SnapChat My Eyes Only PIN Bruteforce

[InvertReality]

Script to brute-force SnapChat My Eyes Only PIN

Memories.db stores the PIN hash in the 'memories_meo_confidential' table - 'hashed_passcode' column as a bcrypt hash.

Memories.db will only be available/contain a hashed passcode if the user has entered the MEO PIN code while connected to the internet. During my testing, when logging out of SnapChat, the memories.db database was deleted/no longer accessible.
Memories.db was re-created upon login, but the hashed_passcode column was empty until I entered the MEO PIN code
while connected to the internet.

It seems that once the PIN code is verified online initially, and a bcrypt hash is created and stored offline within Memories.db,
the user may then enter the PIN to access MEO folder offline (the hash will be cached for an undetermined period of time - this may be the same as the 60 day timeout reported on the Forensics Discord server for media).

memories.db/hash is persistent through power off/on states. Logout and x days is the only thing that appears to remove the hash. However, may still be handy if device is seized and examined early.

Example bcrypt hash [PIN - 1234]: $2a$06$hJJsu8Yb5tlJtsQzMX3ZJu9u6JIiZaoq60U2AbBpx57CImBDrx15q

Iterations = 6
Salt = $2a$06$hJJsu8Yb5tlJtsQzMX3ZJu
Password hash = 9u6JIiZaoq60U2AbBpx57CImBDrx15q

I have some test memories.db so that you can test the script (one db which contains the hash, and one without for error checking via script).

My Discord is AeroDai#1361 and I'm on the Forensic Discord server.

[abrignoni]

Thanks for the contribution!

This PR changes artifact modules without test data for them. A small fixture with each artifact change lets reviewers run the module against real data, and the committed case keeps guarding the module after merge.

• snapchatMEO.py: please include a fixture with this PR.

Adding a fixture

Generate it from your extraction with the helper (details in create_module_test_cases.md):

python admin/test/scripts/make_test_data.py <module> --case <case_number> --input <extraction.zip>

It writes admin/test/cases/testdata.<module>.json and one zip per artifact under admin/test/cases/data/<module>/.

Size rules:

• Under 10 MB per zip: commit the files in this PR.
• 10 to 25 MB: commit the case JSON in the PR and attach the zip to a comment here.
• Over 25 MB: say so here and a maintainer will arrange a handoff.

If your extraction cannot be shared:

• If the app appears on a public research image, generate the fixture from that instead. public_corpus_images.md lists the images and where to download them.
• Or sanitize the real file in place: keep the file the app wrote and overwrite only the personal values, which keeps the format honest.
• Or script a known session: install the app on a test device with a throwaway account, perform documented actions, and extract that.

If none of those fit, say so here and we will work it out. The PR can still be reviewed and merged with the gap recorded in the artifact's notes.

This is a request, not a gate. Nothing here blocks review.