Data extraction method and system based on SQLite3 eigenvalue-based memory retrieval database

Abstract

The present invention provides a method and system for extracting data from a memory retrieval database based on SQLite3 feature values, the method comprising the following steps: scanning the memory of a target process to identify a target feature value in a current SQLite3 database, and locating a memory address based on the target feature value; parsing a data structure of the SQLite3 database based on the memory address to obtain a first variable and a second variable; locating and extracting a key based on the first variable to obtain a target key, and performing address analysis and function locating based on the second variable to obtain an encryption and decryption algorithm; decrypting the SQLite3 database in the memory of the target process based on the target key and the encryption and decryption algorithm to obtain target data. The method and system for extracting data from a memory retrieval database based on SQLite3 feature values ​​of the present invention can quickly and accurately locate keys and encryption and decryption functions, greatly improve decryption efficiency, and reduce resource consumption and time cost of evidence collection.

Description

Technical Field

[0001] The invention belongs to the technical field of data processing, and in particular relates to a data extraction method and system for a memory retrieval database based on SQLite3 characteristic values. Background Art

[0002] With the development of information technology, more and more applications use SQLite3 database to store data. Especially in PC applications, databases usually do not store keys in local files, but dynamically generate and store them in memory when the program is running, which brings challenges to electronic data forensics, because obtaining these keys becomes a key step in decrypting the database.

[0003] Existing technical means mainly focus on file-level analysis and simple memory scanning, lacking in-depth understanding of database structure and targeted retrieval methods. This results in that when faced with encrypted databases, it often takes a lot of time and resources to try to crack them, and the success rate is low. Summary of the invention

[0004] In view of the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a method and system for extracting data from a memory retrieval database based on SQLite3 feature values, so as to solve the technical problem of difficult data extraction in a SQLite3 database.

[0005] In a first aspect, the present invention provides a method for extracting data from a memory retrieval database based on SQLite3 feature values, the method comprising the following steps:

[0006] Scan the memory of the target process to identify the target feature value in the current SQLite3 database, and locate the memory address based on the target feature value;

[0007] Parsing a data structure of the SQLite3 database based on the memory address to obtain a first variable and a second variable;

[0008] Based on the first variable, key location and extraction are performed to obtain a target key, and based on the second variable, address analysis and function location are performed to obtain an encryption and decryption algorithm;

[0009] The SQLite3 database in the target process memory is decrypted based on the target key and the encryption and decryption algorithm to obtain the target data.

[0010] In a possible implementation of the present application, the method further includes defining characteristic values ​​in a SQLite3 database, specifically including:

[0011] Analyze the data structure of the SQLite3 database in memory to determine the characteristic value type, specifically analyze the preset tags, which include the status tag, page type identifier, page header offset, B-tree node pointer, record format and record data, wherein:

[0012] Determine a database state characteristic value based on the state tag, wherein the database state includes an open state, a closed state, and a use state;

[0013] Determine a tag type characteristic value based on the page type identifier, the page type identifier indicates a page type, and the page type includes a table data page, an index page, and a free page;

[0014] A data type characteristic value is determined based on the page header offset, the B-tree node pointer, and the record format and the record quantity.

[0015] In a possible implementation of the present application, scanning the memory of the target process to identify the target feature value in the current SQLite3 database, and locating the memory address based on the target feature value, specifically includes:

[0016] Scanning the entire memory of the target process byte by byte based on a preset memory scanning tool;

[0017] During the scanning process, the data block matching the feature value type is extracted to obtain the target feature value, and the memory address is simultaneously located based on the target feature value, wherein:

[0018] When matching with the characteristic value type, a preset pattern matching mechanism is used for matching.

[0019] In a possible implementation of the present application, parsing the data structure of the SQLite3 database based on the memory address to obtain the first variable and the second variable specifically includes:

[0020] Utilizing a preset debugging tool in combination with the memory address to perform memory mapping and parsing to obtain a memory map;

[0021] In the memory mapping, the first variable and the second variable are obtained according to the memory layout identification of the SQLite3 database, wherein the first variable includes a pCodec variable and the second variable includes an xCodec variable.

[0022] In a possible implementation of the present application, the performing key location and extraction based on the first variable to obtain the target key specifically includes:

[0023] Based on a preset memory editing tool, the address of the first variable is read to locate the key to obtain an initial key;

[0024] Verification is performed based on the initial key, wherein the encrypted data in the decryption database is decrypted using the initial key, and the successfully decrypted initial key is extracted as the target key.

