Skip to content

Add SQLCipher CE implementation#28

Merged
Schamper merged 13 commits into
fox-it:mainfrom
JSCU-CNI:sqlcipher
Feb 13, 2026
Merged

Add SQLCipher CE implementation#28
Schamper merged 13 commits into
fox-it:mainfrom
JSCU-CNI:sqlcipher

Conversation

@JSCU-CNI

Copy link
Copy Markdown
Contributor

This PR implements transparent decryption support for SQLCipher community edition versions 1 up to 4. Fixes #17.

Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
Comment thread dissect/database/sqlite3/sqlite3.py Outdated
Comment thread dissect/database/sqlite3/sqlite3.py Outdated
@JSCU-CNI JSCU-CNI requested a review from Schamper February 10, 2026 13:56
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
DEFAULT_HMAC_ALGO = None


class SQLCipherPage:

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This class is now largely unnecessary and can be replaced by either inlining it in _read_page or splitting it up in one or two functions.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you propose? Some form of a class structure per page could still be useful for future debugging purposes. I agree that the current form of the class is overkill.

@JSCU-CNI JSCU-CNI Feb 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have gone ahead and in-lined the class in the _read_page method. Let me know if that suffices. (ced9972). Also added optional HMAC verification in f2c21c1.

Comment thread dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py Outdated
JSCU-CNI and others added 4 commits February 10, 2026 17:29
@JSCU-CNI JSCU-CNI requested a review from Schamper February 10, 2026 16:51
@codecov

codecov Bot commented Feb 10, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 159 lines in your changes missing coverage. Please review.
✅ Project coverage is 0.00%. Comparing base (6149d6f) to head (3ecb356).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
...database/sqlite3/encryption/sqlcipher/sqlcipher.py 0.00% 147 Missing ⚠️
...database/sqlite3/encryption/sqlcipher/exception.py 0.00% 4 Missing ⚠️
dissect/database/sqlite3/encryption/__init__.py 0.00% 3 Missing ⚠️
.../database/sqlite3/encryption/sqlcipher/__init__.py 0.00% 3 Missing ⚠️
dissect/database/sqlite3/sqlite3.py 0.00% 2 Missing ⚠️
Additional details and impacted files
@@          Coverage Diff           @@
##            main     #28    +/-   ##
======================================
  Coverage   0.00%   0.00%            
======================================
  Files        146     150     +4     
  Lines       3908    4067   +159     
======================================
- Misses      3908    4067   +159     
Flag Coverage Δ
unittests 0.00% <0.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@codspeed-hq

codspeed-hq Bot commented Feb 10, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 6 untouched benchmarks


Comparing JSCU-CNI:sqlcipher (3ecb356) with main (6149d6f)

Open in CodSpeed


# Initialize the decrypted SQLite3 stream as a file-like object and see if that works.
try:
super().__init__(self.stream(), wal=None, checkpoint=None)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe not necessarily for this PR, but does SQLCipher support WAL? If so, is it deliberately not supported yet?

@JSCU-CNI JSCU-CNI Feb 13, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, SQLCipher supports WAL encryption. This hasn't been implemented yet as the WAL PR did not exist yet when this was originally written. Created an issue for that: #31.

@Schamper Schamper merged commit 798cf10 into fox-it:main Feb 13, 2026
24 checks passed
@JSCU-CNI JSCU-CNI deleted the sqlcipher branch February 13, 2026 14:14
twiggler pushed a commit to twiggler/dissect-monorepo-test that referenced this pull request May 26, 2026
Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>
twiggler pushed a commit to twiggler/dissect-monorepo-test that referenced this pull request Jun 4, 2026
Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>
twiggler pushed a commit to twiggler/dissect-monorepo-test that referenced this pull request Jun 5, 2026
Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add support for SQLCipher

2 participants