olejorgenb / colornote-backup-decryptor

Decrypt a ColorNote backup file to export your notes (https://www.colornote.com)

ColorNote backup decryptor

ColorNote doesn’t support any kind of export (!?) and the backup format is both proprietary and encrypted using an undocumented method.

NB: If you have the app installed or have access to an android phone the alternative methods listed at the end might be simpler.

I’ve included a prebuild jar for convenience.

There is at least two versions of the backup format. I haven’t invested in figuring out a detection mechanism so trial and error is the game :)

Usage

java -jar colornote-decrypt.jar PASSWORD OFFSET < INPUT_FILE > OUTPUT_FILE

If you use oracle’s JRE (likely the case if you’re on windows) you’ll need to run the class file directly instead (send your thanks to the US for their silly encryption export restrictions… and to java for making it unbelivable hard to make a properly bundled program):

Unix:

java -cp lib/bcprov-jdk15on-154.jar:lib/bcpkix-jdk15on-154.jar:bin ColorNoteBackupDecrypt PASSWORD OFFSET < INPUT_FILE > OUTPUT_FILE

Windows: (note the different class path separators : -> ;

java -cp lib/bcprov-jdk15on-154.jar;lib/bcpkix-jdk15on-154.jar;bin ColorNoteBackupDecrypt PASSWORD OFFSET < INPUT_FILE > OUTPUT_FILE

Note: the cleanup scripts are written for linux, but this user ran them successfully using cygwin [#9].

The script reads from standard input and writes to standard output.

The decrypted output is json with some weird prefix and note separators (probably encoding the length of the file and individual notes). A small script attempts to clean the json.

Try both versions below. The following error message indicates that the input file uses another format version:

Exception in thread "main" java.io.IOException: javax.crypto.IllegalBlockSizeException: last block incomplete in decryption

Note: the file-extension of the backup files is sometimes .dat and sometimes .doc (might indicate the version?)

V1:

# 0000 is the default password
java -jar colornote-decrypt.jar 0000 < the-backup-file.doc | fixup-v1 > notes.json

V2:

# 0000 is the default password and 28 is a magic offset
java -jar colornote-decrypt.jar 0000 28 < the-backup-file.doc | fixup-v2 > notes.json

If the json still contains garbage, try tailing the n last lines (one note takes one line): tail -n 100 notes.json (Source)

Each fixup script is only based on a single backup file so they could be incomplete. Let me know if you have problems.

When you have the json file the next step is up to you.

Use format-notes to get a quick view of the notes or the following to get a csv format:

jq --raw-output '[.created_date, .modified_date, .title, .note] | @csv' < notes.json > notes.cvs

Alternative methods

Rooted phone

If you have root access you can get hold of the sqlite db directly: http://danyilbohdan.com/blog/colornote/

I haven’t tried it myself, but someone suggested that you could restore the backup in an emulator if you don’t have a rooted phone.

Using android’s built-in backup system to access the app-private data

Restore your encrypted backup onto a color note installation and do a full app backup using adb: (tested on v4.0.6)

adb backup -noapk com.socialnmobile.dictapps.notepad.color.note

Unpack the resulting backup.ab and you’ll have access to the colornote.db sqlite database.

(Source)

colornote-backup-decryptor's Issues

small doc file but never ending decryption with no error report

Hi Olejorgenb,

Thank you so much for your very useful decryptor.

I just have a question about the processing time because with relatively low doc file (43.6 kb) I had to stop the .jar process after a big quarter of an hour with no message, no error.

could tell me what's your experience in term of processing time ?

thank in advance

Missing License

I would like to publish a Github Repo containing this Repo as a submodule, ideally under the GPLv3 license.

I don't know if I'm allowed to do that though, as this repo does not mention any kind of license.

@olejorgenb could you consider adding a license?

Ambiguous redirect

Thank you for writing this, it came in very handy!

When trying to use your program in Ubuntu Xenial, I couldn't get it to work with the java -jar < *-AUTO.doc | fixup > notes.json. I kept getting ambiguous redirect. Luckily cat *-AUTO.dat | java -jar colornote-backup-decrypt.doc | fixup > notes.json worked.

With the current colornote format, there is a lot of junk at the beginnig of the file too, so it won't open properly, but you can still read it with tail -n 100 notes.json. Instead of 100, put the number of notes you have there, as one note takes a single line.

Other way to clean the output

I´m using Linux tr fucntion to remove any non-printable characters from the output, then replace any characters between json entites with a comma and add the brackets to make the final output a list of json objects

infile=out.json 
outfile=notes.json
tr -c '[:print:]\t\r\n' '[ *]' < $infile | sed -e 's/}[^{]*{/},{/g' | sed -e 's/}.{/},{/g' | sed -e 's/^[^{]*{/[{/' > $outfile ; echo ']' >> $outfile

Hope it can help someone :)

