2013-07-28T20:54:11Z

Havarh: Created page with "{{lowercase}} This is the userpage for havarh, an iOS/Linux/Mac OS X hacker/developer."

{{lowercase}}
This is the userpage for havarh, an iOS/Linux/Mac OS X hacker/developer.

Messages

2013-07-28T18:49:48Z

Havarh: /* message */ Description of subject

{{lowercase}}
[[Image:IMessage icon.png|thumb|iMessage in iOS5]]
[[iMessage]] is the built-in system application to send messages. Initially (in earlier iOS versions) this was only for sending and receiving SMS (text) messages. Support for sending and receiving MMS messages was introduced in iOS 3.0 The icon on the [[SpringBoard]] is named '''Messages''', but Apple's official name is '''iMessage''' (see references). The application itself is located in <code>/Applications/MobileSMS.app/</code>.

== Activation ==
iMessages on iOS is activated in the same way as [[FaceTime]], with a silent SMS being sent to a carrier defined number and a successful registration SMS being returned. This 'verifies' the phone number for sending and receiving iMessages. Email (AppleID) verification does not use silent SMS, and only sends an email containing a verification link. This is the only method for iMessages on the iPad, iPod touch and Mac OS X.

iMessage is deeply integrated and built around Apple's Push Notification Server over port 5223.

== Serialization ==
To backup or restore the data of this application without [[iTunes]], the following information might be useful. Initial data for this analysis comes from an [[N88ap|iPhone 3GS]] with firmware 3.1.3, which was later restored / upgraded to an [[N90ap|iPhone 4]] and finally to an [[N94ap|iPhone 4S]] with iOS 5.0.1. On lower or higher firmware versions there are differences in the data.

In the folder <code>/var/mobile/Library/SMS/</code> there are the following files:
*<code>sms.db</code>
*<code>sms.db-shm</code>
*<code>sms.db-wal</code>
*<code>sms-legacy.db</code>
*folder <code>Attachments</code>
*folder <code>Drafts</code>
*folder <code>Parts</code>
The files <code>sms.db-shm</code> and <code>sms.db-wal</code> are probably used for indexing or search and can be recreated if deleted (?). The legacy file was not on my iPhone, but another user claimed to have this file (see jbqa reference).

The <code>Attachments</code> folder contains subfolders and files, which are referenced in the main database file in the table madrid_attachment (see there).

=== Drafts ===
In the folder <code>Drafts</code> there is a file <code>PENDING-recipients.plist</code> (if there is a pending draft with already recipients added) and the content is a plist with an array of strings with the recipients (phone numbers). There is also a subfolder <code>PENDING.draft</code> with a file <code>message.plist</code> containing a '''dict''' with the following three values:
*'''markupString''': The text in HTML format (HTML encoded) that has been entered already
*'''resources''': array of dict for every image:
**'''duration''' (integer): '''0''' for images, number of seconds (duration) for videos
**'''exportedFilename''': (filename, without path, ending in .jpg, .png or .3gp)
**'''mimeType''': '''image/jpeg''' or '''image/png''' or '''video/x-internal-iphone'''
*'''textString''': The text that has been entered already (white spaces and line breaks retained)
Images are put into the markupString like this:
<img id="n"
style="display:block;margin-left:-6px;padding-top:5px;padding-bottom:3px"
width="97px" height="110px"
src="x-ckmsgpart:4-n-0">
n is the image number, starting with 0. The width varies slightly, depending on the image width/height ratio, but the height is always 110px (90px for videos). The images theirself are stored in the same folder with corresponding names like <code>data-0</code>, <code>data-1</code>, etc.

