I want to decrypt in my non-rooted android phone. I tried multiple steps using adb but nothing worked run-as adb backup How can I do so? Is there any way to backup full android to a file on laptop and extract key from it? Please suggest.
34iTtu. The WhatsApp and backups is quite a drama. The messaging app is very restrictive on this subject, as Android users are only allowed to save a backup of their chats on Google Drive . And until recently WhatsApp backups on Android were only compatible with other Android devices. Luckily, there is now an official method to transfer your WhatsApp from Android to iPhone . However, if you have come this far, it is because you have found the msgstore file that contains all your WhatsApp chats and that, in theory, allows you to move them from one mobile to another without having to use any cloud storage service. Well, this time we will tell you everything you need to know about “msgstore” from what it is to how to restore the backup stored in this file. Let’s go there… The WhatsApp msgstore file, which you will surely find in the folders of your mobile with the name “ is the file where all your WhatsApp chats are stored in an encrypted way . That means you won’t be able to open it easily with a text editor or WhatsApp itself, since the messages are encrypted and can’t be read as plain text. Remember that WhatsApp by default and in a mandatory way encrypts all conversations from end to end to prevent hackers from accessing your WhatsApp messages easily. Normally, the app will not save a single msgstore file on your device, but several, since one is created for each date and encryption version used by WhatsApp when making the backup. The standard file name structure is as follows . And the meaning of each of its parts is as follows msgstore the type of file that saves your WhatsApp conversations. db acronym for data base. yyyy – The year the file was created, for example, 2022. mm – The month the file was created, for example, 07. dd The day the file was created, for example 16. cryptXX the encryption method used by WhatsApp, it can be crypt5 crypt7 crypt8 crypt12 crypt14 How to open a msgstore file and restore this WhatsApp backup? Opening a WhatsApp msgstore file and accessing all the chats it contains is not as easy as searching for it and double-clicking on it, as it contains encrypted information. To start with, you will need to root your Android in order to decrypt msgstore files. If your mobile is not rooted and you refuse to root it, we are sorry to tell you that you will not be able to open the msgstore file. At the end of the article we leave an alternative for you. This is so complicated for your security, because if WhatsApp allowed msgstore files to be opened easily, WhatsApp messages from all over the world would be leaked on the Internet because it would be very easy for hackers to access them. Clarified that point, if you have root on your Android, follow these steps to open WhatsApp msgstore files Firstly, locate the msgstore files in the following address internal storage > WhatsApp > Databases . Now, you must find the encryption key that WhatsApp uses, which can only be obtained with root from this address data > data > > files > key . Next, connect your mobile to the PC via USB cable and pass the required files, mentioned above. Then, install the WhatsApp Viewer application available on GitHub on the PC, which is open source, so it is quite reliable. Open WhatsApp Viewer on your PC and select File > replacing “XX” with the encryption version displayed by your msgstore files. Next, choose the msgstore files you want to open and the corresponding encryption key. On the left side of the program, your WhatsApp chats will be displayed and you will be able to read the conversations correctly identified with the phone numbers of the contacts. WhatsApp Viewer is not only a WhatsApp chat viewer, but it also allows you to export your conversations to txt, html and json formats in case you need them that way. Now, if what you want is to restore the WhatsApp msgstore file backup on your mobile, then follow this tutorial on how to restore a local WhatsApp backup. It is very simple! What do I do if my Android mobile is not rooted and I do not intend to root it? Your only option in that case is to export WhatsApp chats from the WhatsApp mobile app itself. That way, you can share them with other apps or even email them to yourself. How? Check out this tutorial on how to export a WhatsApp conversation. So you can see them in Word or Gmail. Rachel Maga is a technology journalist currently working at Globe Live Media agency. She has been in the Technology Journalism field for over 5 years now. Her life’s biggest milestone is the inside tour of Tesla Industries, which was gifted to her by the legend Elon Musk himself. Rachel Maga July 18, 2022 Rachel Maga is a technology journalist currently working at Globe Live Media agency. She has been in the Technology Journalism field for over 5 years now. Her life's biggest milestone is the inside tour of Tesla Industries, which was gifted to her by the legend Elon Musk himself.JikaAnda pernah melihat file di WA bernama msgstore.db.crypt12 dan msgstore-(tahun)-(bulan)-(tanggal).1.db.crypt12. File tersebut bisa digunakan untuk memulihkan riwayat chat WA Anda. msgstore whatsapp adalah sebuah file cadangan lokal yang dibuat dalam tujuh hari terakhir. Beda dengan cadangan di Google Drive yang hanya menyimpan cadangan WhatsApp backup conversation files are now saved with the .crypt12 extension. From crypt9, they seem to be using a modified version of Spongy Castle – a cryptography API library for the findings below are based on reverse engineering work done on WhatCrypt and Omni-Crypt. I would like to highlight that IGLogger proved to be a very useful tool when it came to smali code debugging. Extract Key File To