den4uk / andriller

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Signal database and/or backup extraction

pshem opened this issue · comments

commented

Signal has been growing as a secure messaging platform, but extracting from it is currently not supported in Andriller. I was wondering is there is any chance for adding support either for Signal Backup or Signal Database extraction?

Their encryption code is public and there are standalone backup extraction utilities such as https://github.com/xeals/signal-back (written in Go) and https://github.com/tbvdm/sigbak (written in C).

As much as I agree Signal would be a great app to add to be supported, I have limited time to research into implementing this. If you have a translation of Go / C decoding into Python - it would be of assistance and could implement sooner.

commented

I've found a Python implementation of a backup decryptor https://github.com/elkhadiy/debruitage. However, it doesn't contain a method of extracting Signal's backup encryption password, so we'd have to prompt the user for those 30 digits

Edit: and it doesn't seem to work very well. It seems to be trying to wrap the C implementation linked above with Python and it works in some cases but no others. Hoverer, someone has already found a fix so it should be useful.

Edit2: The fix makes the database create the tables correctly, but errors out when trying to fill them with the contents of the backup. However, the code seems to be based on Signal's own encryption implemented with protocol buffers and converted to Python with https://github.com/elkhadiy/debruitage/blob/master/signal_backup_manager/gen_protobackup_module.py, so it might be a useful start

I recommend this (tested multiple times) :

I don't know if those can be used into Andriller somehow.