WO2022028255A1 - Data extraction method and system for mobile phone enterprise wechat, and storage medium - Google Patents

Abstract

Disclosed in the present invention are a data extraction method and system for mobile phone enterprise WeChat, and a storage medium. The method comprises: parsing a storage file of enterprise WeChat data in a mobile phone, and analyzing the storage positions of various types of enterprise WeChat data; and decoding file information in an enterprise WeChat data storage path by using a key generation algorithm, and extracting all data information of the enterprise WeChat. According to the solution provided by the present invention, by investigating an enterprise WeChat storage file, parsing enterprise WeChat storage file information, decoding the enterprise WeChat storage file information by using the key generation algorithm, and extracting data information, it is ensured that data is comprehensively extracted. According to the solution provided by the present invention, each storage file of the enterprise WeChat is decoded, an enterprise WeChat data extraction process is developed, and the enterprise WeChat data parsing efficiency is improved, and thus, the data extraction efficiency is improved.

Description

A data extraction method, system and storage medium for mobile phone enterprise WeChat technical field

The invention relates to a data extraction technology, and specifically designs a mobile terminal data extraction technology.

Background technique

At present, the number of mobile phone users in China has reached 800 million, and more and more office methods have shifted from relying on computers to mobile phones. At present, there are many types of social software for office work on the market, and the amount of data on mobile office software is increasing. Mobile office software records the user's personal information, work information and location information. At present, the extraction of mobile phone data is not simply the extraction of personal information in the physical memory of the mobile phone, but has been transferred to the mobile APP most of the time. In recent years, data extraction for personal social apps such as WeChat, Weibo, and QQ is relatively mature, but data forensics for office social software is less.

Most of the existing mobile phone APP forensics methods are to analyze the APP storage file, and then decrypt the account information and data information in the stored file through a decryption method, and finally extract important information. However, different APP files have different storage paths and different file encryption methods, so it is more important to develop a data extraction method for enterprise WeChat.

The existing data extraction solutions for enterprise WeChat mainly have the following problems in the actual use process:

1. Less data extraction: Most of the existing enterprise WeChat extraction methods are to use the enterprise WeChat account provided by the person involved to extract the enterprise WeChat after logging in; in the case that the enterprise WeChat login account and password cannot be obtained, it is difficult to obtain the enterprise WeChat account. data is extracted.

2. The extracted data is incomplete: There are many types of enterprise WeChat data, including user account information, to-do information, friend information, group information, and positioning information. Existing enterprise WeChat extraction methods are often difficult to extract all information.

3. Low extraction efficiency: At present, there is no complete process method for enterprise WeChat, so the forensics of enterprise WeChat relies on temporary research, resulting in low data extraction efficiency.

SUMMARY OF THE INVENTION

In view of the problems existing in the existing enterprise WeChat data extraction solution, a new data extraction solution is needed.

Therefore, the purpose of the present invention is to provide a data extraction method for mobile phone enterprise WeChat, which can effectively solve the problems existing in the prior art. Accordingly, the present invention further provides a data extraction system and a storage medium.

In order to achieve the above purpose, the data extraction method for mobile phone enterprise WeChat provided by the present invention includes:

Analyze the storage files of enterprise WeChat data in the mobile phone, and analyze the storage location of various types of enterprise WeChat data;

Use the secret key generation algorithm to decode the information of each file in the data storage path of the enterprise WeChat, and extract all the data information of the enterprise WeChat.

Further, when the method parses the storage file of the enterprise WeChat data in the mobile phone, extracts the folder storing the account information, and parses out the account information contained in the enterprise WeChat;

Extract the encrypted enterprise WeChat file from the mobile phone, and write the enterprise WeChat file that needs to be decoded into a temporary folder. For the extracted file, first find the file "io_data.json", and get "login_keys" by reverse sequence. The value of , used to decrypt the database file that stores the enterprise WeChat data;

After obtaining the value of login_keys, decrypt the relevant secret key Key_1 by decoding and deserializing.

