get_notepad/get_notepad.py at master · Anti-Forensics/get_notepad · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
import json
import os
import glob


class GetNotepad:
    def __init__(self) -> None:
        self.environ_path = os.environ['LOCALAPPDATA']
        self.np_cache_path = "Packages\\Microsoft.WindowsNotepad_8wekyb3d8bbwe\\LocalState\\TabState\\"
        self.np_cache_path_full = os.path.join(self.environ_path, self.np_cache_path)

    def get_all_files(self) -> list:
        '''
        Filters all files to *.bin removing ".0.bin", ".0.1.bin", ".1.bin".
        :return:
        selected_files (the filtered list of files)
        '''
        selected_files = []

        all_files = glob.glob(os.path.join(self.np_cache_path_full, "*.bin*"))
        for file in all_files:
            if file.endswith(".0.bin") or file.endswith(".1.bin"):
                continue
            selected_files.append(file)

        return selected_files

    def get_file_content(self, full_file_path: str) -> bytes:
        '''
        Read the file and prepare it in a variable
        :param full_file_path:
        :return:
        Full file contents in binary mode.
        '''
        with open(full_file_path, 'br') as file:
            return file.read()

    def get_file_name(self, full_file_path: str) -> str:
        '''
        Returns a file name or prints an error message if issaved
        :param full_file_path:
        :return:
        Returns the extracted and decoded file name otherwise prints an error message.
        '''
        # byte 4
        try:
            if self.get_issaved(full_file_path):
                full_file = self.get_file_content(full_file_path)
                file_name_size = full_file[4] * 2

                return full_file[5:5 + file_name_size].decode("utf-16")
        except:
            print(f"Could not get filename for {full_file_path=}")

    def get_issaved(self, full_file_path: str) -> bool:
        '''
        Determines whether a tab in Notepad is saved to a file.
        :param full_file_path:
        :return:
        issaved: bool
        '''
        full_file = self.get_file_content(full_file_path)
        issaved = bool(full_file[3])
        if type(issaved is bool):
            return issaved

    def get_file_data(self, full_file_path: str) -> str:
        '''
        Slices the .bin to extract only the user content data.
        :param full_file_path:
        :return:
        Returns the data as a string
        '''
        full_file = self.get_file_content(full_file_path)
        pattern = b"\x01\x00\x00\x00"

        data_start = full_file.index(pattern)
        parsed_full = full_file[data_start + 6:-5]

        # try: parse > 255 bytes if exception reduce byte start length
        # encode to utf8 to capture the full content - decode with utf16 prints only last line
        try:
            parsed_full_encode = parsed_full.decode('utf-16le').encode('utf8')
        except:
            parsed_full = full_file[data_start + 5: -5]
            parsed_full_encode = parsed_full.decode('utf-16le').encode('utf8')

        return str(parsed_full_encode)


def main() -> None:
    getnote = GetNotepad()
    np_dictionary = {}
    i = 0

    files = getnote.get_all_files()
    for file in files:
        np_dictionary["filename" + str(i).zfill(4)] = getnote.get_file_name(file)

        # workaround (print on decode only prints last line of data from utf16)
        np_dictionary["data" + str(i).zfill(4)] = getnote.get_file_data(file).strip("b'")

        i += 1

    x = json.dumps(np_dictionary)
    print(x)


if __name__ == "__main__":
    main()