In case of a video, the data file is not the video itself, but a bplist with this content (dict):
*'''CKSMSComposeOptionFilenameKey''' (string): '''/var/tmp/capture/capturedvideo.MOV''' or '''/var/tmp/capture-T0x11d520.tmp.OEBOK7/capturedvideo.MOV''' (or similar)
*'''CKSMSComposeOptionPreviewImageDataKey''' (data): big blob (base64 encoded)
For the blob, this was in my test only 5510 byte long, so it's not the movie itself. The only strings in the blob were "JFIF" and "Exif" somewhere near the beginning, so it can be assumed this is metadata or the screenshot shown in the message bubble.

===Main database file===
So we're just looking at the file <code>sms.db</code>, this is an [http://www.sqlite.org/ SQLite database] with the following tables in it:
*sqlite_master
*_SqliteDatabaseProperties
*msg_group
*group_member
*message
*msg_pieces
*madrid_attachment
*madrid_chat

===Indexes===
The following indexes are defined:
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!index name
!table name
!field name(s)
|-
|sqlite_autoindex__SqliteDatabaseProperties_1
|_SqliteDatabaseProperties
|
|-
|message_group_index
|message
|group_id, ROWID
|-
|message_flags_index
|message
|flags
|-
|pieces_message_index
|msg_pieces
|message_id
|-
|madrid_attachment_message_index
|madrid_attachment
|message_id
|-
|madrid_attachment_guid_index
|madrid_attachment
|attachment_guid
|-
|madrid_attachment_filename_index
|madrid_attachment
|filename
|-
|madrid_guid_index
|message
|madrid_guid
|-
|group_id_index
|group_member
|group_id
|-
|madrid_chat_style_index
|madrid_chat
|style
|-
|madrid_chat_state_index
|madrid_chat
|state
|-
|madrid_chat_account_id_index
|madrid_chat
|account_id
|-
|madrid_chat_chat_identifier_index
|madrid_chat
|chat_identifier
|-
|madrid_chat_service_name_index
|madrid_chat
|service_name
|-
|madrid_chat_guid_index
|madrid_chat
|guid
|-
|madrid_chat_room_name_index
|madrid_chat
|room_name
|-
|madrid_chat_account_login_index
|madrid_chat
|account_login
|-
|madrid_roomname_service_index
|message
|madrid_roomname, madrid_service
|-
|madrid_handle_service_index
|message
|madrid_handle, madrid_service
|}

===Triggers===
The following triggers are defined:
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!trigger name
!criteria 1
!criteria 2
!action
|-
|insert_unread_message
|
AFTER INSERT
|style="text-align:left;" |
WHEN NOT read(new.flags)
|style="text-align:left;" |
UPDATE msg_group
SET unread_count = (
SELECT unread_count
FROM msg_group
WHERE ROWID = new.group_id
) + 1
WHERE ROWID = new.group_id;
|-
|mark_message_unread
|
AFTER UPDATE
|style="text-align:left;" |
WHEN read(old.flags)
AND NOT read(new.flags)
|style="text-align:left;" |
UPDATE msg_group
SET unread_count = (
SELECT unread_count
FROM msg_group
WHERE ROWID = new.group_id
) + 1
WHERE ROWID = new.group_id;
|-
|mark_message_read
|
AFTER UPDATE
|style="text-align:left;" |
WHEN NOT read(old.flags)
AND read(new.flags)
|style="text-align:left;" |
UPDATE msg_group
SET unread_count = (
SELECT unread_count
FROM msg_group
WHERE ROWID = new.group_id
) - 1
WHERE ROWID = new.group_id;
|-
|delete_message
|
AFTER DELETE
|style="text-align:left;" |
WHEN NOT read(old.flags)
|style="text-align:left;" |
UPDATE msg_group
SET unread_count = (
SELECT unread_count
FROM msg_group
WHERE ROWID = old.group_id
) - 1
WHERE ROWID = old.group_id;
|-
|insert_newest_message
|
AFTER INSERT
|style="text-align:left;" |
WHEN new.ROWID >= IFNULL(
(
SELECT MAX(ROWID)
FROM message
WHERE message.group_id = new.group_id
), 0
)
|style="text-align:left;" |
UPDATE msg_group
SET newest_message = new.ROWID
WHERE ROWID = new.group_id;
|-
|delete_newest_message
|
AFTER DELETE
|style="text-align:left;" |
WHEN old.ROWID = (
SELECT newest_message
FROM msg_group
WHERE ROWID = old.group_id
)
|style="text-align:left;" |
UPDATE msg_group
SET newest_message = (
SELECT ROWID
FROM message
WHERE group_id = old.group_id
AND ROWID = (
SELECT max(ROWID)
FROM message
WHERE group_id = old.group_id
)
)
WHERE ROWID = old.group_id;
|-
|delete_pieces
|
AFTER DELETE
|<nowiki>-</nowiki>
|style="text-align:left;" |
DELETE
from msg_pieces
where old.ROWID == msg_pieces.message_id;
|}
All defined triggers act on the table ''message'', therefore this is not mentioned in this list with a separate column.