Further, for the obtained secret key Key_1, the method uses the decryption secret key generated by the secret key generation algorithm, and uses the symmetric encryption algorithm to decode each file information in the enterprise WeChat data storage path.

Further, the method can convert the decoded content into a corresponding Chinese character string using UTF-8 in the function GetProtoGB.

In order to achieve the above-mentioned purpose, the data extraction system for mobile phone enterprise WeChat provided by the present invention includes:

A path analysis module, which is used to analyze the storage files of the enterprise WeChat data in the mobile phone, and analyze the storage locations of various types of data in the enterprise WeChat;

A file decryption module, the file decryption module decodes each file information in the data storage path of the enterprise WeChat by using the secret key generation algorithm, and extracts all the data information of the enterprise WeChat.

In order to achieve the above object, the present invention provides a storage medium, wherein the storage medium includes a stored program, and the program executes the above-mentioned data extraction method.

The solution provided by the present invention analyzes the information of the enterprise WeChat storage file by investigating the enterprise WeChat storage file; meanwhile, the secret key generation algorithm is used to decrypt the enterprise WeChat storage file information and extract the data information; thus ensuring the comprehensive data extraction.

The solution provided by the present invention develops the data extraction process of the enterprise WeChat by decoding each storage file of the enterprise WeChat, and improves the data analysis efficiency of the enterprise WeChat, thereby improving the data extraction efficiency.

Description of drawings

The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

1 is an example diagram of the operation flow of the secret key generation algorithm in the example of the present invention;

FIG. 2 is an example diagram of the operation flow of the self-defined replacement algorithm in the example of the present invention.

detailed description

In order to make it easy to understand the technical means, creation features, achieved goals and effects of the present invention, the present invention will be further described below with reference to the specific figures.

This solution is aimed at the data generated by the operation of mobile phone enterprise WeChat. First, it analyzes the storage location of various types of enterprise WeChat data by parsing the enterprise WeChat data storage files;

Next, use the secret key generation algorithm to decode the information of each file in the data storage path of the enterprise WeChat, and extract all the data information of the enterprise WeChat.

In this way, a comprehensive and efficient extraction of the data generated by the mobile phone enterprise WeChat operation is realized.

The extraction method for mobile phone enterprise WeChat data provided by this solution is realized through the following steps during specific implementation:

(1) Extract the installation and storage path of the enterprise WeChat in the mobile phone, and find the Profiles file.

(2) Extract the folder for storing account information. Enterprise WeChat will create a folder for each user. The folder name is the MD5 value of the user ID. This folder is used to store user data and parse out the accounts contained in Enterprise WeChat. information, you can get the user data folder of enterprise WeChat.

The user data stored in the enterprise WeChat can be found according to the attribute of the folder name, so that it is convenient to export the user data to the specified folder in the subsequent steps.

(3) In order to ensure that the original mobile phone data is not modified, export the enterprise WeChat data that needs to be decoded to a temporary file, obtain the value of login_keys from the extracted mobile phone enterprise WeChat file, and decrypt it by decoding and deserializing. Related key Key_1.

As an example, the relevant key Key_1 for decrypting files such as Info.db and Message1 can be obtained through Base64 decoding and Google protobuf deserialization.

(4) For the decoded content, use UTF-8 in the function GetProtoGB to convert it into the corresponding Chinese character string.

(5) Referring to the above analysis framework, content such as friend group information, personal information, friends, groups, chat information, announcements, colleagues, to-do items, etc. can be parsed.

The method analyzes the information of the enterprise WeChat storage file by investigating the enterprise WeChat storage file; at the same time, the secret key generation algorithm is used to decrypt the enterprise WeChat storage file information and extract the data information. This effectively overcomes the problem of less data extraction in the existing scheme.

This solution uses the secret key generation algorithm to decode and reverse each file information in the enterprise WeChat storage file, extract the relevant storage area of the corresponding information, and parse and complete the data information. This effectively overcomes the problem of incomplete data extraction in the existing scheme.

This solution develops the data extraction process of enterprise WeChat by decoding each storage file of enterprise WeChat, and improves the efficiency of enterprise WeChat data analysis. Effectively overcome the problem of low extraction efficiency of the existing scheme.