[0025] In a possible implementation of the present application, performing address analysis and function location based on the second variable to obtain an encryption and decryption algorithm specifically includes:

[0026] Checking the pointer address of the second variable based on the debugging tool to obtain the encryption and decryption function address;

[0027] Perform breakpoint operation based on the encryption and decryption function address to identify function call information and locate the function;

[0028] After determining the function call information, the encryption and decryption function address is disassembled based on a disassembly tool to obtain the encryption and decryption function assembly code;

[0029] Algorithm logic analysis and verification are performed based on the encryption and decryption function assembly code to obtain the encryption and decryption algorithm, wherein the verification is performed using known data and the target key.

[0030] In a possible implementation of the present application, decrypting the SQLite3 database in the target process memory based on the target key and the encryption / decryption algorithm to obtain the target data specifically includes:

[0031] Load the encryption and decryption algorithm and configure the target key in a secure decryption environment;

[0032] Decrypting the encrypted data block in the SQLite3 database based on the encryption and decryption algorithm and the target key to obtain decrypted data;

[0033] The target data is obtained by performing verification and extracting key information based on the decrypted data, wherein the key information includes at least account information and transaction records.

[0034] In a second aspect, the present invention provides a data extraction system for a memory retrieval database based on SQLite3 feature values, the system comprising:

[0035] An identification module is used to scan the memory of the target process to identify the target feature value in the current SQLite3 database, and locate the memory address based on the target feature value;

[0036] A parsing module, used for parsing a data structure of an SQLite3 database based on the memory address to obtain a first variable and a second variable, wherein the first variable includes a pCodec variable and the second variable includes an xCodec variable;

[0037] An acquisition module, configured to locate and extract a key based on the first variable to obtain a target key, and to perform address analysis and function location based on the second variable to obtain an encryption and decryption algorithm;

[0038] The decryption module is used to decrypt the SQLite3 database in the target process memory based on the target key and the encryption and decryption algorithm to obtain the target data.

[0039] In a third aspect, the present invention provides an electronic device, the electronic device comprising: a processor and a memory;

[0040] The memory is used to store computer programs;

[0041] The processor is used to execute the computer program stored in the memory, so that the electronic device executes the above-mentioned data extraction method of the memory retrieval database based on the SQLite3 feature value.

[0042] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by an electronic device, implements the above-mentioned method for extracting data from a memory retrieval database based on SQLite3 feature values.

[0043] As described above, the data extraction method and system of the memory retrieval database based on SQLite3 feature values ​​of the present invention have the following beneficial effects:

[0044] (1) Improving decryption efficiency. This aspect performs memory retrieval based on the characteristic values ​​of the SQLite3 data structure, which can quickly and accurately locate the key and encryption and decryption functions, greatly improving the decryption efficiency.

[0045] (2) Enhanced evidence collection capabilities: The present invention provides a reliable technical means to help electronic data forensics personnel obtain key chat records and other data, providing strong support for case analysis.

[0046] (3) Reduce resource consumption. Compared with traditional brute force cracking methods, the present invention can reduce resource consumption and time cost through feature matching and memory parsing. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 Shown is a schematic diagram of a scene of an electronic device in an embodiment of the present invention;

[0048] Figure 2 Shown is a schematic diagram of method steps in one embodiment of the method for extracting data from a memory retrieval database based on SQLite3 feature values ​​of the present invention;

[0049] Figure 3 Shown is a schematic diagram of method steps in one embodiment of the method for extracting data from a memory retrieval database based on SQLite3 feature values ​​of the present invention;

[0050] Figure 4 Shown is a schematic diagram of method steps in one embodiment of the method for extracting data from a memory retrieval database based on SQLite3 feature values ​​of the present invention;

[0051] Figure 5 Shown is a flow chart of scanning a target process to locate a memory address in an embodiment of the data extraction method of a memory retrieval database based on SQLite3 feature values ​​of the present invention;

[0052] Figure 6 Shown is a structural schematic diagram of the first variable and the second variable in an embodiment of the method for extracting data from a memory retrieval database based on SQLite3 feature values ​​of the present invention;

[0053] Figure 7 Shown is a schematic diagram of method steps in one embodiment of the method for extracting data from a memory retrieval database based on SQLite3 feature values ​​of the present invention;

[0054] Figure 8 Shown is a schematic diagram of method steps in one embodiment of the method for extracting data from a memory retrieval database based on SQLite3 feature values ​​of the present invention;

[0055] Fig. 9 Shown is a structural schematic diagram of a data extraction system for a memory retrieval database based on SQLite3 feature values ​​in one embodiment of the present invention;

[0056] Fig.10 It is a schematic structural diagram of an electronic device of the present invention in one embodiment.