From the trigger statements it is visible that there must be a function called read(x) which is used on the field message.flags. As SQLite does not have this function, but is open-sourced, this has probably been added into the code to facilitate handling the read-flag of a message. Please note that there is also a column called 'read'.

Please note that all date values are stored as a number which means the number of seconds since 1 Jan 2001.

The word "madrid" was the codename for [[iMessage]], before this was a product name (according to [[pytey]], see reference).

==Tables==
===sqlite_master===
This table is contained in every SQLite database and contains general information about the content. It has these fields:
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!field name
!description
|-
|type
|style="text-align:left;" | either 'table' or 'index' or 'trigger'
|-
|name
|style="text-align:left;" | name of the table or index or trigger
|-
|tbl_name
|style="text-align:left;" | same as name for table, related table name for index and trigger
|-
|rootpage
|style="text-align:left;" | integer, internal id where to find the data (?), or 0 for trigger
|-
|sql
|style="text-align:left;" | creation statement
|}

This is the content of this table:
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!type
!name
!tbl_name
!rootpage
!sql
|-
|table
|_SqliteDatabaseProperties
|_SqliteDatabaseProperties
|3
|style="text-align:left;" | CREATE TABLE _SqliteDatabaseProperties (key TEXT, value TEXT, UNIQUE(key))
|-
|table
|message
|message
|5
|style="text-align:left;" | CREATE TABLE message (ROWID INTEGER PRIMARY KEY AUTOINCREMENT, address TEXT, date INTEGER, text TEXT, flags INTEGER, replace INTEGER, svc_center TEXT, group_id INTEGER, association_id INTEGER, height INTEGER, UIFlags INTEGER, version INTEGER, subject TEXT, country TEXT, headers BLOB, recipients BLOB, read INTEGER, madrid_attributedBody BLOB, madrid_handle TEXT, madrid_version INTEGER, madrid_guid TEXT, madrid_type INTEGER, madrid_roomname TEXT, madrid_service TEXT, madrid_account TEXT, madrid_flags INTEGER, madrid_attachmentInfo BLOB, madrid_url TEXT, madrid_error INTEGER, is_madrid INTEGER, madrid_date_read INTEGER, madrid_date_delivered INTEGER, madrid_account_guid TEXT)
|-
|table
|sqlite_sequence
|sqlite_sequence
|6
|style="text-align:left;" | CREATE TABLE sqlite_sequence(name,seq)
|-
|table
|msg_group
|msg_group
|7
|style="text-align:left;" | CREATE TABLE msg_group (ROWID INTEGER PRIMARY KEY AUTOINCREMENT, type INTEGER, newest_message INTEGER, unread_count INTEGER, hash INTEGER)
|-
|table
|group_member
|group_member
|8
|style="text-align:left;" | CREATE TABLE group_member (ROWID INTEGER PRIMARY KEY AUTOINCREMENT, group_id INTEGER, address TEXT, country TEXT)
|-
|table
|msg_pieces
|msg_pieces
|9
