[GH-ISSUE #158] msgstore.db.crypt15 contains more data than a DB File #68

New issue

Closed

opened 2026-03-02 03:59:50 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 03:59:50 +03:00

Owner

Originally created by @3llomi on GitHub (Dec 26, 2024).
Original GitHub issue: https://github.com/ElDavoo/wa-crypt-tools/issues/158

I noticed that msgstore.db (after decryption) is containing more data than a DB or SQLite file.
I tried to run binwalk against it and it outputs a lot of addresses

I ran binwalk --dd="jpeg:jpg" msgstore.db and I was able to extract thumbnails of the images as well. but for some reason each image is about 30MB - I guess it has scrambled data within?

I guess we can get more data out of msgstore.db after decryption? perhaps stickers database?

Originally created by @3llomi on GitHub (Dec 26, 2024). Original GitHub issue: https://github.com/ElDavoo/wa-crypt-tools/issues/158 I noticed that msgstore.db (after decryption) is containing more data than a DB or SQLite file. I tried to run binwalk against it and it outputs a lot of addresses ![CleanShot 2024-12-26 at 17 09 22](https://github.com/user-attachments/assets/7bcd08b0-4e36-4932-9ba3-2576055a5a6e) I ran `binwalk --dd="jpeg:jpg" msgstore.db` and I was able to extract thumbnails of the images as well. but for some reason each image is about 30MB - I guess it has scrambled data within? I guess we can get more data out of msgstore.db after decryption? perhaps stickers database?

kerem closed this issue

2026-03-02 03:59:50 +03:00

kerem commented

2026-03-02 03:59:51 +03:00

Author

Owner

@ElDavoo commented on GitHub (Dec 29, 2024):

They're just inside the database.

Stickers are in their own separate backup.

@ElDavoo commented on GitHub (Dec 29, 2024): They're just inside the database. Stickers are in their own separate backup.

kerem referenced this issue

2026-03-02 04:00:07 +03:00

[PR #68] [MERGED] Bump protobuf from 4.23.0 to 4.23.1 #115