133 lines
5.9 KiB
Markdown
133 lines
5.9 KiB
Markdown
# cronodump
|
|
|
|
The cronodump utility can parse most of the databases created by the [CronosPro](https://www.cronos.ru/) database software
|
|
and dump it to several output formats.
|
|
|
|
The software is popular among Russian public offices, companies and police agencies.
|
|
|
|
|
|
# Quick start
|
|
|
|
In its simplest form, without any dependencies, the croconvert command creates a [CSV](https://en.wikipedia.org/wiki/Comma-separated_values) representation of all the database's tables and a copy of all files contained in the database:
|
|
|
|
```bash
|
|
bin/croconvert --csv test_data/all_field_types
|
|
```
|
|
|
|
By default it creates a `cronodump-YYYY-mm-DD-HH-MM-SS-ffffff/` directory containing CSV files for each table found. It will under this directory also create a `Files-FL/` directory containing all the files stored in the Database, regardless if they are (still) referenced in any data table. All files that are actually referenced (and thus are known by their filename) will be stored under the `Files-Referenced` directory. With the `--outputdir` option you can chose your own dump location.
|
|
|
|
When you get an error message, or just unreadable data, chances are your database is protected. You may need to look into the `--dbcrack` or `--strucrack` options, explained below.
|
|
|
|
|
|
# Templates
|
|
|
|
The croconvert command can use the powerful [jinja templating framework](https://jinja.palletsprojects.com/en/3.0.x/) to render more file formats like PostgreSQL and HTML.
|
|
The default action for `croconvert` is to convert the database using the `html` template.
|
|
Use
|
|
|
|
```bash
|
|
python3 -m venv ./venc
|
|
. venv/bin/activate
|
|
pip install jinja2
|
|
bin/croconvert test_data/all_field_types > test_data.html
|
|
```
|
|
|
|
to dump an HTML file with all tables found in the database, files listed and ready for download as inlined [data URI](https://en.wikipedia.org/wiki/Data_URI_scheme) and all table images inlined as well. Note that the resulting HTML file can be huge for large databases, causing a lot of load on browsers when trying to open them.
|
|
|
|
|
|
The `-t postgres` command will dump the table schemes and records as valid `CREATE TABLE` and `INSERT INTO` statements to stdout. This dump can then be imported in a PostgreSQL database. Note that the backslash character is not escaped and thus the [`standard_conforming_strings`](https://www.postgresql.org/docs/current/runtime-config-compatible.html#GUC-STANDARD-CONFORMING-STRINGS) option should be off.
|
|
|
|
Pull requests for [more templates supporting other output types](/templates) are welcome.
|
|
|
|
|
|
# Inspection
|
|
|
|
There's a `bin/crodump` tool to further investigate databases. This might be useful for extracting metadata like path names of table image files or input and output forms. Not all metadata has yet been completely reverse engineered, so some experience with understanding binary dumps might be required.
|
|
|
|
The crodump script has a plethora of options but in the most basic for the `strudump` sub command will provide a rich variety of metadata to look further:
|
|
|
|
```bash
|
|
bin/crodump strudump -v -a test_data/all_field_types/
|
|
```
|
|
The `-a` option tells strudump to output ascii instead of a hexdump.
|
|
|
|
For a low level dump of the database contents, use:
|
|
```bash
|
|
bin/crodump crodump -v test_data/all_field_types/
|
|
```
|
|
The `-v` option tells crodump to include all unused byte ranges, this may be useful when identifying deleted records.
|
|
|
|
For a bit higher level dump of the database contents, use:
|
|
```bash
|
|
bin/crodump recdump test_data/all_field_types/
|
|
```
|
|
This will print a hexdump of all records for all tables.
|
|
|
|
|
|
## decoding password protected databases
|
|
|
|
Cronos v4 and higher are able to password protect databases, the protection works
|
|
by modifying the KOD sbox. `cronodump` has two methods of deriving the KOD sbox from
|
|
a database:
|
|
|
|
Both these methods are statistics based operations, it may not always
|
|
yield the correct KOD sbox.
|
|
|
|
|
|
### 1. strudump
|
|
|
|
When the database has a sufficiently large CroStru.dat file,
|
|
it is easy to derive the nodified KOD-sbox from the CroStru file, the `--strucrack` option
|
|
will do this.
|
|
|
|
crodump --strucrack recdump <dbpath>
|
|
|
|
### 2. dbdump
|
|
|
|
When the Bank and Index files are compressed, we can derive the KOD sbox by inspecting
|
|
the fourth byte of each record, which should decode to a zero.
|
|
|
|
The `--dbcrack` option will do this.
|
|
|
|
crodump --dbcrack recdump <dbpath>
|
|
|
|
|
|
# Installing
|
|
|
|
`cronodump` requires python 3.7 or later. It has been tested on Linux, MacOS and Windows.
|
|
There is one optional requirement: the `Jinja2` templating engine, but it will install fine without.
|
|
|
|
There are several ways of installing `cronodump`:
|
|
|
|
* You can run `cronodump` directly from the cloned git repository, by using the shell scripts in the `bin` subdirectory.
|
|
* You can install `cronodump` in your python environment by ruinning: `python setup.py build install`.
|
|
* You can install `cronodump` from the public [pypi repository](https://pypi.org/project/cronodump/) with `pip install cronodump`.
|
|
* You can install `cronodump` with the `Jinja2` templating engine from the public [pypi repository](https://pypi.org/project/cronodump/) with `pip install cronodump[templates]`.
|
|
|
|
|
|
# Terminology
|
|
|
|
We decided to use the more common terminology for database, tables, records, etc.
|
|
Here is a table showing how cronos calls these:
|
|
|
|
| what | cronos english | cronos russian
|
|
|:------ |:------ |:------
|
|
| Database | Bank | Банк
|
|
| Table | Base | Базы
|
|
| Record | Record | Записи
|
|
| Field | Field | поля
|
|
| recid | System Number | Системный номер
|
|
|
|
|
|
# License
|
|
|
|
cronodump is released under the [MIT license](LICENSE).
|
|
|
|
|
|
# References
|
|
|
|
cronodump builds upon [documentation of the file format found in older versions of Cronos](http://sergsv.narod.ru/cronos.htm) and
|
|
the [subsequent implementation of a parser for the old file format](https://github.com/occrp/cronosparser) but dropped the heuristic
|
|
approach to guess offsets and obfuscation parameters for a more rigid parser. Refer to [the docs](docs/cronos-research.md) for further
|
|
details.
|