[0057] Component number description

[0058] Steps S202 to S208

[0059] Steps S302 to S308

[0060] Steps S402 to S406

[0061] Steps S702 to S708

[0062] Steps S802 to S806

[0063] 11. Cell Phone

[0064] 12 Tablet

[0065] 13 Laptop

[0066] 90 Data extraction system based on SQLite3 eigenvalue memory retrieval database

[0067] 91 Identification Module

[0068] 92 Parsing module

[0069] 93 Get Module

[0070] 94 Decryption module DETAILED DESCRIPTION

[0071] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0072] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0073] The following embodiments of the present invention provide a data extraction method for a memory retrieval database based on SQLite3 feature values, which can be applied to Figure 1 The electronic device shown. The electronic device described in the present invention may include a mobile phone 11 with a wireless charging function, a tablet computer 12, a laptop computer 13, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiment of the present invention does not impose any restrictions on the specific type of the electronic device.

[0074] For example, the electronic device may be a station (STAION, ST) in a WLAN with a wireless charging function, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with a wireless charging function, a computing device or other processing device, a computer, a laptop computer, a handheld communication device, a handheld computing device, and / or other devices for communicating on a wireless system and a next generation communication system, such as a mobile terminal in a 5G network, a mobile terminal in a future evolved Public Land Mobile Network (PLMN), or a mobile terminal in a future evolved Non-terrestrial Network (NTN).

[0075] For example, the electronic device can communicate with the network and other devices through wireless communication. The above wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobilecommunication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS can include Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), BeiDou navigation Satellite System (BDS), Quasi-Zenith Satellite System (QZSS) and / or Satellite Based Augmentation Systems (SBAS).

[0076] The technical solutions in the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0077] Specifically, see Figure 2 In one embodiment of the invention, the data extraction method of the memory retrieval database based on SQLite3 feature value of the present invention comprises the following steps:

[0078] Step S202, scanning the memory of the target process to identify the target feature value in the current SQLite3 database, and locating the memory address based on the target feature value;

[0079] Step S204, parsing the data structure of the SQLite3 database based on the memory address to obtain the first variable and the second variable;

[0080] Step S206, performing key location and extraction based on the first variable to obtain a target key, and performing address analysis and function location based on the second variable to obtain an encryption and decryption algorithm;

[0081] Step S208: decrypt the SQLite3 database in the target process memory based on the target key and the encryption / decryption algorithm to obtain target data.

[0082] It should be noted that, in this embodiment, the present invention provides a data extraction method for a memory retrieval database based on SQLite3 feature values, which can be specifically applied to data decryption, wherein, by analyzing different feature values ​​of the SQLite3 data structure in the memory, the variables storing the key and the encryption and decryption functions can be accurately located, thereby realizing the decryption of the database. Taking decryption as an example, the specific steps are as follows:

[0083] (1) Analysis of SQLite3 data structure: First, the data structure of the SQLite3 database in memory is analyzed in detail to determine the corresponding characteristic values, which include but are not limited to key data structures such as B-tree, page table, and table header. Specifically, the preset tags are analyzed to determine the characteristic value type in the current encrypted SQLite3 database. Correspondingly, the preset tags include status tags, page type identifiers, page header offsets, B-tree node pointers, and record formats and record data. Among them, B-tree: B-tree, a tree data structure used in databases and file systems, and page tables, specifically Page Table, which manages the structure of memory pages

[0084] (2) Memory scanning and feature matching: In the Windows operating system, the memory of the target process is scanned to identify the target feature value corresponding to the SQLite3 data structure in the current target process, so that the specific memory address can be located based on the target feature value.

[0085] (3) Key location and extraction: Based on the located SQLite3 data structure, further parse the variable storing the key therein, which specifically corresponds to the first variable, i.e., the pCodec variable, and read the address of the first variable through memory reading technology to locate the key and verify it to extract the target key.

[0086] (4) Identification of encryption and decryption algorithms: Based on the key extraction, a second variable is extracted using the same sampling method, and the second variable includes an xCodec variable. The encryption and decryption functions related to the xCodec variable are further retrieved to determine the specific encryption and decryption algorithm. Specifically, address analysis and function definition are performed based on the second variable to obtain the encryption and decryption algorithm.

[0087] (5) Database decryption: Use the extracted target key and the identified encryption and decryption algorithm to decrypt the encrypted SQLite3 database to obtain decrypted data, and perform verification and key information extraction based on the decrypted data to obtain the target data, wherein the target data stores key data for forensics, such as account information and transaction records.

[0088] Further, in one embodiment of the invention, if Figure 3 As shown, the method also includes defining characteristic values ​​in the SQLite3 database, specifically including the following steps:

[0089] Step S302, analyzing the data structure of the SQLite3 database in the memory to determine the characteristic value type, specifically analyzing the preset tag, the preset tag includes a status tag, a page type identifier, a page header offset, a B-tree node pointer, and a record format and record data;

[0090] Step S304, determining a database status characteristic value based on the status tag, wherein the database status includes an open state, a closed state, and a use state;

[0091] Step S306, determining a tag type characteristic value based on the page type identifier, wherein the page type identifier indicates a page type, and the page type includes a table data page, an index page, and a free page;

[0092] Step S308: determining a data type characteristic value based on the page header offset, the B-tree node pointer, the record format, and the record quantity.

