An Android Casting (Device) Story: "cast.db"

 

This article will briefly document a SQLite database ("cast.db") found from Android devices, which would store the information of detected casting devices on the Wi-Fi network.

The said "cast.db" can be recovered at "/data/com.google.android.gms/databases/cast.db". 
Using Joshua Hickman's Android 10 image as an example, "DeviceInfo" table from "cast.dbwould store the casting device ID (SSDP UDN), device friendly name, device model name, device IP address and port number, hotspot BSSID, etc.

Apart from the basic information of the casting devices, some interesting Epoch timestamps in milliseconds like "last_published_timestamp_millis", "last_discovered_timestamp_millis" and "last_discovered_by_ble_timestamp_millis" could be discovered as well. 

There were some other intriguing tables such as "NetworkInfo", which probably records the last connected time to a Wi-Fi network as an Epoch timestamp in milliseconds. However, the timestamp found from the table seemed to be incorrect.

As tested, "cast.db" should populate from at least Android version 7, up to 11. In addition, it would populate itself, regardless of the Google Home app is installed or not.


Comments

Popular posts from this blog

Magnet Weekly CTF Challenge Week 5 Writeup a.k.a. Fun with Hadoop

Magnet Weekly CTF Challenge Week 12 Writeup - Last But Not Least