|style="text-align:left;" | CREATE TABLE msg_pieces (ROWID INTEGER PRIMARY KEY AUTOINCREMENT, message_id INTEGER, data BLOB, part_id INTEGER, preview_part INTEGER, content_type TEXT, height INTEGER, version INTEGER, flags INTEGER, content_id TEXT, content_loc TEXT, headers BLOB)
|-
|table
|madrid_attachment
|madrid_attachment
|13
|style="text-align:left;" | CREATE TABLE madrid_attachment (ROWID INTEGER PRIMARY KEY AUTOINCREMENT, attachment_guid TEXT, created_date INTEGER, start_date INTEGER, filename TEXT, uti_type TEXT, mime_type TEXT, transfer_state INTEGER, is_incoming INTEGER, message_id INTEGER)
|-
|table
|madrid_chat
|madrid_chat
|25
|style="text-align:left;" | CREATE TABLE madrid_chat (ROWID INTEGER PRIMARY KEY AUTOINCREMENT, style INTEGER, state INTEGER, account_id TEXT, properties BLOB, chat_identifier TEXT, service_name TEXT, guid TEXT, room_name TEXT, account_login TEXT, participants BLOB)
|-
|trigger
|insert_unread_message
|message
|0
|style="text-align:left;" | CREATE TRIGGER insert_unread_message AFTER INSERT ON message WHEN NOT read(new.flags) BEGIN UPDATE msg_group SET unread_count = (SELECT unread_count FROM msg_group WHERE ROWID = new.group_id) + 1 WHERE ROWID = new.group_id; END
|-
|trigger
|mark_message_unread
|message
|0
|style="text-align:left;" | CREATE TRIGGER mark_message_unread AFTER UPDATE ON message WHEN read(old.flags) AND NOT read(new.flags) BEGIN UPDATE msg_group SET unread_count = (SELECT unread_count FROM msg_group WHERE ROWID = new.group_id) + 1 WHERE ROWID = new.group_id; END
|-
|trigger
|mark_message_read
|message
|0
|style="text-align:left;" | CREATE TRIGGER mark_message_read AFTER UPDATE ON message WHEN NOT read(old.flags) AND read(new.flags) BEGIN UPDATE msg_group SET unread_count = (SELECT unread_count FROM msg_group WHERE ROWID = new.group_id) - 1 WHERE ROWID = new.group_id; END
|-
|trigger
|delete_message
|message
|0
|style="text-align:left;" | CREATE TRIGGER delete_message AFTER DELETE ON message WHEN NOT read(old.flags) BEGIN UPDATE msg_group SET unread_count = (SELECT unread_count FROM msg_group WHERE ROWID = old.group_id) - 1 WHERE ROWID = old.group_id; END
|-
|trigger
|insert_newest_message
|message
|0
|style="text-align:left;" | CREATE TRIGGER insert_newest_message AFTER INSERT ON message WHEN new.ROWID >= IFNULL((SELECT MAX(ROWID) FROM message WHERE message.group_id = new.group_id), 0) BEGIN UPDATE msg_group SET newest_message = new.ROWID WHERE ROWID = new.group_id; END
|-
|trigger
|delete_newest_message
|message
|0
|style="text-align:left;" | CREATE TRIGGER delete_newest_message AFTER DELETE ON message WHEN old.ROWID = (SELECT newest_message FROM msg_group WHERE ROWID = old.group_id) BEGIN UPDATE msg_group SET newest_message = (SELECT ROWID FROM message WHERE group_id = old.group_id AND ROWID = (SELECT max(ROWID) FROM message WHERE group_id = old.group_id)) WHERE ROWID = old.group_id; END
|-
|trigger
|delete_pieces
|message
|0
|style="text-align:left;" | CREATE TRIGGER delete_pieces AFTER DELETE ON message BEGIN DELETE from msg_pieces where old.ROWID == msg_pieces.message_id; END
