khanhduytran0/bl_sbx ? reverse-engineered prompt

Build me a small Python proof of concept that demonstrates how a crafted downloads.28.sqlitedb and BLDatabaseManager.sqlite can be used to test the iTunesStored and bookassetd sandbox escape on iOS.

I want it to be easy to run from one script, with the needed files generated or prepared automatically, and a simple way to point it at the target payload files. It should show how the two stage flow works, first getting the database into a writable container, then using the book download path to place files into restricted locations under /private/var/ for a device I own and am testing.

Please keep it practical and lightweight, with clear comments and a few notes on what each part is doing. If you need current iOS or database details, look up the latest docs online. Also include a short README style explanation of how to run it and what success looks like, like confirming that a MobileGestalt cache file or similar mobile owned file was written.