利用Frida实现wcdb和sqlcipher数据库加密获取秘钥

参考

wcdb:https://github.com/Tencent/wcdb/wiki/Android%E6%8E%A5%E5%85%A5%E4%B8%8E%E8%BF%81%E7%A7%BB

sqlcipher:https://github.com/sqlcipher/android-database-sqlcipher

js脚本

Java.perform(function () {
    //wcdb
    try {
        const SQLiteConnection = Java.use('com.tencent.wcdb.database.SQLiteConnection');
        SQLiteConnection.nativeOpen.implementation = function (path, openFlags, vfsName) {
            var result = this.nativeOpen(path, openFlags, vfsName);
            console.log("-->nativeOpen(path:" + path + ",openFlags:" + openFlags + ",vfsName:" + vfsName + "):" + result);
            return result;
        }
        const String = Java.use('java.lang.String')
        SQLiteConnection.nativeSetKey.implementation = function (connectionPtr, password) {
            var result = this.nativeSetKey(connectionPtr, password);
            console.log('passwordStr:' + String.$new(password));
            console.log("-->nativeSetKey(connectionPtr:" + connectionPtr + ",password:" + password + "):" + result);
            return result;
        }
    } catch (e) {
        console.log(e)
    }
    //sqlcipher
    try {
        const SQLiteDatabase = Java.use('net.sqlcipher.database.SQLiteDatabase');
        SQLiteDatabase.dbopen.implementation = function (path, flags) {
            var result = this.dbopen(path, flags);
            console.log("-->dbopen(path:" + path + ",openFlags:" + flags + "):" + result);
            return result;
        }
        SQLiteConnection.key.implementation = function (password) {
            var result = this.key(password);
            console.log('passwordStr:' + String.$new(password));
            console.log("-->key(password:" + password + "):" + result);
            return result;
        }
        SQLiteConnection.key_mutf8.implementation = function (password) {
            var result = this.key_mutf8(password);
            console.log('passwordStr:' + String.$new(password));
            console.log("-->key_mutf8(password:" + password + "):" + result);
            return result;
        }
        SQLiteConnection.rekey.implementation = function (password) {
            var result = this.rekey(password);
            console.log('passwordStr:' + String.$new(password));
            console.log("-->rekey(password:" + password + "):" + result);
            return result;
        }
    } catch (e) {
        console.log(e)
    }

});