[0093] It should be noted that, in this embodiment, when identifying the target feature value in the SQLite3 database, the data block matching the feature value type is extracted to obtain the target feature value. Therefore, it is necessary to first define the feature value in the SQLite3 database, that is, to analyze the B-tree structure, page table structure, etc. of the SQLite3 database, determine its feature value in the memory, and record these feature values ​​for subsequent memory scanning.

[0094] Specifically, the preset tags are specifically analyzed during the analysis, wherein the preset tags include status tags, page type identifiers, page header offsets, B-tree node pointers, and record formats and record data. Accordingly, these tags help us identify and distinguish different data structures in memory. Specifically, the page type identifier corresponds to: each SQLite3 page has an identifier at the beginning, which indicates the type of the page (such as table data page, index page, free page, etc.), which is specifically a characteristic value of a tag type, usually one byte long; the page header offset corresponds to: each SQLite3 page has a page header, which contains metadata about the page, and the offset in the page header shows the position where the record starts, which is specifically a characteristic value of a data type; and the B-tree node pointer is specifically: for the internal nodes of the B-tree, the page will contain pointers to child nodes, which are also characteristic values ​​of the data type and can help identify and traverse the structure of the database; as well as the record format and the number of records, wherein each page can store multiple records, and the page header will detail the record format (such as variable-length records) and the number of records, which are also characteristic values ​​of the data type and are crucial for understanding the storage layout of the page.

[0095] Among them, the database status characteristic value is determined based on the status tag, wherein the database status includes an open state, a closed state and a use state. It should be noted that, taking the database status characteristic value as an example, each database has a corresponding SQLite3 data structure in the memory, under which there is a characteristic value representing the current state, with a length of "4" bytes of integer. The main states include the database open state, with a characteristic value of "0xa029a697", the database closed state, with a characteristic value of "0x9f3c2d33", and the database use state, with a characteristic value of "0xf03b7906".

[0096] Further, in one embodiment of the invention, if Figure 4 As shown, scanning the memory of the target process to identify the target feature value in the current SQLite3 database, and locating the memory address based on the target feature value, specifically includes:

[0097] Step S402, scanning the entire memory of the target process byte by byte based on a preset memory scanning tool;

[0098] Step S404, during the scanning process, extracting the data block matching the feature value type to obtain the target feature value, and synchronously locating the memory address based on the target feature value;

[0099] Step S406: When matching with the characteristic value type, a preset pattern matching mechanism is used for matching.

[0100] It should be noted that, in this embodiment, Figure 5 As shown, it is a flowchart for scanning the target process to locate the memory address, wherein the memory is first scanned, specifically based on a preset memory scanning tool, the entire memory of the target process is scanned byte by byte, and features are matched during the scanning process, specifically the data blocks matching the feature value type are extracted to obtain the target feature value, wherein the preset pattern matching mechanism is used for matching with the feature value type, and at the same time, after obtaining the target feature value, the memory address is located based on the target feature value.

[0101] Further, in this embodiment, in the Windows operating system, a memory scanning tool is used to scan the target process, and the characteristic values ​​of the data structure in the SQLite3 database are matched to locate the relevant memory address, wherein the memory scanning tool (such as Mem_Scanner or WinDbg) used scans the entire memory space of the target process byte by byte, and matches according to the characteristic value types defined in the above embodiments, such as the standard header information of the database file (such as the "SQLite format 3\0" string), the page size, and a specific data structure layout, such as the node layout of the B-tree; or the file header or page structure characteristics of SQLite (such as the type identifier and the number of records in the page header). Once the corresponding characteristic value type is successfully matched, the memory scanning tool is used to record the corresponding memory address. In the scanning process, in order to improve the scanning efficiency and accuracy, a pattern matching mechanism (binary feature matching) can be used to accurately match these characteristic values. In addition, in actual application, a more advanced memory scanning tool can also analyze the virtual memory layout of the process and identify the memory pages that may store database information, thereby reducing the search range and improving the retrieval efficiency.

[0102] Specifically, taking the database status characteristic value as an example, these status values ​​are searched in the memory to distinguish the open state, closed state and use state of the database, and when the corresponding characteristic value is obtained, the location of the data structure of the characteristic value in the memory is found, that is, the memory address of the data structure, such as "0x00007FFA8BC70000". Among them, the process of scanning the memory and locating the memory address requires not only a deep understanding of the internal structure of the SQLite3 database, but also the use of memory scanning technology and tools to ensure that useful information can be effectively and accurately extracted from the huge memory data. In layman's terms, it can be understood as a method of finding information in the memory through a specific "data fingerprint".

