[GH-ISSUE #175] [QUESTION] message_thumbnail has missing rows after decryption #78

New issue

Closed

opened 2026-03-02 03:59:53 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 03:59:53 +03:00

Owner

Originally created by @3llomi on GitHub (May 27, 2025).
Original GitHub issue: https://github.com/ElDavoo/wa-crypt-tools/issues/175

I'm wondering why the message_thumbnail table has missing rows after decryption?

I took a msgstore.db.crypt15 and decrypt it, then I got the raw msgstore.db inside data/data/com.whatsapp/databases/msgstore.db using root

And I can see that the raw msgstore.db (inside data) has more rows than the decrypted one.

Could it be like WhatsApp tries to minify the Database size by removing some of the thumbnails?
Or is there something wrong in decryption?

I also tried crypt14 and it's the same

msgstore.db.crypt15 - decrypted

msgstore.db from /data

Originally created by @3llomi on GitHub (May 27, 2025). Original GitHub issue: https://github.com/ElDavoo/wa-crypt-tools/issues/175 I'm wondering why the `message_thumbnail` table has missing rows after decryption? I took a `msgstore.db.crypt15` and decrypt it, then I got the raw `msgstore.db` inside `data/data/com.whatsapp/databases/msgstore.db` using root And I can see that the raw msgstore.db (inside data) has more rows than the decrypted one. Could it be like WhatsApp tries to minify the Database size by removing some of the thumbnails? Or is there something wrong in decryption? I also tried crypt14 and it's the same **msgstore.db.crypt15 - decrypted** ![Image](https://github.com/user-attachments/assets/524689f1-53ea-41d3-bfc2-b8deab920416) **msgstore.db from /data** ![Image](https://github.com/user-attachments/assets/f3049837-536c-427b-b2e4-b75a4716d833)

kerem

2026-03-02 03:59:53 +03:00

closed this issue
added the
invalid
label

kerem commented

2026-03-02 03:59:54 +03:00

Author

Owner

@3llomi commented on GitHub (May 28, 2025):

CONFIRMED
WhatsApp Indeed removes some of the thumbnails while creating encrypted backup (probably to reduce db file size)

I attached Frida while backing up and intercepted SQLite queries and I can see the delete query

@3llomi commented on GitHub (May 28, 2025): CONFIRMED WhatsApp Indeed removes some of the thumbnails while creating encrypted backup (probably to reduce db file size) I attached Frida while backing up and intercepted SQLite queries and I can see the delete query ![Image](https://github.com/user-attachments/assets/1d428ae1-7914-419c-b8a4-1a43d9fb9391)

kerem commented

2026-03-02 03:59:54 +03:00

Author

Owner

@ElDavoo commented on GitHub (Jan 4, 2026):

Well done. Remember what to do with decrypted files is not in the scope of this project.

@ElDavoo commented on GitHub (Jan 4, 2026): Well done. Remember what to do with decrypted files is not in the scope of this project.

kerem referenced this issue

2026-03-02 04:00:08 +03:00

[PR #78] [MERGED] Bump protobuf from 4.23.4 to 4.24.0 #119