|-
|index
|sqlite_autoindex__SqliteDatabaseProperties_1
|_SqliteDatabaseProperties
|4
|style="text-align:left;" | NULL
|-
|index
|message_group_index
|message
|10
|style="text-align:left;" | CREATE INDEX message_group_index ON message(group_id, ROWID)
|-
|index
|message_flags_index
|message
|11
|style="text-align:left;" | CREATE INDEX message_flags_index ON message(flags)
|-
|index
|pieces_message_index
|msg_pieces
|12
|style="text-align:left;" | CREATE INDEX pieces_message_index ON msg_pieces(message_id)
|-
|index
|madrid_attachment_message_index
|madrid_attachment
|14
|style="text-align:left;" | CREATE INDEX madrid_attachment_message_index ON madrid_attachment(message_id)
|-
|index
|madrid_attachment_guid_index
|madrid_attachment
|15
|style="text-align:left;" | CREATE INDEX madrid_attachment_guid_index ON madrid_attachment(attachment_guid)
|-
|index
|madrid_attachment_filename_index
|madrid_attachment
|16
|style="text-align:left;" | CREATE INDEX madrid_attachment_filename_index ON madrid_attachment(filename)
|-
|index
|madrid_guid_index
|message
|18
|style="text-align:left;" | CREATE INDEX madrid_guid_index ON message(madrid_guid)
|-
|index
|group_id_index
|group_member
|24
|style="text-align:left;" | CREATE INDEX group_id_index ON group_member(group_id)
|-
|index
|madrid_chat_style_index
|madrid_chat
|26
|style="text-align:left;" | CREATE INDEX madrid_chat_style_index ON madrid_chat(style)
|-
|index
|madrid_chat_state_index
|madrid_chat
|27
|style="text-align:left;" | CREATE INDEX madrid_chat_state_index ON madrid_chat(state)
|-
|index
|madrid_chat_account_id_index
|madrid_chat
|23
|style="text-align:left;" | CREATE INDEX madrid_chat_account_id_index ON madrid_chat(account_id)
|-
|index
|madrid_chat_chat_identifier_index
|madrid_chat
|22
|style="text-align:left;" | CREATE INDEX madrid_chat_chat_identifier_index ON madrid_chat(chat_identifier)
|-
|index
|madrid_chat_service_name_index
|madrid_chat
|21
|style="text-align:left;" | CREATE INDEX madrid_chat_service_name_index ON madrid_chat(service_name)
|-
|index
|madrid_chat_guid_index
|madrid_chat
|20
|style="text-align:left;" | CREATE INDEX madrid_chat_guid_index ON madrid_chat(guid)
|-
|index
|madrid_chat_room_name_index
|madrid_chat
|19
|style="text-align:left;" | CREATE INDEX madrid_chat_room_name_index ON madrid_chat(room_name)
|-
|index
|madrid_chat_account_login_index
|madrid_chat
|17
|style="text-align:left;" | CREATE INDEX madrid_chat_account_login_index ON madrid_chat(account_login)
|-
|index
|madrid_roomname_service_index
|message
|28
|style="text-align:left;" | CREATE INDEX madrid_roomname_service_index ON message(madrid_roomname, madrid_service)
|-
|index
|madrid_handle_service_index
|message
|29
|style="text-align:left;" | CREATE INDEX madrid_handle_service_index ON message(madrid_handle, madrid_service)
|}
Please note that the values for rootpage might differ in every database.