JCE cannot authenticate the provider BC

java -cp colornote-decrypt.jar:bcprov-jdk15on-160.jar ColorNoteBackupDecrypt 0000 28 < 1525831085526-AUTO.doc > notes.json
java.security.NoSuchProviderException: JCE cannot authenticate the provider BC at java.base/javax.crypto.JceSecurity.getInstance(JceSecurity.java:130) at java.base/javax.crypto.SecretKeyFactory.getInstance(SecretKeyFactory.java:212) at ColorNoteBackupDecrypt.init(ColorNoteBackupDecrypt.java:56) at ColorNoteBackupDecrypt.main(ColorNoteBackupDecrypt.java:45) Caused by: java.util.jar.JarException: file:/home/me/colornote-decrypt.jar has unsigned entries - ColorNoteBackupDecrypt.class at java.base/javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:459) at java.base/javax.crypto.JarVerifier.verifyJars(JarVerifier.java:314) at java.base/javax.crypto.JarVerifier.verify(JarVerifier.java:257) at java.base/javax.crypto.ProviderVerifier.verify(ProviderVerifier.java:129) at java.base/javax.crypto.JceSecurity.verifyProvider(JceSecurity.java:189) at java.base/javax.crypto.JceSecurity.getVerificationResult(JceSecurity.java:215) at java.base/javax.crypto.JceSecurity.getInstance(JceSecurity.java:127) ... 3 more Exception in thread "main" java.lang.SecurityException: JCE cannot authenticate the provider BC at java.base/javax.crypto.Cipher.getInstance(Cipher.java:683) at java.base/javax.crypto.Cipher.getInstance(Cipher.java:614) at ColorNoteBackupDecrypt.init(ColorNoteBackupDecrypt.java:69) at ColorNoteBackupDecrypt.main(ColorNoteBackupDecrypt.java:45) Caused by: java.util.jar.JarException: file:/home/me/colornote-decrypt.jar has unsigned entries - ColorNoteBackupDecrypt.class at java.base/javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:459) at java.base/javax.crypto.JarVerifier.verifyJars(JarVerifier.java:314) at java.base/javax.crypto.JarVerifier.verify(JarVerifier.java:257) at java.base/javax.crypto.ProviderVerifier.verify(ProviderVerifier.java:129) at java.base/javax.crypto.JceSecurity.verifyProvider(JceSecurity.java:189) at java.base/javax.crypto.JceSecurity.getVerificationResult(JceSecurity.java:215) at java.base/javax.crypto.JceSecurity.getInstance(JceSecurity.java:127) at java.base/javax.crypto.SecretKeyFactory.getInstance(SecretKeyFactory.java:212) at ColorNoteBackupDecrypt.init(ColorNoteBackupDecrypt.java:56) ... 1 more

Decryption of encrypted single notes

Hi,

thanks for clarifying the issue with java in the last commit. Now I tried again to use the program and it now works well with test cases.

What I am currently missing is the decryption of single encrypted notes. If a single note is encrypted, its property "encrypted" is set to 1 and the "note" string contains the encrypted string.

As far as I have seen in ColorNote (version 4.1) there is no other password than the master one, so also these note texts should be encrypted with the master password already used to decrypt the whole backup file.

Could you perhaps decrypt those, too?

Worked, with lots of cleanup afterwards

Thank you for this! I tried a few of the combinations in your readme and this worked for an archive from October 2023:
java -jar colornote-decrypt.jar 0000 28 < ~/Downloads/colornote-20231026.backup > ~/Downloads/notes.json

How to clean the json

Hi,

Thank you for the script!

I got a json converted. I have not yet managed to clean it up. It says that fixup-v1 or fixup-v2 are not recognized as internal or external commands, operable programs or batch files.

C:\Users\erikp\ColorNote-backup-decryptor-master\ColorNote-backup-decryptor-master>java -jar colornote-decrypt.jar 0000 28 < colornote-20231114.backup | fixup-v2 > notes.json
'fixup-v2' is not recognized as an internal or external command,
operable program or batch file.

Any idea on how to solve it?
Bless you

Can't get it working

I have a backup file 1703299151437-AUTO.backup that was created today and I'm trying to decrypt it. I've downloaded the git directory and called (command followed by output)

java -jar colornote-decrypt.jar 0000 < 1703299151437-AUTO.backup > notes.json

Exception in thread "main" java.io.IOException: javax.crypto.IllegalBlockSizeException: last block incomplete in decryption
	at java.base/javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:128)
	at java.base/javax.crypto.CipherInputStream.read(CipherInputStream.java:242)
	at java.base/javax.crypto.CipherInputStream.read(CipherInputStream.java:219)
	at ColorNoteBackupDecrypt.decrypt(ColorNoteBackupDecrypt.java:92)
	at ColorNoteBackupDecrypt.main(ColorNoteBackupDecrypt.java:46)
Caused by: javax.crypto.IllegalBlockSizeException: last block incomplete in decryption
	at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher.engineDoFinal(Unknown Source)
	at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2085)
	at java.base/javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:125)
	... 4 more

Based on the other recently "Issue" raised by johnhe4, I also tried java -jar colornote-decrypt.jar 0000 28 < 1703299151437-AUTO.backup > notes.json

which exited without error. However, the notes.json that was produced only contains hexadecimal numbers (where I believe it should have contained some human readable JSON). Anyone any idea for what I could try?