代码之家 › 专栏 › 技术社区 › sdaau

分析/转换诺基亚“智能功能操作系统”备份.ib文件?

nokia parsing

sdaau · 技术社区 · 6 年前

我已经写了一些关于这个的 https://superuser.com/questions/1389657/backup-access-sms-on-nokia-3310-3g-2017-from-linux-pc ;基本上,我正在尝试将诺基亚33103G上的短信息备份到Ubuntu18.04 PC上;请注意,芯片和操作系统上的硬件系统因版本而异。 Nokia 3310 (2017) :

片上系统/操作系统:

联发科MT6260/诺基亚30+系列(2G)

扩频SC7701B/Java驱动的智能功能OS(3G)

展讯SC9820A/Yun OS(4G,CMCC)

我有3G,所以我有一个“智能功能操作系统”,显然是Kaios的一个版本。( Is there any difference between KaiOS and 'Smart Feature OS'? : KaiOS ,显然( KaiOS â A Smartphone Operating System | Hacker News )是火狐操作系统的一个分支。

单击“菜单”>“存储”>“创建备份”( https://www.nokia.com/phones/en_int/support/nokia-3310-3g-user-guide/create-a-backup )在此手机上,它生成一个文件夹,其中包含文件,命名如下:

$ tree All-backup_01-01-2019_20-18-54
All-backup_01-01-2019_20-18-54
âââ ibphone_head.in
âââ phonebook.ib
âââ sms.ib

我从没听说过 .ib 以前的档案,我希望这里有人知道它们是什么。一眼就能看出 IB File Extension - Open .IB File (InterBase Database) 但是我试着用这些 IB 档案带 http://fbexport.sourceforge.net/fbexport.php “通过Firebird和Interbase数据库导出和导入数据的工具”,我得到:

Engine Code    : 335544323
Engine Message :
file ./All-backup_01-01-2019_20-18-54/phonebook.ib is not a valid database

所以,不是这样的。

这是一堆 ibphone_head.in -看起来这里没有个人身份信息:

$ hexdump -C All-backup_01-01-2019_20-18-54/ibphone_head.in 
00000000  00 00 00 00 41 00 6c 00  6c 00 2d 00 62 00 61 00  |....A.l.l.-.b.a.|
00000010  63 00 6b 00 75 00 70 00  5f 00 30 00 31 00 2d 00  |c.k.u.p._.0.1.-.|
00000020  30 00 31 00 2d 00 32 00  30 00 31 00 39 00 5f 00  |0.1.-.2.0.1.9._.|
00000030  32 00 30 00 2d 00 31 00  38 00 2d 00 35 00 34 00  |2.0.-.1.8.-.5.4.|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100  00 00 00 00 45 00 3a 00  5c 00 42 00 61 00 63 00  |....E.:.\.B.a.c.|
00000110  6b 00 75 00 70 00 73 00  5c 00 41 00 6c 00 6c 00  |k.u.p.s.\.A.l.l.|
00000120  2d 00 62 00 61 00 63 00  6b 00 75 00 70 00 5f 00  |-.b.a.c.k.u.p._.|
00000130  30 00 31 00 2d 00 30 00  31 00 2d 00 32 00 30 00  |0.1.-.0.1.-.2.0.|
00000140  31 00 39 00 5f 00 32 00  30 00 2d 00 31 00 38 00  |1.9._.2.0.-.1.8.|
00000150  2d 00 35 00 34 00 00 00  00 00 00 00 00 00 00 00  |-.5.4...........|
00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200  00 00 00 00 30 30 30 31  2e 30 30 30 30 33 00 00  |....0001.00003..|
00000210  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000230  00 00 00 00 00 00 6d 6d  69 6b 65 79 62 61 63 6b  |......mmikeyback|
00000240  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000250  00 00 00 00 00 00 03 00  00 00 00 00 b0 cd 09 00  |................|
00000260  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000270  00 00 00 00 00 00 00 00  f3 dd 00 00 7e 2f 00 00  |............~/..|
00000280  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000002c4

因此,字符串似乎是用2个字节编码的,“宽字符”;而且在大多数情况下, iBoeEnHead in 似乎只是对其包含/父文件夹的名称进行编码, All-backup_01-01-2019_20-18-54 .