===_SqliteDatabaseProperties===
This seems to be a general-purpose table to store some configuration values.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!field name
!type
|-
|key
|TEXT
|-
|value
|TEXT
|-
|colspan="2" | UNIQUE(key)
|}

These values are stored in the table:
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!key
!value
!description
|-
|counter_last_reset
|0
|style="text-align:left;" | ?
|-
|_UniqueIdentifier
|960B6637-167E-44A1-86E5-90E3DFE768AC
|style="text-align:left;" | ?
|-
|_ClientVersion
|21
|style="text-align:left;" | ?
|-
|counter_out_all
|254
|style="text-align:left;" | ?
|-
|counter_out_lifetime
|254
|style="text-align:left;" | ?
|-
|counter_in_all
|468
|style="text-align:left;" | ?
|-
|counter_in_lifetime
|468
|style="text-align:left;" | ?
|-
|__CPRecordSequenceNumber
|2835
|style="text-align:left;" | ?
|}

===message===
This is the main table where all messages are stored:
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!field name
!type
!value / description
|-
|ROWID
|INTEGER PRIMARY KEY AUTOINCREMENT
|style="text-align:left;" | primary key
|-
|address
|TEXT
|style="text-align:left;" | NULL or a name or a phone number (with or without spaces) of the other person (sent to or received from)
|-
|date
|INTEGER
|style="text-align:left;" | message date
|-
|text
|TEXT
|style="text-align:left;" | message content
|-
|flags
|INTEGER
|style="text-align:left;" | unknown, possible values: 0, 2, 3, 5, 35, 16387. Probably a bit-set. The value 35 was set in a SMS that couldn't get sent out and is stil marked with a red exclamation mark letting you send it again.
|-
|replace
|INTEGER
|style="text-align:left;" | unknown, possible values: 0, 1, 2
|-
|svc_center
|TEXT
|style="text-align:left;" | NULL
|-
|group_id
|INTEGER
|style="text-align:left;" | 0 or foreign key to msg_group.ROWID
|-
|association_id
|INTEGER
|style="text-align:left;" | often 0, but sometimes a copy of the date field
|-
|height
|INTEGER
|style="text-align:left;" | always 0
|-
|UIFlags
|INTEGER
|style="text-align:left;" | unknown, possible values: 0, 4, 5, 6, 7
|-
|version
|INTEGER
|style="text-align:left;" | always 0
|-
|subject
|TEXT
|style="text-align:left;" | The subject of an iMessage/MMS-message, or NULL if it's an SMS or if subject is not used on a iMessage/MMS-message
|-
|country
|TEXT
|style="text-align:left;" | NULL or an ISO country code (eg: 'ch' for Switzerland)
|-
|headers
|BLOB
|style="text-align:left;" | always NULL
|-
|recipients
|BLOB
|style="text-align:left;" | normally NULL, one entry had an xml value in it
|-
|read
|INTEGER
|style="text-align:left;" | 0 or 1 (Assume 0 = unread and 1 is read though Madrid messages are always 0 so it probably doesn't apply to them)
|-
|madrid_attributedBody
|BLOB
|style="text-align:left;" | blob, content unknown. The only strings in it are "JFIF" and "Exif", so this is probably meta-data.
|-
|madrid_handle
|TEXT
|style="text-align:left;" | NULL if not an iMessage or a phone number of the other person (sender or receiver)
|-
|madrid_version
|INTEGER
|style="text-align:left;" | NULL if pre-iOS 5.0 or 0
|-
|madrid_guid
|TEXT
|style="text-align:left;" | GUID (unique to the message) or NULL if not an iMessage
|-
|madrid_type
|INTEGER
|style="text-align:left;" | 0 or NULL if pre-iOS 5.0
|-
|madrid_roomname
|TEXT
|style="text-align:left;" | NULL
|-
|madrid_service
|TEXT
|style="text-align:left;" | 'Madrid' or NULL if not an iMessage
|-
|madrid_account
|TEXT
|style="text-align:left;" | NULL if not an iMessage or 'p:' & own phone number or 'e:' & email registered for iMessage
|-
|madrid_flags
|INTEGER
|style="text-align:left;" | message type. Known values: NULL (if not an iMessage), 12289 (received), 32773 (send error), 36869 (sent), 45061 (sent), 77825 (received message containing parsed data eg: phone, email, website), 102405 (sent message containing parsed data eg: phone, email, website)
|-
|madrid_attachmentInfo
|BLOB
|style="text-align:left;" | NULL or blob. The blob contains these strings: streamtyped, NSMutableArray, NSArray, NSObject, NSMutableString, NSString, and a GUID. Format unknown.
|-
|madrid_url
|TEXT
|style="text-align:left;" | always an empty string
|-
|madrid_error
|INTEGER
|style="text-align:left;" | empty string if message is pre-iOS 5.0 or 0 if after
|-
|is_madrid
|INTEGER
|style="text-align:left;" | value 0 or 1 (0=SMS, 1=iMessage)
|-
|madrid_date_read
|INTEGER
|style="text-align:left;" | null if message is pre-iOS 5.0, 0 if sms or a sent iMessage, integer value representing the date read
|-
|madrid_date_delivered
|INTEGER
|style="text-align:left;" | null if message is pre-iOS 5.0, 0 if sms or a received iMessage, integer value representing the date sent
|-
|madrid_account_guid
|TEXT
|style="text-align:left;" | GUID of account used (multiple entries may be found representing either the phone or email registered with iMessage) or empty if not an iMessage
|}

===sqlite_sequence===
This table does not define data types. This is the data in the table:
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!name
!seq
|-
|msg_group
|71
|-
|message
|784
|-
|group_member
|71
|-
|msg_pieces
|3
|-
|madrid_chat
|3
|-
|madrid_attachment
|3
|}

===msg_group===
This defines a chat (SMS/text/message) conversation group.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!field name
!type
!value / description
|-
|ROWID
|INTEGER PRIMARY KEY AUTOINCREMENT
|style="text-align:left;" | primary key
|-
|type
|INTEGER
|style="text-align:left;" | 0 if only one recipient, 1 if multiple recipients
|-
|newest_message
|INTEGER
|style="text-align:left;" | foreign key to message. This value is auto-updated by triggers when inserting / deleting a message, so that this always points to the newest message.
|-
|unread_count
|INTEGER
|style="text-align:left;" | The number of unread messages in this group. This value is auto-incremented/decremented by triggers when inserting or deleting an unread message or when marking a message as read or unread.
|-
|hash
|INTEGER
|style="text-align:left;" | signed 32-bit integer value (calculation?)
|}

===group_member===
This defines the member of the chat (SMS/text/message) conversation group. As you currently cannot define groups, there is always only one member in each group, so the group_id and ROWID values match.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!field name
!type
!value / description
|-
|ROWID
|INTEGER PRIMARY KEY AUTOINCREMENT
|style="text-align:left;" | primary key
|-
|group_id
|INTEGER
|style="text-align:left;" | foreign key to msg_group.ROWID
|-
|address
|TEXT
|style="text-align:left;" | name or phone number (with or without spaces)
|-
|country
|TEXT
|style="text-align:left;" | ISO country code eg: 'ch' for Switzerland
|}

===msg_pieces===
This table contains information about MMS objects. (?)

When a message is deleted, a trigger checks if there are related entries in this table here and deletes them also.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!field name
!type
!value / description
|-
|ROWID
|INTEGER PRIMARY KEY AUTOINCREMENT
|style="text-align:left;" | primary key
|-
|message_id
|INTEGER
|style="text-align:left;" | foreign key to message
|-
|data
|BLOB
|style="text-align:left;" | NULL
|-
|part_id
|INTEGER
|style="text-align:left;" | 0
|-
|preview_part
|INTEGER
|style="text-align:left;" | 0 or -1
|-
|content_type
|TEXT
|style="text-align:left;" | empty string or 'image/jpeg'
|-
|height
|INTEGER
|style="text-align:left;" | 0
|-
|version
|INTEGER
|style="text-align:left;" | 1
|-
|flags
|INTEGER
|style="text-align:left;" | 0
|-
|content_id
|TEXT
|style="text-align:left;" | NULL or 1
|-
|content_loc
|TEXT
|style="text-align:left;" | image file name without path (like 'IMG_0104.JPG')
|-
|headers
|BLOB
|style="text-align:left;" | NULL
|}