When the solution is specifically implemented, it can be presented in the form of a corresponding software program, and can be stored in a corresponding storage medium, and the configuration form of the storage medium is not limited here.

Aiming at the above data extraction method, this solution provides an extraction system for mobile phone enterprise WeChat data. The extraction system is mainly composed of a path analysis module and a file decryption module.

The path analysis module in this system is used to analyze the storage files of enterprise WeChat data in the mobile phone, and analyze the storage location of various types of enterprise WeChat data.

As an example, the path analysis module in this system mainly analyzes three files for enterprise WeChat: the user's account information and the secret key Key_1 can be parsed from the "io_data.json" file; the "Session.db" can be decrypted using the secret key Key_1. After the file, the user's friend information can be parsed; after decrypting the "Info.db" file with the secret key Key_1, the user's chat information and group chat information can be parsed.

The file decryption module in this system uses the secret key generation algorithm to decode the information of each file in the data storage path of the enterprise WeChat, and extracts all the data information of the enterprise WeChat.

The data extraction system thus formed can comprehensively and efficiently extract the data of the mobile phone enterprise WeChat according to the above data extraction method and process during operation.

For the above solution, the implementation process of the above solution is further described below by taking a specific application example.

This application example extracts the mobile phone enterprise WeChat data by building the corresponding data extraction system. The entire extraction process mainly includes two parts: enterprise WeChat file path analysis and enterprise WeChat file decryption.

Among them, the path analysis of the enterprise WeChat file is firstly performed, and the process is as follows.

In view of the different installation paths of enterprise WeChat in Android and iOS systems, this solution analyzes the storage path of enterprise WeChat in the two operating systems respectively; find out the storage path of enterprise WeChat:

Android phone storage location:

data/data/com.tencent.wework/app_data/Profiles;

For example: Xiaomi mobile phone storage path is

"/data/data/com.tencent.wework/r/app_data/Profiles/^[0-9a-fA-F]{32}$";

Other Android phone storage paths are

"/data/data/com.tencent.wework/app_data/Profiles/^[0-9a-fA-F]{32}$"

iOS phone storage location: /com.tencent.ww/Documents/Profiles.

Specifically:

"/AppDomain/com.tencent.ww/Documents/Profiles/^[0-9a-fA-F]{32}$").

Analyze the account information in the relevant files under the enterprise WeChat storage path. Through the analysis, it is found that the enterprise WeChat creates a folder for each account to store account data information. The main information is stored in the Profiles/MD5/Message1 directory; The storage file is encrypted by aes-128-cbc, and the decryption key is stored in Profiles/MD5/io_data.json.

Next, decrypt the enterprise WeChat files, and the process is as follows.

For the io_data.json file, obtain the value whose key value is "login_keys", which is a base64 string, decode it, and obtain the protobuf serialized binary data block after decoding.

Then, the obtained protobuf serialized binary data block can be deserialized into a readable structure through protoc.exe, and the decryption related key key_1 can be obtained.

At this time, the file can be decrypted and parsed through a secret key generation algorithm, and valid data can be extracted, wherein the specific implementation of the secret key generation algorithm is shown in FIG. 1 .

Here, for the obtained decryption-related key key_1, a corresponding key aeskey is generated through a corresponding key generation algorithm (as shown in FIG. 1 ), so as to decrypt the account information storage file. The basic process is as follows:

(1) Parse key_1 from Profiles/MD5/io_data.json (the process is as above);

(2) generate the key Aes key by passing the key key_1 through the secret key generation algorithm shown in Figure 1;

(3) Then decrypt the above-mentioned related files such as Message1 and Info.db through the aes-123-cbc algorithm.

As an example, the following describes the process of key generation in this example in conjunction with accompanying drawing 1:

1) Take the first 8 bytes of key_1 and a default 24-byte data to form an intermediate key key_a;

2) Perform 50 cycles of md5 calculation on the default 32-byte data to obtain the intermediate key key_a_1;

3) Perform a custom replacement algorithm on key_a and key_a_1 to generate a 32-byte md5 value temp_b;

4) Combining key_a and temp_b into a 64-byte data block and performing 50 times of md5 to obtain the first 16-byte data and the current page number+4-byte default value to form a 24-byte intermediate key key_b;

5) Do an md5 calculation on key_b to get the Aes key for final decryption.

