Break SQLcipher by modifying libsqlcipher.so? I was trying to extract data from an Android app which uses SQLcipher. SQLcipher is an extension of SQLite that encrypts database files with 256-bit AES.
Most of the application code is compressed and protected with some sort of anti-reverse-engineering stuff, so no source code and no debuggers. However, the SQLcipher binary lies in lib/libsqlcipher.so. I'm curious if I can extract the encryption key simply by swapping libsqlcipher.so(e.g. modify sqlite3_key function so that it logs the encryption key to file). The plan is to compile my own version of libsqlcipher.so, repack APK, and run it on a device.
Will this method work as expected? It sounds too easy to be true:)
I ended up using Frida to hook sqlite3_key dynamically and got the encryption key. Simple enough.

Brief steps I took:

Setup Frida to connect to your Android device
On the Python end, attach to target app and load JavaScript.

import frida

# Attach to target app
session = frida.get_usb_device().attach(&quot;cn.com.company_name.app_name&quot;)

# Load Javascript from a separate file. 
with open(&quot;script.js&quot;, &quot;r&quot;) as file:
  script = session.create_script(file.read())
  script.load()

# Print any messages that Javascript send back
script.on(&quot;message&quot;, print)


On the Javascript end, hook into sqlite3_key and read encryption key from memory:

// Locate the SQLCipher library
var sqlcipher = Process.findModuleByName(&quot;libsqlcipher.so&quot;);

// Locate the `sqlite3_key` function call
var func = sqlcipher.findExportByName(&quot;sqlite3_key&quot;);

// Hook into it
Interceptor.attach(func, {
    onEnter: function (args) {
        // The encryption key is the second argument to `sqlite3_key`
        var key_ptr = args[1];

        // read 32 bytes worth of data(256-bit key)
        var key = key_ptr.readByteArray(32);

        // And send it back to Python
        send(&quot;Got key&quot;, key);
    }
});