这是一个电话簿的Hexdump,在这里我匿名给a a a a a a a和bbb:

$ hexdump -C -n 1900 All-backup_01-01-2019_20-18-54/phonebook.ib
00000000  70 00 68 00 6f 00 6e 00  65 00 62 00 6f 00 6f 00  |p.h.o.n.e.b.o.o.|
00000010  6b 00 2e 00 69 00 62 00  00 00 00 00 00 00 00 00  |k...i.b.........|
00000020  00 00 00 00 01 00 00 00  30 f8 04 00 62 01 00 00  |........0...b...|
00000030  62 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |b...............|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000240  00 00 00 00 98 03 00 00  01 00 00 00 ff ff ff ff  |................|
00000250  ff ff ff ff 01 00 01 00  00 00 00 00 00 00 00 00  |................|
00000260  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000360  d9 d4 37 46 00 00 00 00  00 00 01 02 00 00 04 01  |..7F............|
00000370  07 12 80 88 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000380  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000003b0  09 00 41 00 41 00 41 00  41 00 41 00 41 00 41 00  |..A.A.A.A.A.A.A.|
000003c0  41 00 41 00 00 00 00 00  00 00 00 00 00 00 00 00  |A.A.............|
000003d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000005e0  00 00 00 00 00 00 00 00  00 00 00 00 ff ff ff ff  |................|
000005f0  ff ff ff ff 98 03 00 00  01 00 00 00 ff ff ff ff  |................|
00000600  ff ff ff ff 04 00 01 00  00 00 00 00 00 00 00 00  |................|
00000610  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000710  d9 d4 37 46 00 00 00 00  00 00 01 02 00 00 06 11  |..7F............|
00000720  83 29 23 13 58 f9 00 00  00 00 00 00 00 00 00 00  |.)#.X...........|
00000730  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000760  03 00 42 00 42 00 42 00  00 00 00 00              |..B.B.B.....|
0000076c

似乎在这里 d9 d4 37 46 是条目的分隔符,条目之间的间距似乎为0x3b0=944个字节;但无法确定实际电话号码存储在何处。

我不会粘贴 sms.ib 因为我害怕透露更多的个人信息。

然而,也许已经发布了什么,会帮助某人查看这是否是一个已经建立的文件格式?无论如何,我想把这些文件的内容转换成纯文本…

1 回复 | 直到 6 年前

Yvette 6 年前

这个 phonebook.ib 是专有文件格式。我做了一些分析,找到了可以从中提取姓名和电话号码的方法。

头是580字节,似乎不包含任何有趣的内容。
条目似乎以条目长度开始,编码为3个4位小数点,后跟另一个数字(可能是版本号?).

在我的示例文件中,所有条目都是940字节,因此 94 03 作为前两个字节。我在不同偏移量处识别的其他字段条目:

entry+0x12A[1 byte]:表示电话号码的字节数。
entry+0x12b[1 byte]:类似于两位十进制编码标志。如果设置了高半字节(例如 10 )电话号码以开头 + .
输入+0x12C:电话号码,十进制编码。例如, 123456 将表现为 21 43 65 . 特殊数字:
- a 是 *
- b 是 #
- f 忽略(当位数不是偶数时视为最后一位)。
entry+0x16c[1 byte]:名称长度。
entry+0x16e:以utf-16表示的名称(即每个字符2个字节)。

以您的代码片段为例:

0x36e是电话长度,4个字节。
0x36F是额外的标志,高半字节是 0 所以没有 + 前缀。
0x370是电话号码的起始位置, 07 12 80 88 翻译为 70210888 .

在我的报告中可以找到一个简单的引用解析器: https://github.com/yossigo/phonebook_ib_export