[0103] Furthermore, in one embodiment of the invention, the data structure of the SQLite3 database is parsed based on the memory address to obtain the first variable and the second variable, specifically including: using a preset debugging tool in combination with the memory address to perform memory mapping and parsing to obtain a memory mapping; in the memory mapping, the first variable and the second variable are obtained according to the memory layout identification of the SQLite3 database, wherein the first variable includes a pCodec variable, and the second variable includes an xCodec variable.

[0104] It should be noted that, in this embodiment, Figure 6 As shown, it shows a structure diagram of the first variable and the second variable, wherein the first variable includes a pCodec variable, which is a key variable for storing a key, and the second variable includes an xCodec variable, which is a key variable for processing encryption and decryption. The two variables correspond to become important elements of forensics and encrypted data recovery. Specifically, once the memory address containing the first variable (pCodec variable) is located through a memory scanning tool (such as Mem_Scanner or WinDbg), the next step is to parse the data structure in this part of the memory to confirm the specific location of the key. Since the first variable (pCodec variable) and the second variable (xCodec variable) are obtained in the same way, this embodiment will take the first variable (pCodec variable) as an example for specific description.

[0105] Among them, firstly, a preset debugging tool is used to perform memory mapping and parsing in combination with the memory address to obtain a memory mapping. Specifically, a debugging tool (such as WinDbg or GDB) is used to map out the memory address area of ​​interest. Specifically, it can be achieved by creating a memory image of the process or directly accessing the memory space of a specific process in the debugger; then the pCodec variable is identified. Specifically, in the obtained memory mapping, the first variable (pCodec variable) is identified according to the memory layout of the SQLite database. Specifically, the source code or document of the SQLite database needs to be studied to understand the possible location and structure of the pCodec variable in the memory. Among them, since the acquisition method of the second variable (xCodec variable) is the same, it is not repeated here.

[0106] Furthermore, in one embodiment of the invention, the key positioning and extraction based on the first variable to obtain the target key specifically includes: reading the address of the first variable based on a preset memory editing tool to perform key positioning to obtain an initial key; and performing verification based on the initial key, wherein the encrypted data in the decryption database is decrypted using the initial key, and the successfully decrypted initial key is extracted as the target key.

[0107] It should be noted that, in this embodiment, after obtaining the first variable (pCodec variable), key location and extraction can be performed based on the first variable (pCodec variable) to obtain the target key, specifically, including "key location-key extraction and key verification", wherein,

[0108] ①, Key location: determine the specific memory address of the first variable (pCodec variable);

[0109] ②. Key extraction: Based on the memory editing tool (HxD), the specific memory address of the first variable (pCodec variable) is read to read the content and obtain the initial key;

[0110] ③. Key verification: Use the initial key to decrypt the encrypted data in the decryption database, and extract the successfully decrypted initial key as the target key.

[0111] It should be noted that, in this embodiment, once the specific memory address of the first variable (pCodec) is determined, the content of this address can be directly read using a memory editing tool (such as HxD) or a programming method (such as using Python's ctypes library). The read data includes the initial key used for database encryption, and in order to verify whether the extracted initial key is correct, the initial key can be used to try to decrypt the encrypted data in the database. If the decryption is successful, it proves that the initial key is extracted correctly and is used as the target key. Through the above steps ①, ② and ③, the key used to encrypt the SQLite database can be effectively extracted from the running program, which is of great significance to fields such as data forensics and security analysis. In terms of application, this process can be likened to finding a small keyword hidden in a paragraph in a specific chapter from a thick book.

[0112] Further, in one embodiment of the invention, if Figure 7 As shown, the address analysis and function location based on the second variable to obtain the encryption and decryption algorithm specifically includes the following steps:

[0113] Step S702, checking the pointer address of the second variable based on the debugging tool to obtain the encryption and decryption function address;

[0114] Step S704, performing a breakpoint operation based on the encryption and decryption function address to identify function call information and locate the function;

[0115] Step S706, after determining the function call information, disassemble the encryption and decryption function address based on a disassembly tool to obtain the encryption and decryption function assembly code;

[0116] Step S708, performing algorithm logic analysis and verification based on the encryption and decryption function assembly code to obtain the encryption and decryption algorithm, wherein the verification is performed using known data and the target key.

[0117] It should be noted that, in this embodiment, the second variable (xCodec variable) stores the index pointer of the corresponding encryption and decryption function, so that the second variable (xCodec variable) becomes the key node linking the database encryption mechanism and the actual execution code, specifically, including "pointer address analysis-encryption and decryption function positioning-disassembly code analysis-algorithm identification and verification", where,

[0118] I. Pointer address analysis: It is necessary to identify the pointer address stored in the second variable, which is usually a pointer to a function that is responsible for implementing encryption and decryption operations;

[0119] II. Locating the encryption and decryption functions: Once the memory address of the function is obtained, the next step is to breakpoint at that address and then monitor the calls of the function when the database performs encryption and decryption operations;

[0120] III. Disassembly code analysis: Use the disassembly tool to disassemble the memory address pointed to by the pointer and parse the assembly code of the function;

[0121] IV. Algorithm identification and verification: Based on the disassembled code, analyze the algorithm logic, confirm the encryption and decryption algorithm used, and reproduce the encryption and decryption process using known data and extracted keys.