In conjunction with it, the custom replacement process used in this key generation process is as follows (as shown in Figure 2):

1) Initialize the 256-byte replacement table init_table;

2) Perform an AND operation with each byte of the number of cycles count and key_a_1 to generate the initial replacement item init_md5;

3) Perform an AND operation with init_table[i] and init_md5[i%16] in turn to obtain the intermediate index temp, and finally exchange the values of init_table[i] and init_table[temp];

4) Perform an AND operation with key_a[i-1] and init_table[temp] in turn to obtain temp_2, and store temp_2 in key_a[i-1];

5) Repeat steps 1-4 for a predetermined number of times (eg 20 times) to obtain key_a.

According to this method, the key can be generated quickly and safely, thereby further improving the security and reliability of the whole scheme.

Finally, it should be noted that the above-mentioned method of the present invention, or a specific system unit, or some of its units, is a pure software architecture, and can be deployed on a physical medium, such as a hard disk, an optical disk, or any electronic device ( Such as a smart phone, a computer-readable storage medium), when the machine loads the program code and executes (eg, a smart phone loads and executes), the machine becomes a device for carrying out the present invention. The above-mentioned method and device of the present invention can also transmit the program code type through some transmission media, such as cable, optical fiber, or any transmission type. When the program code is received, loaded and executed by a machine (such as a smart phone), The machine becomes a device for carrying out the invention.

The foregoing has shown and described the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above-mentioned embodiments. The above-mentioned embodiments and descriptions only illustrate the principle of the present invention. Without departing from the spirit and scope of the present invention, the present invention will also have Various changes and modifications fall within the scope of the claimed invention. The claimed scope of the present invention is defined by the appended claims and their equivalents.

Claims (6)

1. The data extraction method for mobile phone enterprise WeChat is characterized in that, it includes:

   Analyze the storage files of enterprise WeChat data in the mobile phone, and analyze the storage location of various types of enterprise WeChat data;

   Use the secret key generation algorithm to decode the information of each file in the data storage path of the enterprise WeChat, and extract all the data information of the enterprise WeChat.
2. The data extraction method for mobile phone enterprise WeChat according to claim 1, characterized in that, when the method analyzes the storage file of enterprise WeChat data in the mobile phone, it extracts a folder for storing account information, and parses out the account contained in the enterprise WeChat. information;

   Extract the encrypted enterprise WeChat file from the mobile phone, and write the enterprise WeChat file that needs to be decoded into a temporary folder. For the extracted file, first find the file "io_data.json", and get "login_keys" by reverse sequence. The value of , used to decrypt the database file that stores the enterprise WeChat data;

   After obtaining the value of login_keys, decrypt the relevant secret key Key_1 by decoding and deserializing.
3. According to the data extraction method for mobile phone enterprise WeChat according to claim 1, it is characterized in that, for the obtained secret key Key_1, the decryption secret key generated by the secret key generation algorithm uses a symmetric encryption algorithm to store data in the enterprise WeChat data storage path. The information of each file is decoded.
4. The data extraction method for mobile phone enterprise WeChat according to claim 1, wherein the decoded content can be converted into a corresponding Chinese character string by using UTF-8 in the function GetProtoGB.
5. The data extraction system for mobile phone enterprise WeChat is characterized in that it includes:

   A path analysis module, which is used to analyze the storage files of the enterprise WeChat data in the mobile phone, and analyze the storage locations of various types of enterprise WeChat data;

   A file decryption module, wherein the file decryption module uses a secret key generation algorithm to decode each file information in the enterprise WeChat data storage path, and extracts all the data information of the enterprise WeChat.
6. A storage medium, wherein the storage medium includes a stored program, wherein the program executes the data extraction method according to any one of claims 1-4.

Images