irsl / huawei-hisuite-kobackupciphertool

Tool to encrypt/decrypt backup packages created by Huawei Hisuite.

KobackupCipherTool

This is the result of my reverse engineering effort of the Huawei Kobackup application. Kobackup is a backend component of Hisuite, an app running on Android handsets.

You can use this tool to decrypt backup packages created by Hisuite and also to craft backup packages yourself.

Examples:

java irsl.CheckMsgV3Tool com.amazon.mShop.android.shopping.tar 12345678xX df264714a68a9224fef4302b29f8eea7ac11f5baada015a55b6e7f43190ba9f379c89c57d17d4eb1df0259c24c56b045dacc39a45275ea9be3b4d465f57583b3
java irsl.BackupSecurityV3DecryptionTool setting.db 12345678xX ca8ae6026225e3fc04cab5287ab84179705bb8216463d2f843bdc8ebb9c02128e0fbc0ba76d282b3df46db45c9cdfcc6 setting.db.clear
java irsl.BackupSecurityV3DecryptionTool wifiConfig.db 12345678xX 1ffeee986ed96ac3177888ab8899bfe0b9a46820cea632dc44658557164255b8952dd7ff156bb8fa26ca1a03279350f4 wifiConfig.db.clear
java irsl.BackupSecurityV3DecryptionTool com.amazon.mShop.android.shopping.tar 12345678xX cc34f2df1066e4125019b227e2cb01e3d08878f8ac1bb3c6fd5e7b54f715520be87ee9ada5945646260619fee3051911 com.amazon.mShop.android.shopping.tar.tar

huawei-hisuite-kobackupciphertool's Issues

checkMsgV3 has been upgraded to two segments of 128 bytes

Device: HUAWEI Mate 10
Version: ALP-AL00 10.0.0.156(C00E156R1P4)

Huawei Backup Version: 10.1.1.715
Download Link: https://apkcombo.com/huawei-backup/com.huawei.KoBackup/

Example:

    <column name="checkMsgV3">
      <value String="177a9105e33b3352842d640f91f783231973a62d25149268086eebfaf4039254ecae3a287d68766f40c7d3f15114e2ee38851e733e232f1e543a1937d78836a1_73291f608d91974c4d05914d41db51b1188cfdf9b40cad8fa9ae0ef2dc48f720561fb605e394a019c0c6e939b5316eef1e871c28589579ed9c4facec324b7332"/>
    </column>

How to Use your tool

Hello irsl,

i want to decrypt my hisuite backup with your tool. But i dont know how.

can you help?

i hae got an folder with the crypted data. There is an "backup_record.db" File and more folders like "media" or "backupFiles1".

greets from germany

Bruno

How to view the decrypted .db file

RT, I use SQ Lite to open it, but an error is reported, what software can I use to view the decrypted .db file?

decrypted file report an error "The compressed file format is unknown or the data is corrupted"

how to get the checkmsgv3 of a tar file with null password?