docs: identify msglib wrapper analysis path
This commit is contained in:
zhaoyilun
@@ -0,0 +1,85 @@
|
||||
# MsgLib.db readability and wrapper-path precheck
|
||||
|
||||
Date: 2026-07-10
|
||||
|
||||
## Question
|
||||
|
||||
Why are the copied `MsgLib.db` files not directly readable as SQLite, and what is the safest next path for extracting contact/group display names and richer message metadata?
|
||||
|
||||
## Evidence checked
|
||||
|
||||
- Existing ignored metadata:
|
||||
- `runs/offline-evidence-intake/zyl-qqfile-20260709/metadata/schema-inspection-summary.json`
|
||||
- `runs/offline-evidence-intake/zyl-qqfile-20260709/metadata/archive-list.txt`
|
||||
- New ignored C24 metadata:
|
||||
- `runs/offline-evidence-intake/zyl-qqfile-20260709/metadata/c24-msglib-format-precheck.json`
|
||||
- `runs/offline-evidence-intake/zyl-qqfile-20260709/metadata/c24-wrapper-string-precheck.json`
|
||||
- Read-only extracted wrapper candidates under ignored:
|
||||
- `runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/c24-wrapper-candidates/`
|
||||
|
||||
No raw DB bytes, decrypted messages, or personal values are committed in this note.
|
||||
|
||||
## Findings
|
||||
|
||||
1. The three inspected `MsgLib.db` copies do not start with SQLite magic and contain no SQLite header within the first 1 MiB sample.
|
||||
2. The inspected DB samples have high entropy and the same non-SQLite prefix shape across iSphere and IMPP account copies. This strongly suggests a consistent encrypted/wrapped DB format rather than a random corrupt copy.
|
||||
3. The archive contains standard SQLite libraries, DB abstraction libraries, and a repair tool next to `MsgLib.db`:
|
||||
- `System.Data.SQLite.dll`
|
||||
- `Utilities.Lib.DBSQLite.dll`
|
||||
- `Utilities.Lib.SQLiteInteraction.dll`
|
||||
- `Utilities.Lib.SQLiteInteractionBase.dll`
|
||||
- `Utilities.Lib.DBBase.dll`
|
||||
- `Utilities.Lib.DBModel.dll`
|
||||
- `HYHC.IMPP.DAL.dll`
|
||||
- `RepairDatabase.exe`
|
||||
4. String-only static scanning of wrapper candidates shows that `HYHC.IMPP.DAL.dll` and `RepairDatabase.exe` reference message/group DB behavior and candidate table/method names, including:
|
||||
- `tblMsgGroupPersonMsg`
|
||||
- `ImportOldDataBase`
|
||||
- `GetGroupMessaeByID`
|
||||
- `GetGroupRecentMsg`
|
||||
- `UpdateGroupName`
|
||||
- `SelectMsgGroupName`
|
||||
- `SelectRecentGroupName`
|
||||
- `SaveGroupInfomation`
|
||||
- `groupJid`
|
||||
- `set_MemberJid`
|
||||
- `set_MsgGroupName`
|
||||
- `set_MemberName`
|
||||
- `get_naturalname`
|
||||
5. `Utilities.Lib.SQLiteInteraction.dll` exposes `SQLiteConnectionStringBuilder` plus `get_Password` and `set_Password`.
|
||||
6. `Utilities.Lib.DBModel.dll` exposes configuration concepts such as `IConStrDecryption`, `PasswordPropertyName`, and `DecryptionPropertyName`.
|
||||
7. `smcrypto-*` and `BouncyCastle.Crypto.dll` are present, but C24 does not prove they are the actual `MsgLib.db` wrapper. They are supporting crypto candidates only.
|
||||
|
||||
## Decision
|
||||
|
||||
Do not treat `MsgLib.db` as ordinary SQLite.
|
||||
|
||||
The best current hypothesis is:
|
||||
|
||||
> `MsgLib.db` is an encrypted or wrapped SQLite database opened through the client DB abstraction layer, likely involving `Utilities.Lib.SQLiteInteraction*`, `Utilities.Lib.DBModel`, and `HYHC.IMPP.DAL`.
|
||||
|
||||
The next safe implementation path is not direct DB reads. It is static wrapper analysis first:
|
||||
|
||||
1. Inspect .NET metadata/IL for the DB wrapper assemblies.
|
||||
2. Identify how connection strings/password/decryption are supplied.
|
||||
3. Identify table names and model classes for message, contact, group, member, and display-name fields.
|
||||
4. Only after that, attempt a read-only schema extraction on copied DB files under ignored paths.
|
||||
|
||||
## Next slice
|
||||
|
||||
C25 should perform a read-only static .NET wrapper analysis over the extracted candidate assemblies. It should produce table/model/source mappings only, not execute the client and not write to the original DB.
|
||||
|
||||
Suggested C25 focus:
|
||||
|
||||
- `HYHC.IMPP.DAL.dll`
|
||||
- `Utilities.Lib.SQLiteInteraction.dll`
|
||||
- `Utilities.Lib.DBModel.dll`
|
||||
- `Utilities.Lib.DBSQLite.dll`
|
||||
- `RepairDatabase.exe`
|
||||
|
||||
Expected output:
|
||||
|
||||
- candidate table names;
|
||||
- candidate model/property names for contact/group/message metadata;
|
||||
- likely connection-string/password/decryption flow;
|
||||
- decision whether C26 can attempt a copied-DB read-only schema extraction.
|
||||
@@ -18,8 +18,8 @@ Schema notes: `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md`
|
||||
| MCP tool | Primary source | Fallback source | Evidence file | Decision status | Next implementation slice |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| `isphere_receive_messages` | decrypted `PacketReader.ProcessPacket` XMPP `<message>` stanzas via `internal/isphere.EncryptedPacketLogSource`; configured by `ISPHERE_PACKET_LOG_FILE` or `ISPHERE_PACKET_LOG_DIR` | decrypted `Smark.SendReceive` transport stanzas; decrypted `SaveToDB` `Chat_OnMessageArrived` traces; wrapped `MsgLib.db` after DB wrapper is solved | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#field-mapping-evidence` | C20 supports and validates the current safe receive-message contract args; default source remains empty when unset | apply safe contract args to contact/group search |
|
||||
| `isphere_search_contacts` | bare sender/receiver JIDs extracted from normalized log-backed messages loaded from configured PacketReader file or directory source | decrypted roster/contact stanzas from `Smark.SendReceive`; `MsgLib.db` contact/conversation tables after DB wrapper is solved; UIA helper source if display names are missing | `docs/source-discovery/2026-07-10-display-name-source-precheck.md` | C23 blocked display-name enrichment: no validated JID-to-display-name source yet; JID-only display/account fallback remains honest | precheck `MsgLib.db` readability/wrapper path |
|
||||
| `isphere_search_groups` | decrypted `PacketReader.ProcessPacket` `type="groupchat"` stanzas and conference/MUC JIDs loaded from configured PacketReader file or directory source | `MsgLib.db` group/conversation tables after DB wrapper is solved; UIA helper source if group display names are missing | `docs/source-discovery/2026-07-10-display-name-source-precheck.md`; C9 ignored-log scan: PacketReader 86 groupchat/86 conference hits; Smark 24 groupchat/658 conference/631 muc hits | C23 blocked display-name/member enrichment: no validated group-title/member source yet; JID-only display fallback remains honest | precheck `MsgLib.db` readability/wrapper path |
|
||||
| `isphere_search_contacts` | bare sender/receiver JIDs extracted from normalized log-backed messages loaded from configured PacketReader file or directory source | decrypted roster/contact stanzas from `Smark.SendReceive`; `MsgLib.db` contact/conversation tables after DB wrapper is solved; UIA helper source if display names are missing | `docs/source-discovery/2026-07-10-msglib-readability-precheck.md` | C24 confirms `MsgLib.db` is not ordinary SQLite and likely needs client DB wrapper/static .NET analysis before display-name extraction | static wrapper analysis for table/model/password flow |
|
||||
| `isphere_search_groups` | decrypted `PacketReader.ProcessPacket` `type="groupchat"` stanzas and conference/MUC JIDs loaded from configured PacketReader file or directory source | `MsgLib.db` group/conversation tables after DB wrapper is solved; UIA helper source if group display names are missing | `docs/source-discovery/2026-07-10-msglib-readability-precheck.md`; C9 ignored-log scan: PacketReader 86 groupchat/86 conference hits; Smark 24 groupchat/658 conference/631 muc hits | C24 finds group table/model candidates in wrapper strings but no validated copied-DB read path yet; JID-only display fallback remains honest | static wrapper analysis for table/model/password flow |
|
||||
| `isphere_receive_files` | decrypted `PacketReader.ProcessPacket` file-transfer message stanzas via `internal/isphere.ListFilesFromMessages` and `isphere_receive_files` list mode; configured PacketReader file or directory source; `zyl\importal\<hash>` cache entries remain unlinked | decrypted `Smark.SendReceive` and `SaveToDB` traces for file-reference reconciliation; future UIA/client connector for download | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#c12-file-transfer-evidence-precheck` | C22 verifies safe file-list contract args; no log-to-cache/download mapping yet | defer download mapping; precheck contact/group display-name evidence |
|
||||
| `isphere_send_message` | none validated yet | existing bridge/API/local service preferred; UIA write connector only after internal-sandbox action evidence; network/protocol connector only after protocol discovery | `docs/source-discovery/2026-07-10-send-message-source-precheck.md` | C15 blocked: contract exists, but no committed bridge/API/local service, helper write op, UIA action chain, or protocol connector is validated | do not implement write behavior; harden existing read source configuration |
|
||||
| `isphere_send_file` | none validated yet | depends on send-message connector plus outbound file/upload evidence | `docs/source-discovery/2026-07-10-send-message-source-precheck.md` | blocked behind `isphere_send_message` connector selection and file upload/source policy | defer until send-message connector is validated |
|
||||
|
||||
Reference in New Issue
Block a user