Skip to content

Add HiSuite 14 PMS split AES-GCM support - #49

Open
RRoenn wants to merge 1 commit into
RealityNet:masterfrom
RRoenn:hisuite14-pms-split
Open

Add HiSuite 14 PMS split AES-GCM support#49
RRoenn wants to merge 1 commit into
RealityNet:masterfrom
RRoenn:hisuite14-pms-split

Conversation

@RRoenn

@RRoenn RRoenn commented Aug 18, 2026

Copy link
Copy Markdown

Summary

Add support for newer HiSuite / LocalBackup application-data backups using the PMS split format.

This format was observed with HiSuite / LocalBackup 14.7.0.240 (backupVersion=31) and stores application data as multiple encrypted TAR parts:

<package>.tar.0
<package>.tar.1
<package>.tar.2
...

The matching BackupFileModuleInfo entry contains isPmsSplit=true.

Encryption

For PMS split application data, each part is decrypted independently using:

  • PBKDF2-HMAC-SHA256
  • 10,000 iterations
  • 256-bit key
  • AES-256-GCM
  • salt and nonce from encMsgV3
  • final 16 bytes of each split file as the GCM authentication tag

Each part is authenticated with decrypt_and_verify() before its plaintext is accepted.

After successful authentication, the decrypted parts are concatenated to reconstruct the original TAR archive.

Behavior

  • Existing legacy HiSuite / KoBackup decryption remains unchanged.
  • PMS split packages are detected by <package>.tar.<number> together with isPmsSplit=true.
  • Split parts are sorted numerically and checked for missing parts.
  • Without -e, the reconstructed archive is written as:
    data/data/<package>.tar
  • With -e, the reconstructed TAR is extracted to:
    data/data/<package>/
  • Nested info.xml files are skipped by the generic Multimedia XML parser, as they are backup metadata rather than Multimedia XML files.

Tests

Added synthetic tests covering:

  • successful AES-GCM decryption and reconstruction of a multi-part TAR
  • GCM authentication failure with an incorrect password
  • parsing of Boolean XML values such as isPmsSplit

All tests pass:

Ran 3 tests
OK

The implementation was also validated end-to-end against a real HiSuite / LocalBackup 14.7.0.240 backup containing three PMS split application-data parts. All parts authenticated successfully and reconstructed into a valid TAR archive which was extracted successfully.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant