I'm exploring a database from a third-party application and I was wondering if it is possible to infer how to decode a BLOB in a SQLite database if you don't know what is stored inside the BLOB?
Is there any way or are there tools to solve this?
Add a comment
|
3 Answers
Is there any way or are there tools to solve this?
A BLOB is binary data. There are ways to reconstruct the data format (these reverse engineering methods are related to those you use for deciphering unknown file formats), but without further information what is stored in the binary BLOB it is rather difficult, so I can only give some vague hints:
- think about: if you were the programmer to encode the data that is stored in the BLOB - how would you do it? Often the way that is used is similar
- look at the first bytes of the data - often it tells what file format it could be/is (there are documentations of those "magic numbers" for many file formats available); also don't forget to look whether the data could be compressed (i. e. look for zlib header, since zlib is often used for compression)
- if legal (depends on your country), it is often helpful to apply reverse engineering tools like IDA Pro or if not available a good debugger to have a look what the program does with the BLOB data after reading
1 Comment
Bart Jacobs
It's not the answer I wished for, but thanks for the valuable and helpful information! I now know what to do next. Thanks, Nubok!
use
sqlite3 db.sqlite 'select writefile('data.bin', value) from Record limit 1;'
(assuming value volumn contains type BLOB, like in IndexedDB)
then you can print contents of this file with cat data.bin
