Today I got a popup message in my iPad2 (jailbroken using absinthe) that it have 0 free space.
Using ssh, I check the size of folders in the iPad and found out an interesting file that took 4.1G space and keep growing.
The file is /private/var/keybags/backup_keys_cache.db
The owner is root
user and wheel
group. Curious, I rename the file into backup_keys_cache.db.orig
. I do ls
again and found that the file got created again and now keep growing in size.
AbiFathirs-iPad:~ root# ls -alh /private/var/keybags/
total 4.1G
drwx------ 2 root wheel 170 Feb 18 23:54 ./
drwxr-xr-x 30 root wheel 1.2K Feb 18 23:52 ../
-rw------- 1 root wheel 97K Feb 19 00:03 backup_keys_cache.db
-rw------- 1 root wheel 4.1G Feb 18 23:56 backup_keys_cache.db.orig
-rw-r--r-- 1 root wheel 2.9K Feb 18 18:44 systembag.kb
I want to know if anybody else have this problems? I tried to uninstall newly installed application, from cydia and from app store, but the process that wrote to this file is still running and the file continue to grow.
I tried to install lsof
, but when I run it, it crash with message Cannot allocate memory
Update Feb 19, 2012:
One of my friend suggest a temporary solution to prevent the process writing into this file. Delete/rename the original file, then create new file as symbolic link to /dev/null
cd /private/var/keybags/
mv backup_keys_cache.db backup_keys_cache.db.orig2 && ln -s /dev/null backup_keys_cache.db
Now with the file become symbolic link into the black hole, it should not hog down the storage space. I still have the original 4.1GB file saved in my laptop, and smaller file that created after the original file got renamed.
I tried to use db4.6_dump
to read this file but I got this message:
DATA=END
db4.6_dump: backup_keys_cache.db: DB_VERIFY_BAD: Database verification failed
My friend suspect it could be from sniffing tools, but he also curious why the file could be that big.
Update Feb 28, 2012
Today I found out that the application (malware?) might have ability to learn and find a way to always write the backup_keys_cache.db file. It could detect and delete the softlink that I made into /dev/null with the same name. I tried to delete the file, make a directory with the same name, but today the directory have been renamed and the backup_keys_cache.db file now had 1.9M size.
If the file not got into 4.1GB, I might not aware about it's existence. I need to know if any other iPad 2 users had the same problem. Please check your device and see if you had the file in there or not.