[jensstigaard]

What this changes

Parsing app ru.alexandermalikov.protectednotes artifacts: Notes, settings, passwords, attachments.

For a new or changed artifact

• Ran the tool against a real extraction and confirmed the row counts, not just that it imports.
• Ran python admin/scripts/check_artifact_output.py <report folder> on that report and fixed or documented every finding. An empty or constant column is often a real result (no group chats, coarse location denied); the fix for those is a sentence in the artifact's notes naming the column and saying it was empty or uniform, which is also what stops the checker reporting it.
• Checked it against a second app data directory where the platform provides one (a second user, account, or container). --compare <multi-container report> reads the scaling for you: it should be exactly double.
• notes, description and sample_data say only what the data shows, and the numbers were re-derived from the finished run.

Anything reviewers should know

Includes unit test.

[github-actions]

Test data is now included for every changed artifact module. Thank you!

[abrignoni]

Thanks Jens, this is a careful module. The notes say clearly what was tested on real data and what was only synthetic, and the CI checks all pass. A few things before merge:

1. Fixture. Please add one for the module. From your extraction:

   python admin/test/scripts/make_test_data.py privateNotepad --case <case_number> --input <extraction.zip>
   

   That writes admin/test/cases/testdata.privateNotepad.json and a zip per artifact under admin/test/cases/data/privateNotepad/. If the extraction can't be shared, two options work: overwrite the personal values in the real notes.db and prefs file and keep everything else as the app wrote it, or install the app on a test device, create a few notes, a password entry, an attachment and a lock, and extract that. A scripted session would also give real data for passwords, attachments and intruder photos, which today are only tested on synthetic data.

2. Licence header. The zlib notice says the file is an altered version of other software, but it doesn't say which. Who wrote the original, and where is it? We need to name it so it can be credited. If you wrote all of it yourself, the header can go, since the repo is MIT.

3. Key check. resolve_key tests each candidate key against one field, the first non-empty title, body or password. If that one value is damaged, the right key is rejected and the whole container gives no rows. Could it try a few fields, or fall back to the only key that unwraps and report the fields that fail as stored?

4. Notes length. The paragraph on the data key and decryption is repeated in four artifacts, and in App Settings it points to Key Source in App Settings, its own artifact. One sentence in each artifact, with the full account in Notes, would be easier to read in the report.

5. Small ones:

   • hash_as_hex calls b64decode without validate=True, so stray characters are dropped quietly and the hex can be wrong instead of falling back to the stored value.
   • A last_app_usage_time that isn't a number ends up as text in a datetime column.
   • Notes and Passwords have no Android User column, while Settings and Intruder Photos do. Adding it would make them match.

Thanks again for the work on this one.

[jensstigaard]

Hi Alexis

Thanks for the review statement.

For reference, my answers to the stated bullets.

1. Commit 27575f7 implements a separation of logic enabling smoothly generation of test data.
   Commit 5d6c09f adds a generated zip containing test data for the parser.

2. I have cleaned up the parser script, removing the license header, which were unclear.
   In cooperation with a colleague we originally made a script in 2024, parsing the app for XRY/XAMN. The parser script in this PR is basically just a port of the code from the XRY script authored by me and my collegaue. My colleague is not interested in figuring in the code/repo as an author by the way...

3. Handled in f732589

4. Handled in f732589

5. Handled in 1c6b34a

I have run latest code and tested against repo test data + real data, and it returns the expected number of artifacts.

[abrignoni]

Thanks Jens, the changes look good and the key selection is much safer now. Two CI checks are red, both small:

1. Test Cases: the case zips are in, but there is no recorded snapshot, so all five units report NO_BASELINE. Record them with:

   python admin/test/scripts/test_module.py privateNotepad -a all -c casejens
   

   and commit the JSON files it writes under admin/test/results/privateNotepad/.

2. Python Lint Check: pylint flags unsubscriptable-object on best[0] in resolve_key, because best starts as None. Keeping the count in its own variable (for example best_count = -1) clears it.

The synthetic fixture is fine as a regression case. Your builder says it plainly, that it uses the schema the parser queries and not one seen on a device, so a short note in the Notes artifact saying the committed test data is synthetic would round it out.

On the licence: thanks for explaining. Since the XRY script was written with a colleague, please confirm you are both fine with this port going out under ALEAPP's MIT licence.

[jensstigaard]

1+2 are now fixed with the latest commits.

We confirm the acceptance of MIT licensing when contributing.