[0122] It should be noted that, in this embodiment, using a debugging tool (such as WinDbg), the value of the second variable (xCodec variable) in the memory can be viewed to obtain the memory address of the encryption and decryption function, and after determining the memory address, monitor the call of the function when the database performs the encryption and decryption operation to confirm the function, and ensure that it is the code responsible for executing the encryption and decryption, and after parsing the assembly code of the function, by analyzing these codes as the specific implementation of the encryption and decryption operation, including the algorithm and operation logic used, confirm the encryption and decryption algorithm used (such as AES, RSA, etc.). This step is critical, because the correct identification of the algorithm is the prerequisite for the subsequent correct decryption of data, and verify the algorithm, and try to reproduce the encryption and decryption process in an independent environment, where, if encryption and decryption can be successfully performed, the encryption and decryption algorithm and the extracted target key, as well as the correctness of the memory address corresponding to the function are confirmed. Among them, through the above I-IV series of detailed analysis and verification steps, we can accurately determine the encryption and decryption algorithm used by the database, and provide necessary technical support for subsequent data recovery or security analysis. In terms of application, this process can be likened to unlocking a complex lock, which not only requires finding the key, but also requires clarifying how the key works with the lock.

[0123] Further, in one embodiment of the invention, if Figure 8 As shown, the decryption of the SQLite3 database in the target process memory based on the target key and the encryption and decryption algorithm to obtain the target data specifically includes the following steps:

[0124] Step S802, loading the encryption and decryption algorithm and configuring the target key in a secure decryption environment;

[0125] Step S804, decrypting the encrypted data block in the SQLite3 database based on the encryption and decryption algorithm and the target key to obtain decrypted data;

[0126] Step S806, performing verification and extracting key information based on the decrypted data to obtain the target data, wherein the key information at least includes account information and transaction records.

[0127] It should be noted that, in this embodiment, decryption and extraction of the SQLite3 database specifically includes "preparing the decryption environment - loading the encryption algorithm - configuring the key - performing the decryption operation - verifying the decrypted data - extracting the target data", where:

[0128] 1. Prepare the decryption environment: You need to set up a secure decryption environment to ensure that no data is leaked or destroyed during the decryption process;

[0129] 2. Load the encryption algorithm: load the identified encryption and decryption algorithm;

[0130] 3. Configure the key: configure the extracted target key into the decryption tool;

[0131] 4. Execute decryption operation: decrypt the database file or the encrypted data block in the database;

[0132] 5. Verify decrypted data: After decryption, verify the integrity and accuracy of the decrypted data;

[0133] 6. Extract target data: Confirm that the data has been successfully decrypted. The next step is to extract key information from it;

[0134] 7. Records and Reports: The decryption process and results should be recorded in detail.

[0135] It should be noted that, in this embodiment, setting up a secure decryption environment is usually performed in an isolated system or virtual machine to avoid potential security risks. The identified encryption and decryption algorithm is used. For example, if the algorithm is AES, then an AES decryption program or library needs to be prepared. These programs or libraries need to be able to accept the key and the data to be decrypted as input, and the format and length of the target key should match the encryption and decryption algorithm to ensure that it can be used correctly to decrypt the database file or the encrypted data block in the database. This usually involves reading the encrypted data and then applying the decryption algorithm and key to process it. The decryption process may take some time, depending on the size of the data and the complexity of the encryption. After decryption, verification is required. The data can be checked to be reasonable by comparing some known attributes of the decrypted data or by application logic. Finally, once it is confirmed that the data has been successfully decrypted, the next step is to extract key information from it, such as user account information, transaction records, etc., so that users can query and analyze the decrypted database, as well as document records and reports: the decryption process and results should be recorded in detail, including the tools and methods used and any key information found. These records are very important for legal proceedings, security analysis or subsequent audits in actual applications. Furthermore, the entire process from step 1 to step 7 applies the extracted key and the determined encryption and decryption algorithm to actual data recovery, thereby enabling the recovery and use of key data in the encrypted SQLite3 database. In layman's terms, this process can be regarded as using the correct key and lock knowledge to open a high-level security box and take out important documents from it.

