notesutils VS apple_cloud_notes_parser

I should write this stuff up, but I haven't.

I do have some brief notes on the "Notes.app" format here:

https://github.com/dunhamsteve/notesutils/blob/master/notes....

But I didn't discuss my methodology -- Generic decoding of protobuf, building up a schema as you go -- the tricky part there is that a byte array and a substructure look the same, so you have to try to decode it, and if successful, try that schema on the next example.

Here is another fun technique - scanning through a disassembly of an Apple framework looking for assembly patterns that match the protobuf compiler output (this was dependent on which language was targeted by protobuf):

https://gist.github.com/dunhamsteve/224e26a7f56689c33cea4f0f...

So you find the serializer / deserializer code and figure out what the original protbuf spec looked like.

Here's a Python script that takes the JSON output from https://github.com/threeplanetssoftware/apple_cloud_notes_pa... (needs master), and rebuilds Notes in Markdown format, with links, attachments, lists, etc.:

https://gist.github.com/vszakats/5a3bd939721d1dde6142d9ea3b2...

And simpler, standalone JXA script, that outputs HTML, but loses some data, such as links:

I use this https://github.com/threeplanetssoftware/apple_cloud_notes_pa... and it works extremely well.

A brief googling showed that the encryption is on point, but there are password brute-forcing tools out there, such as this: 1, 2. If you have at least a vague idea of what your password was supposed to be, you can use it to build a password dictionary (again, there should be tools to produce passwords based on an initial wordlist and various permutations, like character substitutions), feed it to a tool like the one above, and wait (maybe a year or two, heh).