search

olejorgenb / ColorNote-backup-decryptor

Decrypt a ColorNote backup file to export your notes (https://www.colornote.com)
MIT License
52 stars 9 forks source link

Decryption of encrypted single notes #3

Open bbcquincy opened 5 years ago

bbcquincy commented 5 years ago

Hi,

thanks for clarifying the issue with java in the last commit. Now I tried again to use the program and it now works well with test cases.

What I am currently missing is the decryption of single encrypted notes. If a single note is encrypted, its property "encrypted" is set to 1 and the "note" string contains the encrypted string.

As far as I have seen in ColorNote (version 4.1) there is no other password than the master one, so also these note texts should be encrypted with the master password already used to decrypt the whole backup file.

Could you perhaps decrypt those, too?

olejorgenb commented 5 years ago

Hm, I think that must be a new feature. I think the best approach would be do make a new backup without encryption of the individual notes (if possible in newest color note version).

I don't have time (or motivation to support colornote's for free really :)) to add new features.

A wild guess would be to extract the encrypted string (which most likely is base64 encoded if part of the json file. base64 decode it and try to run the decryption on the resulting file. I doubt it will work though. It's likely that the encryption is done in a slightly different way.

If you're familiar with programming you could attempt to decompile the latest version and find out how they do the new encryption. I will accept a PR.

I recommend moving on to another program with actual export functionality.

marco-venuti commented 7 months ago

Hi @olejorgenb, I tried to decrypt the encrypted note after decoding its base64 string as appearing in the json, but it didn't work. I used the same algorithm as you did for the master file, with the same salt and my master password. The algorithm itself does not fail, but it produces a random result instead. Since the input binary must at least be of certain format or size, I'd guess that the encryption algorithm could indeed be correct, but maybe the salt is different. How did you find the salt in the first place? Did you find it somehow in the decompiled binary of the app?

olejorgenb commented 7 months ago

How did you find the salt in the first place? Did you find it somehow in the decompiled binary of the app?

I unpacked the apk file and used a java disassembler to inspect the code.