[discussion] where does snapchat store photos/videos?

[trojanteacher]

found this script here: h t t p s : / / gist.github.com/jamescmartinez/6913761

works perfectly!

#!/usr/bin/env ruby
 
require 'openssl'
 
data = File.open('blob', 'r:ASCII-8BIT').read
c = OpenSSL::Cipher.new('AES-128-ECB')
c.decrypt
c.key = 'M02cnQ51Ji97vwT4'
o = ''.force_encoding('ASCII-8BIT')
data.bytes.each_slice(16) { |s| o += c.update(s.map(&:chr).join) }
o += c.final
File.open('blob.jpg', 'w') { |f| f.write(o) }

Do you have to run that as a ruby script? Or just a batch file? That is what I'm no sure about.

 

[polobunny]

You guys know we have a wonderful Xposed module called Keepchat that works wonderfully and is currently maintained by Ramis here?

Sources are also available, if you want to check.

 

[manjubaba123]

decryption with ruby

Do you have to run that as a ruby script? Or just a batch file? That is what I'm no sure about.

i do it like this:

$ chmod +x decrypt.rb
$ ruby decrypt.rb

i don't know if it is necessary to start it with ruby but it works.

 

[quantemplation]

You guys know we have a wonderful Xposed module called Keepchat that works wonderfully and is currently maintained by Ramis here?

Sources are also available, if you want to check.

I finally caved and installed this. It works fabulously. The only thing I'd add is to make the filename start with the display name instead of the username. But I'm not too upset about the way it is anyway. I'm sure I could make a tasker function switch the names, but it'd be a hassle that I'm not worried about. Thanks for the push; I'd heard of it but held back.

 

[polobunny]

I finally caved and installed this. It works fabulously. The only thing I'd add is to make the filename start with the display name instead of the username. But I'm not too upset about the way it is anyway. I'm sure I could make a tasker function switch the names, but it'd be a hassle that I'm not worried about. Thanks for the push; I'd heard of it but held back.

I understand that if you're not running Xposed framework or using Android 4.4 in ART mode then it seems like a bit more painful than using an app, but the whole process is so transparent that it would be silly to ignore it otherwise.

 

[thesquealunit]

Question:

I'm trying to decrypt and view some snaps I opened on my iPad. I found (what I think are) the encrypted snaps stored in root/var/mobile/applications/71A.../Library/Caches/com.toyopagroup.picaboo/fsCachedData. Only some of them would decrypt using aes.online-domain-tools and none would open after renaming the .bat to .jpg. And I'm not literate enough to use y'alls fancy scripts to try the same.

Any ideas?

 

[trojanteacher]

I'm trying to decrypt and view some snaps I opened on my iPad. I found (what I think are) the encrypted snaps stored in root/var/mobile/applications/71A.../Library/Caches/com.toyopagroup.picaboo/fsCachedData. Only some of them would decrypt using aes.online-domain-tools and none would open after renaming the .bat to .jpg. And I'm not literate enough to use y'alls fancy scripts to try the same.

Any ideas?

I'm with you, I realize many here use LINUX, but I use Windows 7. What kind of DOS commands would I do to create these decryptions? I've attempted to run ruby scripts, but I'm sure I'm doing it wrong. If anyone is willing to help us out with this, it would be much appreciated.

 

[mvmacd]

I'm trying to decrypt and view some snaps I opened on my iPad. I found (what I think are) the encrypted snaps stored in root/var/mobile/applications/71A.../Library/Caches/com.toyopagroup.picaboo/fsCachedData. Only some of them would decrypt using aes.online-domain-tools and none would open after renaming the .bat to .jpg. And I'm not literate enough to use y'alls fancy scripts to try the same.

Any ideas?

I suggest downloading Virtual Box on Windows, and also the Ubuntu disk image.
Point the virtual CD drive to the iso and you can run Linux inside Windows.

Swiped from my Nexus 10 using xda-developers app

 

[serstylz2]

I managed to decrypt a SnapChat. It was a relatively simple process.

1. Load the snapchat in the app, but don't view it.
2. Copy the .nomedia file from the "/data/data/com.snapchat.android/cache/received_image_snaps/" to your SD card.
3. This part you may be able to do on the phone but I emailed the file to myself so I could mess with it on my desktop computer. Make a copy of this file just in case.
4. Go to http://aes.online-domain-tools.com/. Change the input type to "file", upload the picture, set function to "AES", set mode to "ECB". CAUTION: It says on the website that data is transmitted over their network UNENCRYPTED!!! So be careful!
5. Using the key Xzanthurus provided, "M02cnQ51Ji97vwT4", paste that into the "key" input area on the site. Press "decrypt".
6. Once decrypted, download that as a binary file.
7. Change the extension to ".jpg" instead of ".dat".

There's your picture! (assuming you did everything correctly lol).

Eric

EDIT: For more information on getting the actual key: click here.

Snapchat must have updated to overcome this woraround, i am getting:

"Decryption failed. Provided encrypted text is not valid."