decrypt the crypt12 files, you will first need the key file. The key file stores the encryption key, K. WhatsApp stores the key file in a secure location /data/data/ If your phone is rooted, extracting this file is easy. I will not go through the steps again, as it’s already mentioned in the crypt8 decryption article. If your phone is not rooted, refer to instructions from WhatCrypt and Omni-Crypt for details on extracting the key file. The idea is to install an older version of WhatsApp, where Android ADB backup was still working and extract the key file from the backup. Extract crypt12 Backup File Pull the encrypted WhatsApp messages file from your phone using ADB. $ adb pull /sdcard/WhatsApp/Databases/ Decryption Keys This section is just for your information and you can skip this section. The encryption method being used is AES with a key K length of 256 bits and an initialisation vector IV size of 128 bits. The 256-bit AES key is saved from offset 0x7E till 0x9D in the file. Offsets start from 0x00. You can extract the AES key with hexdump and assign the value to variable $k. $ k=$hexdump -ve '2/1 "%02x"' key cut -b 253-316 The $k variable will hold a 64-digit hexadecimal value in ASCII that is actually 256 bits in length. The IV or the initialisation vector is saved from offset 0x33 till 0x42 in the crypt12 file. The IV value will be different for every crypt12 file. $ iv=$hexdump -n 67 -ve '2/1 "%02x"' cut -b 103-134 The K and IV extraction method is similar to what we have done for crypt8 files before. Strip Header / Footer in crypt12 File Again, this section is just for your information and you can skip this section. Before we start the decryption process, we will need to strip the 67 byte header and 20 byte footer from the crypt12 file. $ dd if= of= ibs=67 skip=1$ truncate -s -20 The above dd command will strip the the first 67 bytes from the crypt12 file and save it to a file with extension The truncate command will strip the last 20 bytes from the crypt12 file. As the WhatsApp AES cryptography API library seems to be a modified version, we will no longer be able to use openssl to decrypt the crypt12 file. I have yet to determine what has been modified. To decrypt crypt12 files, I have written a simple Java program that will use the modified cryptography API library instead. For the cryptography API library, I have extracted the modified Spongy Castle cryptography class files from the Omni-Crypt APK file using dex2jar. You can find the Java program and crypto library over here at GitLab. The Java program will create 3 output files – encrypted file with header and footer stripped. – decrypted file in zlib format. – decrypted sqlite3 database file. Below is how you can compile and run the Java program. 12345678910111213141516171819202122232425262728293031323334353637383940 $ git clone cd whatsapp-crypt12/$ javac -classpath "lib/ cp ../ .$ cp ../ .$ java -cp "lib/ crypt12KXXXXXXXXXXIVYYYYcreating encrypted file with header/footer stripped zlib output file sqlite3 output file ls -ltotal 136724-rw-r-r- 1 ibrahim staff 4339 Oct 9 1605 1 ibrahim staff 5459 Oct 9 1605 1 ibrahim staff 158 Oct 9 1605 keydrwxr-xr-x 2 ibrahim staff 4096 Oct 9 1605 lib-rw-r-r- 1 ibrahim staff 1089 Oct 9 1605 LICENSE-rw-r-r- 1 ibrahim staff 62692352 Oct 9 1606 1 ibrahim staff 25757610 Oct 9 1605 1 ibrahim staff 25757523 Oct 9 1605 1 ibrahim staff 25757507 Oct 9 1606 1 ibrahim staff 1376 Oct 9 1605 file * compiled Java class data, version Java C source, ASCII textkey Java serialization data, version 5lib SQLite database, user version raw G3 data, zlib compressed data Final Words To use the Java decryption tool, you will need to use OpenJDK. Oracle require JCE Provider libraries to be signed. OpenJDK does not have this requirement. If you try running the Java program on Oracle JDK, you will most likely get the following exception. Exception in thread "main" JCE cannot authenticate the provider SC There are some workarounds to bypass the error, but it has not worked for me so far. Decryption failed when using the modified cryptography API library from WhatsApp and WhatCrypt. Only Omni-Crypt library is working. I have yet to determine the reason for this. If you have any further information on this, leave a = { interested_inunix, linux, android, open_source, reverse_engineering; codingc, shell, php, python, java, javascript, nodejs, react; plays_onxbox, ps4; linux_desktop_usertrue; } Answer(1 of 3): To be on the safe side, open it in Notepad. Ensure that it is from a reliable source. Else it might crash your hard disk too. Be careful.
Name already in use A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch? 1 branch 0 tags Code Use Git or checkout with SVN using the web URL. Open with GitHub Desktop Download ZIP Latest commit Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time Crypt12 Decrypt Decrypt Whatsapp crypt12 sqlite database files Crypt12 algorithm AES GCM mode encryption using 128 bit block size and 16 bytes IV nonce key file must be 158 byte long only last 32bytes represent the key crypt12 file includes 67 byte header and 20 byte trailer which needs to be removed the resulted plain bytes need to be decompressed in order to obtain the final SQLite .db file for more information you can check A Systems Approach to Cyber Security Proceedings of the 2nd Singapore Cyber-Security R&D Conference SG-CRC 2017 Usage example Ensure you have the key file key and crypt12 file in the same directory with the go entrypoint. You can use the existing key and msgstore files in the repo for testing. Run using GO Or run Windows executable Otherwise use the necessery arguments go run -h Usage of -crypt12file string crypt12 file path default " -keyfile string decryption key file path default "key" -outputfile string decrypted output file path default " Build go get go build crypt12-decrypt -> built with go version