Skip to content

Instantly share code, notes, and snippets.

@theevilbit
Created August 27, 2024 09:42
Show Gist options
  • Select an option

  • Save theevilbit/985d4f1f21737c68e4c123817c3aabe8 to your computer and use it in GitHub Desktop.

Select an option

Save theevilbit/985d4f1f21737c68e4c123817c3aabe8 to your computer and use it in GitHub Desktop.
#!/bin/bash
# Check if the database path is provided as an argument
if [ -z "$1" ]; then
echo "Usage: $0 /path/to/your/database.sqlite"
exit 1
fi
# Use the first argument as the database file path
DB_PATH="$1"
# Query to select the data column as hex from the record table
SQL_QUERY="SELECT hex(data) FROM record;"
# Execute the query and process each row
sqlite3 "$DB_PATH" "$SQL_QUERY" | while read -r HEXDATA; do
# Convert hex to binary and then to plist format
echo "$HEXDATA" | xxd -r -p - | plutil -p -
done
@andrebsb
Copy link

andrebsb commented Aug 5, 2025

/Users/$USER/Library/Group\ Containers/group.com.apple.usernoted/db2 doesn't seem to be user-accessible anymore even with root. Are there known workarounds ?

@theevilbit
Copy link
Author

That is because of macOS's new TCC protection of containers. You can give Full Disk Access permission to your app or allow it through a popup. Not much more you can do.

@leetesla
Copy link

bash parse_notificationdb_records.sh /Users/$USER/Library/Group\ Containers/group.com.apple.usernoted/db2/db

macos 15上运行成功,需要开启“完全磁盘访问”权限

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment