[discussion] where does snapchat store photos/videos?

Search This thread

trojanteacher

Member
Nov 4, 2013
9
0
found this script here: h t t p s : / / gist.github.com/jamescmartinez/6913761

works perfectly!

Code:
#!/usr/bin/env ruby
 
require 'openssl'
 
data = File.open('blob', 'r:ASCII-8BIT').read
c = OpenSSL::Cipher.new('AES-128-ECB')
c.decrypt
c.key = 'M02cnQ51Ji97vwT4'
o = ''.force_encoding('ASCII-8BIT')
data.bytes.each_slice(16) { |s| o += c.update(s.map(&:chr).join) }
o += c.final
File.open('blob.jpg', 'w') { |f| f.write(o) }

Do you have to run that as a ruby script? Or just a batch file? That is what I'm no sure about.
 

polobunny

Senior Member
Oct 25, 2011
6,223
2,311
Montreal
You guys know we have a wonderful Xposed module called Keepchat that works wonderfully and is currently maintained by Ramis here?

Sources are also available, if you want to check.
 
  • Like
Reactions: quantemplation

quantemplation

Senior Member
Feb 28, 2013
117
60
Richmond, VA
You guys know we have a wonderful Xposed module called Keepchat that works wonderfully and is currently maintained by Ramis here?

Sources are also available, if you want to check.

I finally caved and installed this. It works fabulously. The only thing I'd add is to make the filename start with the display name instead of the username. But I'm not too upset about the way it is anyway. I'm sure I could make a tasker function switch the names, but it'd be a hassle that I'm not worried about. Thanks for the push; I'd heard of it but held back.
 

polobunny

Senior Member
Oct 25, 2011
6,223
2,311
Montreal
I finally caved and installed this. It works fabulously. The only thing I'd add is to make the filename start with the display name instead of the username. But I'm not too upset about the way it is anyway. I'm sure I could make a tasker function switch the names, but it'd be a hassle that I'm not worried about. Thanks for the push; I'd heard of it but held back.

I understand that if you're not running Xposed framework or using Android 4.4 in ART mode then it seems like a bit more painful than using an app, but the whole process is so transparent that it would be silly to ignore it otherwise. :)
 

thesquealunit

New member
Jan 16, 2014
1
0
Question:

I'm trying to decrypt and view some snaps I opened on my iPad. I found (what I think are) the encrypted snaps stored in root/var/mobile/applications/71A.../Library/Caches/com.toyopagroup.picaboo/fsCachedData. Only some of them would decrypt using aes.online-domain-tools and none would open after renaming the .bat to .jpg. And I'm not literate enough to use y'alls fancy scripts to try the same.

Any ideas?
 

trojanteacher

Member
Nov 4, 2013
9
0
I'm trying to decrypt and view some snaps I opened on my iPad. I found (what I think are) the encrypted snaps stored in root/var/mobile/applications/71A.../Library/Caches/com.toyopagroup.picaboo/fsCachedData. Only some of them would decrypt using aes.online-domain-tools and none would open after renaming the .bat to .jpg. And I'm not literate enough to use y'alls fancy scripts to try the same.

Any ideas?

I'm with you, I realize many here use LINUX, but I use Windows 7. What kind of DOS commands would I do to create these decryptions? I've attempted to run ruby scripts, but I'm sure I'm doing it wrong. If anyone is willing to help us out with this, it would be much appreciated.
 

mvmacd

Senior Member
Nov 2, 2010
867
124
Massachusetts
I'm trying to decrypt and view some snaps I opened on my iPad. I found (what I think are) the encrypted snaps stored in root/var/mobile/applications/71A.../Library/Caches/com.toyopagroup.picaboo/fsCachedData. Only some of them would decrypt using aes.online-domain-tools and none would open after renaming the .bat to .jpg. And I'm not literate enough to use y'alls fancy scripts to try the same.

Any ideas?

I suggest downloading Virtual Box on Windows, and also the Ubuntu disk image.
Point the virtual CD drive to the iso and you can run Linux inside Windows.

Swiped from my Nexus 10 using xda-developers app
 

serstylz2

Senior Member
Feb 10, 2009
154
1
I managed to decrypt a SnapChat. It was a relatively simple process.

1. Load the snapchat in the app, but don't view it.
2. Copy the .nomedia file from the "/data/data/com.snapchat.android/cache/received_image_snaps/" to your SD card.
3. This part you may be able to do on the phone but I emailed the file to myself so I could mess with it on my desktop computer. Make a copy of this file just in case.
4. Go to http://aes.online-domain-tools.com/. Change the input type to "file", upload the picture, set function to "AES", set mode to "ECB". CAUTION: It says on the website that data is transmitted over their network UNENCRYPTED!!! So be careful!
5. Using the key Xzanthurus provided, "M02cnQ51Ji97vwT4", paste that into the "key" input area on the site. Press "decrypt".
6. Once decrypted, download that as a binary file.
7. Change the extension to ".jpg" instead of ".dat".

There's your picture! (assuming you did everything correctly lol).

Eric

EDIT: For more information on getting the actual key: click here.

Snapchat must have updated to overcome this woraround, i am getting:

"Decryption failed. Provided encrypted text is not valid."
 

Cloudlin

New member
Aug 12, 2009
3
0
I am getting decryption failed too.
I went ahead and thoroughly read this through h t t p s://kivikakk.ee/2013/05/10/snapchat.html"]https://kivikakk.ee/2013/05/10/snapchat.html
and decompiled the latest snapchat version 4.1.07.
Found this in com.snapchat.android.util.crypto named as "SnapEncryptionAlgorithm.java"

package com.snapchat.android.util.crypto;

import com.snapchat.android.Timber;
import com.snapchat.android.util.AnalyticsUtils;
import com.snapchat.android.util.crypto.EncryptionAlgorithm;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

public class SnapEncryptionAlgorithm implements EncryptionAlgorithm {

public static String a = "M02cnQ51Ji97vwT4";
private String b;


public SnapEncryptionAlgorithm(String var1) {
if(var1 == null) {
throw new NullPointerException("key cannot be null");
} else {
this.b = var1;
}
}

public byte[] a(byte[] var1) {
try {
Cipher var3 = Cipher.getInstance("AES/ECB/PKCS5Padding");
var3.init(2, new SecretKeySpec(this.b.getBytes(), "AES"));

try {
byte[] var6 = var3.doFinal(var1);
return var6;
} catch (OutOfMemoryError var7) {
System.gc();
byte[] var5 = var3.doFinal(var1);
return var5;
}
} catch (Throwable var8) {
if(Timber.a()) {
throw new RuntimeException(var8.getMessage());
} else {
AnalyticsUtils.a("SnapEncryptionAlgorithm.decrypt failed", var8);
return null;
}
}
}

public byte[] b(byte[] var1) {
try {
Cipher var3 = Cipher.getInstance("AES/ECB/PKCS5Padding");
var3.init(1, new SecretKeySpec(this.b.getBytes(), "AES"));

try {
byte[] var6 = var3.doFinal(var1);
return var6;
} catch (OutOfMemoryError var7) {
System.gc();
byte[] var5 = var3.doFinal(var1);
return var5;
}
} catch (Throwable var8) {
if(Timber.a()) {
throw new RuntimeException(var8.getMessage());
} else {
AnalyticsUtils.a("SnapEncryptionAlgorithm.encrypt failed", var8);
return null;
}
}
}
}

Not entirely sure what to make of it, but it seems to me that there is another private key a long with the original public key involved in the encryption process? Correct me if I'm wrong.
If anyone wants to poke around with the decompiled jar file I have uploaded it. You can extract it with winrar.
 

Attachments

  • Snapchat_v4.1.07_decompiled.jar
    2.2 MB · Views: 303

xnotte

Member
Jun 15, 2010
25
1
I want to recover the deleted .nomedia files, that are deleted by snapchat after viewed. They have to be in memory still if there's no overwriting in that sector.

My problem it's the Hex Signature key. I need to have a Signature key to customize the recovery programs. Anyone can tell me the signature key of the .nomedia file type ?
 

icewewe

Member
Jan 27, 2010
41
10
I want to recover the deleted .nomedia files, that are deleted by snapchat after viewed. They have to be in memory still if there's no overwriting in that sector.

My problem it's the Hex Signature key. I need to have a Signature key to customize the recovery programs. Anyone can tell me the signature key of the .nomedia file type ?

xnotte: the files are encrypted using AES-ECB, so the contents is random. It is unlikely that the file signature will remain constant. Additionally, reading your phone's flash memory to find deleted .nomedia files will significantly increase the wear-and-tear on the NAND, potentially shortening its lifespan. I would not recommend doing that.

You can use inotify to copy the .nomedia file when it is received by snapchat. Functions to use inotify are available in the android.os.FileObserver class. If you copy the file to the SD card before it is deleted you can decrypt it later using the techniques described previously in this thread.
 

Masterbigmak

New member
Sep 29, 2012
1
0
Everett
how to get image

Okay folks for me on the Moto X rooted and updated snapchat location for .nomedia is "\data\data\com.snapchat.android\cache\received_image_snaps" was unable to move the .jpg.nomedia files to desktop. But used share email method and downloaded them. Now when change the file from ".jpg.nomedia" to just ".jpg" when opened with picture viewer their is no image, so it is encrypted. Now I need help I using windows and need guidance on how to de crypt the file to view it? Windows 7 64X OS.
 

ablunt75

New member
May 6, 2014
1
0
stolen snaps

I suggest downloading Virtual Box on Windows, and also the Ubuntu disk image.
Point the virtual CD drive to the iso and you can run Linux inside Windows.

Swiped from my Nexus 10 using xda-developers app

hello I was needing some assistance with some snapchats I removed from an htc one from the dumpster app
they now reside on a windows 7 computer and I am having a hard time decrypting them

thanks in advance
the novice
ablunt75
 

sd_tib

New member
May 13, 2014
1
0
I went through the entire thread, and I tried what 3ric15 had posted on page 6 but it still gave me an error when trying to open the file after i downloaded the binary file.
Help?
 

clownage

Senior Member
Jul 14, 2010
105
0
so does anybody know how to view these nomedia files ?
pm please if we are not allowed to talk about it lol
 

jing713

Senior Member
Jan 29, 2011
59
3
Sydney
seems that I don't have the 'data/com.snapchat.android/cache/received_image_snaps' file on my phone.

I have the 'received_video_snaps' but no received image snaps...

Have they patched this out?

:confused: :(
 

danny1013

New member
Jun 12, 2014
1
0
I've seen it asked a couple of times in this thread but not answered. How do I go about doing this with a video? I already have the nomedia file saved on my computer but if I try to run it through that decryption link the file I end up with simply doesn't play. I have been trying to figure this out for a week now. Can anyone help me out?

Edit: I got it to open with VLC but it's just a blank green screen
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 8
    I managed to decrypt a SnapChat. It was a relatively simple process.

    1. Load the snapchat in the app, but don't view it.
    2. Copy the .nomedia file from the "/data/data/com.snapchat.android/cache/received_image_snaps/" to your SD card.
    3. This part you may be able to do on the phone but I emailed the file to myself so I could mess with it on my desktop computer. Make a copy of this file just in case.
    4. Go to http://aes.online-domain-tools.com/. Change the input type to "file", upload the picture, set function to "AES", set mode to "ECB". CAUTION: It says on the website that data is transmitted over their network UNENCRYPTED!!! So be careful!
    5. Using the key Xzanthurus provided, "M02cnQ51Ji97vwT4", paste that into the "key" input area on the site. Press "decrypt".
    6. Once decrypted, download that as a binary file.
    7. Change the extension to ".jpg" instead of ".dat".

    There's your picture! (assuming you did everything correctly lol).

    Eric

    EDIT: For more information on getting the actual key: click here.
    4
    So I've went into the /data/data/com.snapchat.android/ folder, and it is only about 200KB, so the image/video files can't be stored there.

    I also noticed if you have a new message, and you close and open the app, it will have to redownload it. So it seems that snapchat is storing the images in the RAM.

    So I dumped the ram of my snapchat PID, using this method. I had to download a compiled gdb binary.

    I then used photoRec to scan all the *.dump files [I concatenated them all first, the file was about 100MB]. For filesystem I said "Other."
    All I got was one txt file. It seemed to be xml, and contained a lot of usernames of my friends, but that's all.

    If anyone has any input on the subject, here is the thread for it!
    3
    So I've went into the /data/data/com.snapchat.android/ folder, and it is only about 200KB, so the image/video files can't be stored there.

    Snapchat save picture under /data/data/com.snapchat.android/cache/received_image_snaps. You then have to copy and paste the file out of the folder, and rename the file extension from .jpgnomedia to .jpg

    I can not find where the videos are stored. That's how I found this thread.
    3
    If you can't find the video folder, it's because it deletes it and the videos when they are not loaded. They are stored under /data/media/Android/data/com.snapchat.android/cache/received_video_snaps/ in mp4 format with a .nomedia file extension. As soon as you navigate away from the app, they are deleted, so I set up a tasker gesture to allow me to copy them while they are loaded.

    As people said before, the images are stored in /data/data/com.snapchat.android/cache/received_image_snaps/ with the jpg.nomedia extension. If that folder doesn't exist, try making sure you've received and loaded a snapchat first. The images seem to stay until they're viewed.
    2
    Where can I find these files on my Samsung Infuse? I go into /data/data/com.snapchat.android/cache but the folder is empty.

    I have not had time to check this location, however I have sort of discovered a workaround. [HTC Rezound CM10.1]

    Ideally you should have a wifi toggle in the statusbar.
    Open snapchat and then click on your snaps, after it loads the images [It will say "Loading image..", then "Tap to view"], turn off WiFi. Then you can view the snapchats [pic or video], and before enabling wifi, wipe Snapchat's data.

    This way you can screenshot while offline and they will not know.

    Alternatively you can use TitaniumBackup. Backup app while logged in, after viewing snapchat offline, restore data from backup so you do not constantly have to login. :)