Keychain-Dumper VS notesutils

Re keychain, you're probably aware of it, but https://github.com/ptoomey3/Keychain-Dumper/ is very thorough in extracting keychain data (including data that one would expect to no longer be in there).

I have also tried Keychain-Dumper, but when I run this via SSH I get an error saying "No Password Keychain items found. You should Unlock your device" (my device has a 4 digit passcode that has been entered before running the dumper). I can see the Keychain-2.db and Keychain-ota-backup.plist that seem to contain the info I need, but its all heavily encrypted.

I should write this stuff up, but I haven't.

I do have some brief notes on the "Notes.app" format here:

https://github.com/dunhamsteve/notesutils/blob/master/notes....

But I didn't discuss my methodology -- Generic decoding of protobuf, building up a schema as you go -- the tricky part there is that a byte array and a substructure look the same, so you have to try to decode it, and if successful, try that schema on the next example.

Here is another fun technique - scanning through a disassembly of an Apple framework looking for assembly patterns that match the protobuf compiler output (this was dependent on which language was targeted by protobuf):

https://gist.github.com/dunhamsteve/224e26a7f56689c33cea4f0f...

So you find the serializer / deserializer code and figure out what the original protbuf spec looked like.