===madrid_attachment===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!field name
!type
!value / description
|-
|ROWID
|INTEGER PRIMARY KEY AUTOINCREMENT
|style="text-align:left;" | primary key
|-
|attachment_guid
|TEXT
|style="text-align:left;" | GUID - this matches the subfolder name in the folder <code>Attachments</code>
|-
|created_date
|INTEGER
|style="text-align:left;" | unsigned integer value with the creation date
|-
|start_date
|INTEGER
|style="text-align:left;" | 0
|-
|filename
|TEXT
|style="text-align:left;" | complete filename (with path)
|-
|uti_type
|TEXT
|style="text-align:left;" | 'public.jpeg' or 'public.vcard'
|-
|mime_type
|TEXT
|style="text-align:left;" | 'image/jpeg' or 'text/vcard'
|-
|transfer_state
|INTEGER
|style="text-align:left;" | 5
|-
|is_incoming
|INTEGER
|style="text-align:left;" | 0
|-
|message_id
|INTEGER
|style="text-align:left;" | -1
|}

===madrid_chat===
In my case there are three entries in this table.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!field name
!type
!value / description
|-
|ROWID
|INTEGER PRIMARY KEY AUTOINCREMENT
|style="text-align:left;" | primary key
|-
|style
|INTEGER
|style="text-align:left;" | Only known value is 45
|-
|state
|INTEGER
|style="text-align:left;" | Only known value is 3
|-
|account_id
|TEXT
|style="text-align:left;" | GUID of the iMessage account you used
|-
|properties
|BLOB
|style="text-align:left;" | NULL for the second row or a bplist (see below)
|-
|chat_identifier
|TEXT
|style="text-align:left;" | phone number of the other person in international format, no spaces
|-
|service_name
|TEXT
|style="text-align:left;" | 'Madrid'
|-
|guid
|TEXT
|style="text-align:left;" | same as chat_identifier, but with a '-' in front of it
|-
|room_name
|TEXT
|style="text-align:left;" | NULL
|-
|account_login
|TEXT
|style="text-align:left;" | 'P:' & own phone number or 'E:' & email registered for iMessage
|-
|participants
|BLOB
|style="text-align:left;" | bplist (see below)
|}

For the properties bplist this contains the following settings for the first row (dict):
*CKMadridServiceConsecutiveCanceledMessageCount (integer) = 2
*CKMadridServiceLastCanceledMessageTime (real) = date/time value
or this for the third row (dict):
*CKPlaceholderTimeSince1970Property (real) = date/time value
Please note that the date/time values here are the number of seconds since 1 Jan 1970 and not since 2001 like in the other database fields. There are also fractions of a second (up to seven digits).

For the participants bplist, in all three rows there is the same content (array):
*(string): a phone number, not my own, in international format, no spaces

The interesting thing is that the phone number of the participants list matches the phone number of the first row. The people in the second and third row don't know the person from the participants list. Probably this is garbage in this table or its implementation is not finished yet. I also don't have any related messages.

The field ''chat_identifier'' seems to be unique. This table is probably an index of iMessage contacts.

===References===
*[http://imfreedom.org/wiki/IMessage Information based on examination of the Messages Beta application for Mac OS X]
*[http://www.apple.com/ios/features.html#imessage Apple's description of iMessage]
*[http://blog.cryptographyengineering.com/2012/08/dear-apple-please-set-imessage-free.html Critics on protocol by Matthew Green]
*[http://www.scip.ch/?labs.20111103 SCIP article (german only)]
*[http://twitter.com/#!/pytey/status/127644352091664384 pytey explaining "Madrid"]
*[http://www.jailbreakqa.com/questions/92827/how-to-backuprestore-sms-without-itunes jbqa: How to backup/restore SMS without iTunes]
*[http://smsmerge.homedns.org/ script to merge two SMS databases]