iPhone SMS read from sms.db

I'm referring to an iPhone which isn't jailbroken
I was wondering how to read SMS content programmatically (Objective-c) from my iPhone.
But something is wrong on new FW 4.3.5 ... here some notes:
Step #1: explore sms.db structure
Step #2: find on iPhone the location sms store
Step #3: try to read

Step #1 : explore sms.db structure

In order to explore and understand sms.db we will use the backup file made by iTunes when we backup our iPhone. Since  sms.db (such as any other storage .db on iPhone) is a sqlite file we need to have a sqllite browser : https://github.com/sqlitebrowser/sqlitebrowser/releases
(moved) http://sourceforge.net/projects/sqlitebrowser/files/sqlitebrowser/2.0%20beta1/sqlitebrowser200b1osx.zip/download

Now explore sms.db using the local backup ... so open Terminal and follow below steps :

• cd ~/Library/Application\ Support/MobileSync/Backup
• find . -iname 3d0d7e5fb2ce288813306e4d4636395e047a3d28 (you obtain a list of directory which contains that file ... so you have to chose one)
• Run sqllite browser "SQLite Database Browser 2.0 b1.app" then open file 3d0d7e5fb2ce288813306e4d4636395e047a3d28

You can easily browse this file using sqlite so that discover :
-  table name : message (select * from message)
-  columns of table :

ROWID
address
date
text
flags
replace
svc_center
group_id
association_id
height
UIFlags
version
subject
country
headers
recipients
read

Where:

address : phone number from
date : timestamp
Flags : 2 = received / 3 = sent / 33 = ? / 129 = deleted
group_id : it indicates the conversation

Step #2 : find on iPhone the location

From google a possible location on iPhone filesystem is :
 /private/var/mobile/Library/SMS/sms.db
(on old FW : /var/mobile/Library/SMS/sms.db ... and other places ...)
Since I wasn't able to load from location that I found I decided to explore myself the iPhone contents with following lines :

//START: Test Directory Content
 NSString* path = @"/var/mobile/Library";
 NSError* error = nil;
 NSArray* files = [[NSFileManager defaultManager] contentsOfDirectoryAtPath:path error:&error];
 NSLog(@"Directory '%@' has content : '%@'",path,files);
//END: Test Directory Content

Output of above snippet is :

LOG: 2011-08-02 16:36:00.713 ******[975:707] Directory '/var/mobile/Library' has content : '(
  ".localized",
  AddressBook,
  Caches,
  Calendar,
  ...
  SMS,
  Safari,
  SafeHarbor,
  ...
  )'

So directory is present but the problem is when we try to get content of folder SMS. Using above code changing NSString* path = @"/var/mobile/Library/SMS"; 
Output is now : 

/var/mobile/Library/SMS/
2011-08-02 16:39:52.281 *******[994:707] Directory '/var/mobile/Library/SMS/' has content : '(null)'

The same result if we try with : /private/var/mobile/Library/SMS -> has content '(null)'
... maybe  new FW has permissions changed on this location ... or location is wrong...

I'll try to investigate but it seems that SMS isn't readable (schreenhot of my filebrowser-test app)

Step #3 : try to read

I tryed to read some .db (such as sms.db) with the below code the only one which was working is: callhistory.db
Placed here : /private/var/wireless/Library/CallHistory/call_history.db

//END : Test DB sqllite
if (sqlite3_open("/private/var/wireless/Library/CallHistory/call_history.db", &database) == SQLITE_OK)
    {
        NSString *querySQL = [NSString stringWithFormat: @"select * from call;"];
        const char *query_stmt = [querySQL UTF8String];
        const char *error;
        int err = sqlite3_prepare_v2 (database, query_stmt, -1, &statement, &error);
        if (err != SQLITE_OK){
            NSLog(@"Can't execute statement error is '%d'",err);
        }
    } else{
        NSLog(@"Can't open db");
    }
    // Scan Result
    while(sqlite3_step(statement) == SQLITE_ROW) {
        NSString *value1 = [NSString stringWithUTF8String:(char *)sqlite3_column_text(statement, 1)];
        NSLog(@"-->%@",value1);
    }
//END : Test DB sqllite

Other .db location that I found (but not all checked yet) :

  /private/var/mobile/Library/CallHistory/call_history.db:
  /private/var/mobile/Library/SMS/sms.db
  /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
  /private/var/mobile/Library/AddressBook/AddressBookImages.sqlitedb
  /private/var/mobile/Library/Calendar/Calendar.sqlitedb
  /private/var/mobile/Library/Notes/notes.db
  /private/var/mobile/Library/Safari/Bookmarks.plist
  /private/var/mobile/Library/Safari/History.plist
  /private/var/mobile/Library/Safari/SuspendState.plist
  /private/var/mobile/Library/YouTube/Bookmarks.plist
  /private/var/mobile/Library/Mail/Accounts.plist
  /private/var/preferences/SystemConfiguration/com.apple.network.identification.plist
  /private/var/preferences/SystemConfiguration/com.apple.wifi.plist
  /private/var/Keychains/keychain-2.db

 I'll update this post if I'll find something else.