Rekordbox SQLCipher Database Decryption

Overview

Successfully decrypted the rekordbox exportLibrary.db SQLCipher database file using an obfuscated password key.

Tools Used

• SQLCipher 4.5.1
• Python 3 with standard libraries (zlib, base64, subprocess)

Process

1. Initial Investigation

• Confirmed the database was encrypted using SQLCipher
• Checked file header with hexdump (showing binary/encrypted data)
• Created backup of the original database file

2. Key Discovery

Found two critical pieces of information from a Python file:

1. XOR Key (BLOB_KEY):

   BLOB_KEY = b"657f48f84c437cc1"

2. Encrypted Blob (BLOB):

   BLOB = b"PN_1dH8$oLJY)16j_RvM6qphWw`476>;C1cWmI#se(PG`j}~xAjlufj?`#0i{;=glh(SkW)y0>n?YEiD`l%t("

The encryption method was:

• Zlib compression of the plaintext password
• XOR encryption with BLOB_KEY
• Base85 encoding of the result

3. Decryption Implementation

Created Python script /Volumes/RAMDisk/.PIONEER/rekordbox/decrypt_key.py with:

import zlib
import base64
import subprocess

BLOB_KEY = b"657f48f84c437cc1"
BLOB = b"PN_1dH8$oLJY)16j_RvM6qphWw`476>;C1cWmI#se(PG`j}~xAjlufj?`#0i{;=glh(SkW)y0>n?YEiD`l%t("

def deobfuscate(blob: bytes) -> str:
    key = BLOB_KEY
    data = base64.b85decode(blob)
    xored = bytes(b ^ key[i % len(key)] for i, b in enumerate(data))
    return zlib.decompress(xored).decode("utf-8")

4. Password Recovery

Successfully decrypted the SQLCipher password:

r8gddnr4k847830ar6cqzbkk0el6qytmb3trbbx805jm74vez64i5o8fnrqryqls

5. Database Extraction

Used SQLCipher with the recovered password to dump the database contents:

sqlcipher exportLibrary.db "PRAGMA key = 'r8gddnr4k847830ar6cqzbkk0el6qytmb3trbbx805jm74vez64i5o8fnrqryqls';"

Database Schema

The rekordbox database contains the following tables:

• album
• artist
• category
• color
• content
• cue
• genre
• history
• history_content
• hotCueBankList
• hotCueBankList_cue
• image
• key
• label
• menuItem
• myTag
• myTag_content
• playlist
• playlist_content
• property
• recommendedLike
• sort

Files Created

• decrypt_key.py - Python script for key deobfuscation
• exportLibrary_dump.sql - Complete database dump
• exportLibrary.db.backup - Backup of original database

Security Considerations

The decryption process revealed that rekordbox uses a hardcoded encryption key with XOR cipher to protect access to sensitive database data. The password is stored in an obfuscated format, but can be recovered with the proper key.

Technical Notes

• SQLCipher version: 3.37.2 (SQLCipher 4.5.1 community)
• Database size: 118,784 bytes
• XOR key length: 16 bytes
• Encrypted blob length: 85 bytes