[0136] An embodiment of the present application also provides a data extraction system for a memory retrieval database based on SQLite3 feature values. The data extraction system for a memory retrieval database based on SQLite3 feature values ​​can implement the data extraction method for a memory retrieval database based on SQLite3 feature values ​​described in the present application. However, the implementation device of the data extraction method for a memory retrieval database based on SQLite3 feature values ​​described in the present application includes but is not limited to the structure of the data extraction system for a memory retrieval database based on SQLite3 feature values ​​listed in the present embodiment. All structural deformations and replacements of the prior art made according to the principles of the present application are included in the protection scope of the present application.

[0137] See also Fig. 9 In one embodiment, this embodiment provides a data extraction system 90 for a memory retrieval database based on SQLite3 feature values, the system comprising:

[0138] An identification module 91 is used to scan the memory of the target process to identify the target feature value in the current SQLite3 database, and locate the memory address based on the target feature value;

[0139] A parsing module 92, configured to parse a data structure of an SQLite3 database based on the memory address to obtain a first variable and a second variable, wherein the first variable includes a pCodec variable and the second variable includes an xCodec variable;

[0140] An acquisition module 93, configured to locate and extract a key based on the first variable to obtain a target key, and to perform address analysis and function location based on the second variable to obtain an encryption and decryption algorithm;

[0141] The decryption module 94 is used to decrypt the SQLite3 database in the target process memory based on the target key and the encryption and decryption algorithm to obtain the target data.

[0142] Since the specific implementation of this embodiment corresponds to the aforementioned method embodiment, the same details will not be repeated here, and those skilled in the art should also understand that Fig. 9 The division of the modules in the embodiment is merely a division of logical functions, and in actual implementation, all or part of them can be integrated into one or more physical entities, and these modules can be implemented entirely in the form of software called by processing elements, or entirely in the form of hardware, or some modules can be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware.

[0143] In the several embodiments provided by the present invention, it should be understood that the disclosed system, device or method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules / units is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules or units, which can be electrical, mechanical or other forms.

[0144] The modules / units described as separate components may or may not be physically separated, and the components displayed as modules / units may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules / units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention. For example, the functional modules / units in the various embodiments of the present invention may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0145] Those of ordinary skill in the art should further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0146] The embodiment of the present invention also provides a computer-readable storage medium. A person of ordinary skill in the art can understand that all or part of the steps in the method for implementing the above embodiment can be completed by instructing the processor through a program, and the program can be stored in a computer-readable storage medium, and the storage medium is a non-transitory medium, such as a random access memory, a read-only memory, a flash memory, a hard disk, a solid-state hard disk, a magnetic tape, a floppy disk, an optical disc, and any combination thereof. The above storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state disk (SSD)), etc.

[0147] An embodiment of the present invention further provides an electronic device, which includes a processor and a memory.

[0148] The memory is used to store computer programs.

[0149] The memory includes: ROM, RAM, disk, USB flash drive, memory card or CD and other media that can store program codes.

[0150] The processor is connected to the memory and is used to execute the computer program stored in the memory so that the electronic device executes the above-mentioned data extraction method of the memory retrieval database based on the SQLite3 feature value.

[0151] Preferably, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0152] like Fig.10 As shown, the electronic device of the present invention is in the form of a general computing device. The components of the electronic device may include but are not limited to: one or more processors or processing units 101, a memory 102, and a bus 103 connecting different system components (including the memory 102 and the processing unit 101).

[0153] Bus 103 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0154] Electronic devices typically include a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device, including volatile and non-volatile media, removable and non-removable media.

[0155] The memory 102 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 1021 and / or cache memory 1022. The electronic device may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 1023 may be used to read and write non-removable, non-volatile magnetic media ( Fig.10 not shown, usually called a "hard drive"). Although Fig.10Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 103 via one or more data medium interfaces. The memory 102 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0156] A program / utility 1024 having a set (at least one) of program modules 10241 may be stored, for example, in the memory 102, such program modules 10241 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 10241 generally perform the functions and / or methods of the embodiments described herein.

[0157] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, displays, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via input / output (I / O) interface 104. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapter 105. Fig.10 As shown, the network adapter 105 communicates with other modules of the electronic device via the bus 103. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0158] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A method for extracting data from a memory retrieval database based on SQLite3 feature values, characterized in that: include: Defining a characteristic value in an SQLite3 database specifically includes: analyzing a data structure of the SQLite3 database in memory to determine a characteristic value type, specifically analyzing a preset tag, wherein the preset tag includes a state tag, a page type identifier, a page header offset, a B-tree node pointer, a record format, and record data, wherein a database state characteristic value is determined based on the state tag, wherein the database state includes an open state, a closed state, and a use state; determining a tag type characteristic value based on the page type identifier, wherein the page type identifier indicates a page type, wherein the page type includes a table data page, an index page, and a free page; determining a data type characteristic value based on the page header offset, the B-tree node pointer, the record format, and the number of records; Scan the memory of the target process to identify the target feature value in the current SQLite3 database, and locate the memory address based on the target feature value; Parsing a data structure of an SQLite3 database based on the memory address to obtain a first variable and a second variable specifically includes: using a preset debugging tool to perform memory mapping and parsing in combination with the memory address to obtain a memory mapping; in the memory mapping, identifying the first variable and the second variable according to the memory layout of the SQLite3 database; Based on the first variable, key location and extraction are performed to obtain a target key, and based on the second variable, address analysis and function location are performed to obtain an encryption and decryption algorithm; The SQLite3 database in the target process memory is decrypted based on the target key and the encryption and decryption algorithm to obtain the target data.