 

[Cloudlin]

I am getting decryption failed too.
I went ahead and thoroughly read this through h t t p s://kivikakk.ee/2013/05/10/snapchat.html"]https://kivikakk.ee/2013/05/10/snapchat.html
and decompiled the latest snapchat version 4.1.07.
Found this in com.snapchat.android.util.crypto named as "SnapEncryptionAlgorithm.java"

package com.snapchat.android.util.crypto;

import com.snapchat.android.Timber;
import com.snapchat.android.util.AnalyticsUtils;
import com.snapchat.android.util.crypto.EncryptionAlgorithm;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

public class SnapEncryptionAlgorithm implements EncryptionAlgorithm {

public static String a = "M02cnQ51Ji97vwT4";
private String b;


public SnapEncryptionAlgorithm(String var1) {
if(var1 == null) {
throw new NullPointerException("key cannot be null");
} else {
this.b = var1;
}
}

public byte[] a(byte[] var1) {
try {
Cipher var3 = Cipher.getInstance("AES/ECB/PKCS5Padding");
var3.init(2, new SecretKeySpec(this.b.getBytes(), "AES"));

try {
byte[] var6 = var3.doFinal(var1);
return var6;
} catch (OutOfMemoryError var7) {
System.gc();
byte[] var5 = var3.doFinal(var1);
return var5;
}
} catch (Throwable var8) {
if(Timber.a()) {
throw new RuntimeException(var8.getMessage());
} else {
AnalyticsUtils.a("SnapEncryptionAlgorithm.decrypt failed", var8);
return null;
}
}
}

public byte[] b(byte[] var1) {
try {
Cipher var3 = Cipher.getInstance("AES/ECB/PKCS5Padding");
var3.init(1, new SecretKeySpec(this.b.getBytes(), "AES"));

try {
byte[] var6 = var3.doFinal(var1);
return var6;
} catch (OutOfMemoryError var7) {
System.gc();
byte[] var5 = var3.doFinal(var1);
return var5;
}
} catch (Throwable var8) {
if(Timber.a()) {
throw new RuntimeException(var8.getMessage());
} else {
AnalyticsUtils.a("SnapEncryptionAlgorithm.encrypt failed", var8);
return null;
}
}
}
}

Not entirely sure what to make of it, but it seems to me that there is another private key a long with the original public key involved in the encryption process? Correct me if I'm wrong.
If anyone wants to poke around with the decompiled jar file I have uploaded it. You can extract it with winrar.

 

[xnotte]

I want to recover the deleted .nomedia files, that are deleted by snapchat after viewed. They have to be in memory still if there's no overwriting in that sector.

My problem it's the Hex Signature key. I need to have a Signature key to customize the recovery programs. Anyone can tell me the signature key of the .nomedia file type ?

 

[icewewe]

I want to recover the deleted .nomedia files, that are deleted by snapchat after viewed. They have to be in memory still if there's no overwriting in that sector.

My problem it's the Hex Signature key. I need to have a Signature key to customize the recovery programs. Anyone can tell me the signature key of the .nomedia file type ?

xnotte: the files are encrypted using AES-ECB, so the contents is random. It is unlikely that the file signature will remain constant. Additionally, reading your phone's flash memory to find deleted .nomedia files will significantly increase the wear-and-tear on the NAND, potentially shortening its lifespan. I would not recommend doing that.

You can use inotify to copy the .nomedia file when it is received by snapchat. Functions to use inotify are available in the android.os.FileObserver class. If you copy the file to the SD card before it is deleted you can decrypt it later using the techniques described previously in this thread.

 

[FreeDee]

Snapchat must have updated to overcome this woraround, i am getting:

"Decryption failed. Provided encrypted text is not valid."

Still works for me (latest version 4.1.07 as of 4/28/2014)

 

[Masterbigmak]

how to get image

Okay folks for me on the Moto X rooted and updated snapchat location for .nomedia is "\data\data\com.snapchat.android\cache\received_image_snaps" was unable to move the .jpg.nomedia files to desktop. But used share email method and downloaded them. Now when change the file from ".jpg.nomedia" to just ".jpg" when opened with picture viewer their is no image, so it is encrypted. Now I need help I using windows and need guidance on how to de crypt the file to view it? Windows 7 64X OS.

 

[ablunt75]

stolen snaps

I suggest downloading Virtual Box on Windows, and also the Ubuntu disk image.
Point the virtual CD drive to the iso and you can run Linux inside Windows.

Swiped from my Nexus 10 using xda-developers app

hello I was needing some assistance with some snapchats I removed from an htc one from the dumpster app
they now reside on a windows 7 computer and I am having a hard time decrypting them

thanks in advance
the novice
ablunt75

 

[sd_tib]

I went through the entire thread, and I tried what 3ric15 had posted on page 6 but it still gave me an error when trying to open the file after i downloaded the binary file.
Help?

 

[clownage]

so does anybody know how to view these nomedia files ?
pm please if we are not allowed to talk about it lol

 

[jing713]

seems that I don't have the 'data/com.snapchat.android/cache/received_image_snaps' file on my phone.

I have the 'received_video_snaps' but no received image snaps...

Have they patched this out?

 

[Sinyc]

seems that I don't have the 'data/com.snapchat.android/cache/received_image_snaps' file on my phone.

I have the 'received_video_snaps' but no received image snaps...

Have they patched this out?

Still there for me. Also looks like http://aes.online-domain-tools.com/ is down...

 

[danny1013]

I've seen it asked a couple of times in this thread but not answered. How do I go about doing this with a video? I already have the nomedia file saved on my computer but if I try to run it through that decryption link the file I end up with simply doesn't play. I have been trying to figure this out for a week now. Can anyone help me out?

Edit: I got it to open with VLC but it's just a blank green screen