mac_apt VS notesutils

If you are capable of running cli applications macApt is pretty sophisticated and feature rich analysis tool for MacOS. If it doesn’t have the exact feature you need you could extend it to identify activities of this ‘foreign’ software. Full disclosure I contributed to this project by developing the Docker container, and published the work, unpaid.

I should write this stuff up, but I haven't.

I do have some brief notes on the "Notes.app" format here:

https://github.com/dunhamsteve/notesutils/blob/master/notes....

But I didn't discuss my methodology -- Generic decoding of protobuf, building up a schema as you go -- the tricky part there is that a byte array and a substructure look the same, so you have to try to decode it, and if successful, try that schema on the next example.

Here is another fun technique - scanning through a disassembly of an Apple framework looking for assembly patterns that match the protobuf compiler output (this was dependent on which language was targeted by protobuf):

https://gist.github.com/dunhamsteve/224e26a7f56689c33cea4f0f...

So you find the serializer / deserializer code and figure out what the original protbuf spec looked like.