Formula finds the field data where IMEI, can also be found by way of search key section " 0x000001027400 ", the pass Key byte latter one byte is byte length shared by IMEI, the designated length byte after length byte, is exactly IMEI data Body.

S6：The clear crytpographic key of 7 characters, its detailed step are calculated by the UIN characters and IMEI characters that get It is as follows：

S61：By the IMEI character strings got, UIN character strings are arrived plus acquisition, this group of character string is passed through into MD5 Small letter md5 values are calculated in algorithm, take preceding 7 characters as clear crytpographic key；

S62：7 clear crytpographic keys obtained are used as initial key, 16 bytes works before EnMicroMsg.db database files For initial vector, OpenSSL officials libeay32 built-in functions (PKCS5_PBKDF2_HMAC_SHA1 (), key iteration time are called Number is 4000 times, and what can be derived from arrives decruption key；The key calculated is passed to OpenSSL officials libeay32 built-in functions AES_set_decrypt_key () obtains AES256 decruption keys；

The page size of " EnMicroMsg.db " file encryption database is 1024 bytes, and every page of last 16 bytes are Descrambled vector, decryption unit is for the first time 1024-32 bytes, is later each 1024-16 bytes, recursive call OpenSSL official Square libeay32 built-in functions AES_cbc_encrypt () can complete to decrypt；

S63：By original 16 bytes of wechat database file head after decryption " 0x53514C69746520666F726D6174203300 " reduction covering, can normally check wechat database file.

Compared with prior art the advantage of the invention is that：Wechat database decruption key is fast and accurately found, to peace Zhuo Weixin chat records are decrypted, and can completely recover encryption data, help the police to solve a case, and reduce victim's loss.

Embodiment

For the objects, technical solutions and advantages of the present invention are more clearly understood, by the following examples, the present invention is done into One step describes in detail.

A kind of Android system wechat chat record decryption method, comprises the following steps：

S1：Android wechat APP chat record databases be stored in Android mobile phone user data subregion " data Com.tencent.mm " in path.If exist in " data " catalogue of Android mobile phone user data subregion " com.tencent.mm " catalogue, then illustrate to there may be wechat chat record data in the Android mobile phone, otherwise the Android hand Wechat chat record data are not present in machine.

S2：" MicroMsg " catalogue in recursive scanning " com.tencent.mm " catalogue, find the entitled MD5 values of catalogue, Length is the catalogue of 32 character strings, different WeChat accounts data is saved in each catalogue, wherein " EnMicroMsg.db " File is wechat chat record SQLite database files, can be obtained by the number for counting above-mentioned catalogue in Android mobile phone The WeChat accounts number that historical log is crossed.

S3：Look for path for " cdn cdninfo.txt " file, record has WeChat accounts in cdninfo.txt files UIN, or judge that the file in " cdndnsinfo " catalogue may be remembered with the presence or absence of there is file in " cdndnsinfo " catalogue Record has the UIN of WeChat accounts.The effective document path found under storage.

S4：After UIN in " cdninfo.txt " file is recorded in keyword " 0x010102010102 ", the key bytes Latter one byte is byte length shared by UIN, and normal length byte is 0x04 or 0x03 etc., by the specified length after length byte Spend byte, i.e. 4 or 3 byte conversions into have after the binary data character string of symbol 10 be for decryption UIN (such as： 0x3E6B2EA0 change after into 1047211680).The UIN of file, key bytes and recording mode in " cdndnsinfo " catalogue It is identical with " cdninfo.txt " file.Only need to obtain UIN in a file corresponding to more than in each WeChat accounts catalogue Can the UIN of each WeChat accounts (different).

S5：Obtain the IMEI that wechat uses mobile phone

(1) there is the file of one entitled " CompatibleInfo.cfg " in " MicroMsg " catalogue, if this document is present Continue to parse this document, return and terminate if this document is not present.

(2) " CompatibleInfo.cfg " file is a Java serializing file, can be serialized by anti-Java Mode find field data where IMEI, can also be found by way of search key section " 0x000001027400 ", The key bytes latter one byte is byte length shared by IMEI, and normal length byte is 0x0F or 0x0E etc., length byte Designated length byte afterwards, i.e., the data of 15 or 14 bytes are exactly IMEI data volume.

S6：The clear crytpographic key of 7 characters is calculated by the UIN characters and IMEI characters that get；

(1) by the IMEI character strings got, UIN character strings is arrived plus acquisition, this group of character string is calculated by MD5 Small letter md5 values are calculated in method, take preceding 7 characters (letter is small letter) to be used as clear crytpographic key.

(2) by 7 previously obtained passwords as initial key, 16 bytes before EnMicroMsg.db database files As initial vector, OpenSSL officials libeay32 built-in functions (PKCS5_PBKDF2_HMAC_SHA1 (), key iteration are called Number is 4000 times, and what can be derived from arrives decruption key.The key calculated is passed to OpenSSL officials libeay32 built-in functions AES_set_decrypt_key () obtains AES256 decruption keys.

The page size of " EnMicroMsg.db " file encryption database is 1024 bytes, and every page of last 16 bytes are Descrambled vector, decryption unit is for the first time 1024-32 bytes, is later each 1024-16 bytes, and recursive call calls OpenSSL officials libeay32 built-in function AES_cbc_encrypt () can complete to decrypt.

(3) because 16 bytes house decryption initial vector before the wechat database file of encryption, cause original SQLite file headers are capped；Therefore by original 16 bytes of its file header " 0x53514C69746520666F726D6174203300 " reduction covering, can normally check wechat database file.

One of ordinary skill in the art will be appreciated that embodiment described here is to aid in reader and understands this hair Bright implementation, it should be understood that protection scope of the present invention is not limited to such especially statement and embodiment.Ability The those of ordinary skill in domain can be made according to these technical inspirations disclosed by the invention it is various do not depart from essence of the invention its Its various specific deformations and combination, these deformations and combination are still within the scope of the present invention.

Claims (1)

1. a kind of Android system wechat chat record decryption method, it is characterised in that comprise the following steps：

S1：Judge to whether there is " com.tencent.mm " catalogue in " data " catalogue of Android mobile phone user data subregion, if In the presence of there may be wechat chat record data in the expression then Android mobile phone, S2 is performed；Otherwise it is not present in the Android mobile phone Wechat chat record data, terminate；

S2：" MicroMsg " catalogue in recursive scanning " com.tencent.mm " catalogue, find the entitled MD5 values of catalogue, length For the catalogue of 32 character strings, the wechat that historical log is crossed in Android mobile phone can be obtained by the number for counting above-mentioned catalogue Account number number, also need to find " EnMicroMsg.db " file；

S3：Look for path for " cdn cdninfo.txt " file, or the file looked in " cdndnsinfo " catalogue；

S4：The UIN of file in " cdninfo.txt " file or " cdndnsinfo " catalogue, UIN is looked for be recorded in keyword After " 0x010102010102 ", the key bytes latter one byte is byte length shared by UIN, by specifying after length byte Length byte is converted into after the binary data character string of symbol 10 being the UIN for decryption；

S5：The IMEI that wechat uses mobile phone is obtained, detailed step is as follows：

S51：Judge whether there is the file of one entitled " CompatibleInfo.cfg " in " MicroMsg " catalogue, if this document In the presence of parsing this document is continued, S52 is performed；Terminate if this document is not present；

S52：" CompatibleInfo.cfg " file is a Java serializing file, is looked for by way of anti-Java is serialized To the field data where IMEI, can also be found by way of search key section " 0x000001027400 ", the keyword Section latter one byte is byte length shared by IMEI, the designated length byte after length byte, is exactly IMEI data volume；

S6：The clear crytpographic key of 7 characters is calculated by the UIN characters and IMEI characters that get, its detailed step is as follows：

S61：By the IMEI character strings got, UIN character strings are arrived plus acquisition, this group of character string is passed through into MD5 algorithms Small letter md5 values are calculated, take preceding 7 characters as clear crytpographic key；

S62：7 clear crytpographic keys obtained are used as initial key, at the beginning of 16 bytes are used as before EnMicroMsg.db database files Begin vector, and calling OpenSSL officials libeay32 built-in functions, (PKCS5_PBKDF2_HMAC_SHA1 (), key iterations are 4000 times, what can be derived from arrives decruption key；The key calculated is passed to OpenSSL officials libeay32 built-in functions AES_ Set_decrypt_key () obtains AES256 decruption keys；

The page size of " EnMicroMsg.db " file encryption database is 1024 bytes, and every page of last 16 bytes are decryption Vector, decryption unit is for the first time 1024-32 bytes, is later each 1024-16 bytes, recursive call OpenSSL officials Libeay32 built-in function AES_cbc_encrypt () can complete to decrypt；

S63：By original 16 bytes of wechat database file head after decryption " 0x53514C69746520666F726D6174203300 " reduction covering, can normally check wechat database file.