package com.ciofecaforensics

Get desktop application:
View/edit binary Protocol Buffers messages

Represents an attachment (embedded object)

Used in: AttributeRun

• optional string attachment_identifier = 1

• optional string type_uti = 2

Represents a "run" of characters that need to be styled/displayed/etc

Used in: Note

• optional int32 length = 1

• optional ParagraphStyle paragraph_style = 2

• optional Font font = 3

• optional int32 font_weight = 5

• optional int32 underlined = 6

• optional int32 strikethrough = 7

• optional int32 superscript = 8

  Sign indicates super/sub

• optional string link = 9

• optional Color color = 10

• optional AttachmentInfo attachment_info = 12

Represents a checklist item

Used in: ParagraphStyle

• optional bytes uuid = 1

• optional int32 done = 2

Represents a color

Used in: AttributeRun

• optional float red = 1

• optional float green = 2

• optional float blue = 3

• optional float alpha = 4

A Dictionary holds many DictionaryElements

Used in: MergeableDataObjectEntry, OrderedSet, OrderedSetOrdering

• repeated DictionaryElement element = 1

Represents an object that has pointers to a key and a value, asserting somehow that the key object has to do with the value object.

Used in: Dictionary

• optional ObjectID key = 1

• optional ObjectID value = 2

A Document has a Note within it.

Used in: NoteStoreProto

• optional int32 version = 2

• optional Note note = 3

Represents a font

Used in: AttributeRun

• optional string font_name = 1

• optional float point_size = 2

• optional int32 font_hints = 3

A List holds details about multiple objects

Used in: MergeableDataObjectEntry

• repeated ListEntry list_entry = 1

A list Entry holds details about a specific object

Used in: List

• optional ObjectID id = 2

• optional ListEntryDetails details = 3

  I dislike this naming, but don't have better information

• optional ListEntryDetails additional_details = 4

List Entry Details hold another object ID and unidentified mapping

Used in: ListEntry

• optional ListEntryDetailsKey list_entry_details_key = 1

• optional ObjectID id = 2

Used in: ListEntryDetails

• optional int32 list_entry_details_type_index = 1

• optional int32 list_entry_details_key = 2

MapEntries have a key that maps to an array of key items and a value that points to an object.

Used in: MergeableDataObjectMap

• optional int32 key = 1

• optional ObjectID value = 2

Similar to Document for Notes, this is what holds the mergeable object

Used in: MergableDataProto

• optional int32 version = 2

  Asserted to be version in https://github.com/dunhamsteve/notesutils

• optional MergeableDataObjectData mergeable_data_object_data = 3

Represents the top level object in a ZMERGEABLEDATA cell

• optional MergableDataObject mergable_data_object = 2

This is the mergeable data object itself and has a lot of entries that are the parts of it along with arrays of key, type, and UUID items, depending on type.

Used in: MergableDataObject

• repeated MergeableDataObjectEntry mergeable_data_object_entry = 3

• repeated string mergeable_data_object_key_item = 4

• repeated string mergeable_data_object_type_item = 5

• repeated bytes mergeable_data_object_uuid_item = 6

Each entry is part of the pbject. For example, one entry might be identifying which UUIDs are rows, and another might hold the text of a cell.

Used in: MergeableDataObjectData

• optional RegisterLatest register_latest = 1

• optional List list = 5

• optional Dictionary dictionary = 6

• optional UnknownMergeableDataObjectEntryMessage unknown_message = 9

• optional Note note = 10

• optional MergeableDataObjectMap custom_map = 13

• optional OrderedSet ordered_set = 16

The Object Map uses its type to identify what you are looking at and then a map entry to do something with that value.

Used in: MergeableDataObjectEntry

• optional int32 type = 1

• repeated MapEntry map_entry = 3

A Note has both text, and then a lot of formatting entries. Other fields are present and not yet included in this proto.

Used in: Document, MergeableDataObjectEntry, OrderedSetOrderingArray

• optional string note_text = 2

• repeated AttributeRun attribute_run = 5

Overarching object in a ZNOTEDATA.ZDATA blob

• optional Document document = 2

ObjectIDs are used to identify objects within the protobuf, offsets in an arry, or a simple String.

Used in: DictionaryElement, ListEntry, ListEntryDetails, MapEntry, RegisterLatest

• optional uint64 unsigned_integer_value = 2

• optional string string_value = 4

• optional int32 object_index = 6

An ordered set is used to hold structural information for embedded tables

Used in: MergeableDataObjectEntry

• optional OrderedSetOrdering ordering = 1

• optional Dictionary elements = 2

The ordered set ordering identifies rows and columns in embedded tables, with an array of the objects and contents that map lookup values to originals.

Used in: OrderedSet

• optional OrderedSetOrderingArray array = 1

• optional Dictionary contents = 2

This array holds both the text to replace and the array of UUIDs to tell what embedded rows and columns are.

Used in: OrderedSetOrdering

• optional Note contents = 1

• repeated OrderedSetOrderingArrayAttachment attachment = 2

This array identifies the UUIDs that are embedded table rows or columns

Used in: OrderedSetOrderingArray

• optional int32 index = 1

• optional bytes uuid = 2

Styles a "Paragraph" (any run of characters in an AttributeRun)

Used in: AttributeRun

• optional int32 style_type = 1

• optional int32 alignment = 2

• optional int32 indent_amount = 4

• optional Checklist checklist = 5

Register Latest is used to identify the most recent version

Used in: MergeableDataObjectEntry

• optional ObjectID contents = 2

This is unknown, it first was noticed in folder order analysis.

Used in: MergeableDataObjectEntry

• optional UnknownMergeableDataObjectEntryMessageEntry unknown_entry = 1

This is unknown, it first was noticed in folder order analysis. "unknown_int2" is where the folder order is stored

Used in: UnknownMergeableDataObjectEntryMessage

• optional int32 unknown_int1 = 1

• optional int64 unknown_int2 = 2