2. The method for extracting data from a memory retrieval database based on SQLite3 feature values ​​according to claim 1, characterized in that: Scanning the memory of the target process to identify the target feature value in the current SQLite3 database, and locating the memory address based on the target feature value, specifically includes: Scanning the entire memory of the target process byte by byte based on a preset memory scanning tool; During the scanning process, the data block matching the feature value type is extracted to obtain the target feature value, and the memory address is simultaneously located based on the target feature value, wherein: When matching with the characteristic value type, a preset pattern matching mechanism is used for matching.

3. The data extraction method of the memory retrieval database based on SQLite3 feature value according to claim 2 is characterized in that: The first variable includes a pCodec variable, and the second variable includes an xCodec variable.

4. The method for extracting data from a memory retrieval database based on SQLite3 feature values ​​according to claim 3, characterized in that: The performing key location and extraction based on the first variable to obtain the target key specifically includes: Based on a preset memory editing tool, the address of the first variable is read to locate the key to obtain an initial key; Verification is performed based on the initial key, wherein the encrypted data in the decryption database is decrypted using the initial key, and the successfully decrypted initial key is extracted as the target key.

5. The method for extracting data from a memory retrieval database based on SQLite3 feature values ​​according to claim 4, characterized in that: The performing address analysis and function location based on the second variable to obtain an encryption and decryption algorithm specifically includes: Checking the pointer address of the second variable based on the debugging tool to obtain the encryption and decryption function address; Perform breakpoint operation based on the encryption and decryption function address to identify function call information and locate the function; After determining the function call information, the encryption and decryption function address is disassembled based on a disassembly tool to obtain the encryption and decryption function assembly code; Algorithm logic analysis and verification are performed based on the encryption and decryption function assembly code to obtain the encryption and decryption algorithm, wherein the verification is performed using known data and the target key.

6. The method for extracting data from a memory retrieval database based on SQLite3 feature values ​​according to claim 5, characterized in that: Decrypting the SQLite3 database in the target process memory based on the target key and the encryption and decryption algorithm to obtain the target data specifically includes: Load the encryption and decryption algorithm and configure the target key in a secure decryption environment; Decrypting the encrypted data block in the SQLite3 database based on the encryption and decryption algorithm and the target key to obtain decrypted data; The target data is obtained by performing verification and extracting key information based on the decrypted data, wherein the key information includes at least account information and transaction records.

7. A data extraction system based on an in-memory retrieval database of SQLite3 feature values, characterized in that: include: An identification module is used to scan the memory of the target process to identify the target characteristic value in the current SQLite3 database, and locate the memory address based on the target characteristic value, wherein defining the characteristic value in the SQLite3 database specifically includes: analyzing the data structure of the SQLite3 database in the memory to determine the characteristic value type, specifically analyzing the preset label, the preset label includes a state label, a page type identifier, a page header offset, a B-tree node pointer, and a record format and record data, wherein the database state characteristic value is determined based on the state label, wherein the database state includes an open state, a closed state, and a use state; determining the label type characteristic value based on the page type identifier, the page type identifier indicates the page type, and the page type includes a table data page, an index page, and a free page; determining the data type characteristic value based on the page header offset, the B-tree node pointer, the record format, and the number of records; A parsing module, configured to parse a data structure of an SQLite3 database based on the memory address to obtain a first variable and a second variable, specifically comprising using a preset debugging tool in combination with the memory address to perform memory mapping and parsing to obtain a memory mapping; in the memory mapping, the first variable and the second variable are obtained according to the memory layout identification of the SQLite3 database, wherein the first variable includes a pCodec variable and the second variable includes an xCodec variable; An acquisition module, configured to locate and extract a key based on the first variable to obtain a target key, and to perform address analysis and function location based on the second variable to obtain an encryption and decryption algorithm; The decryption module is used to decrypt the SQLite3 database in the target process memory based on the target key and the encryption and decryption algorithm to obtain the target data.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for extracting data from a memory retrieval database based on SQLite3 feature values ​​as described in any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: The electronic device comprises: a processor and a memory; wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the electronic device executes the data extraction method of the memory retrieval database based on the SQLite3 feature value as described in any one of claims 1 to 6.

Images