Break SQLcipher by modifying libsqlcipher.so?
I ended up using Frida to hook sqlite3_key dynamically and got the encryption key. Simple enough.

Brief steps I took:

Setup Frida to connect to your Android device
On the Python end, attach to target app and load JavaScript.

import frida

# Attach to target app
session = frida.get_usb_device().attach(&quot;cn.com.company_name.app_name&quot;)

# Load Javascript from a separate file. 
with open(&quot;script.js&quot;, &quot;r&quot;) as file:
  script = session.create_script(file.read())
  script.load()

# Print any messages that Javascript send back
script.on(&quot;message&quot;, print)


On the Javascript end, hook into sqlite3_key and read encryption key from memory:

// Locate the SQLCipher library
var sqlcipher = Process.findModuleByName(&quot;libsqlcipher.so&quot;);

// Locate the `sqlite3_key` function call
var func = sqlcipher.findExportByName(&quot;sqlite3_key&quot;);

// Hook into it
Interceptor.attach(func, {
    onEnter: function (args) {
        // The encryption key is the second argument to `sqlite3_key`
        var key_ptr = args[1];

        // read 32 bytes worth of data(256-bit key)
        var key = key_ptr.readByteArray(32);

        // And send it back to Python
        send(&quot;Got key&quot;, key);
    }
});