https://github.com/n3rada/sharpnotesreader

A C# light executable that read Windows 11 Notes from TabState directory.
https://github.com/n3rada/sharpnotesreader

csharp execute-assembly forensics-tools notepad offensive-security red-team windows-11

Last synced: about 1 month ago
JSON representation

A C# light executable that read Windows 11 Notes from TabState directory.

• Host: GitHub
• URL: https://github.com/n3rada/sharpnotesreader
• Owner: n3rada
• License: bsd-3-clause
• Created: 2024-09-04T20:29:43.000Z (4 months ago)
• Default Branch: main
• Last Pushed: 2024-09-05T13:53:51.000Z (4 months ago)
• Last Synced: 2024-11-12T22:38:06.785Z (about 1 month ago)
• Topics: csharp, execute-assembly, forensics-tools, notepad, offensive-security, red-team, windows-11
• Language: C#
• Homepage:
• Size: 84 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# SharpNotesReader

`SharpNotesReader` is a tool designed to **extract unsaved notes from Windows 11's Notepad** (`Notepad.exe`) session files. This feature allows quick-typed notes to persist even after the application is closed and reopened later. The tool lets you retrieve and read those unsaved files, providing insight into the hidden "`TabState`" files Notepad uses.

Many users rely on Notepad for tasks like quickly jotting down passwords or short notes:

![notes](./images/notes.png)

With a bit of trickery and a few lines of code, you can look into the stored note data located at `%localAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState` and extract the content:

![example](./images/example.png)

## Build Instruction

Open the solution (`.sln`) file with `Visual Studio`, and build the solution (`F7`). Executable will be located at `SharpNotesReader\bin\Release\SharpNotesReader.exe`. 

## In-Memory

Since disk is as "floor is lava", the binaries produced using `C#` are, by their inherent design, _de facto_ in-memory executables. This characteristic makes them highly versatile and powerful for stealthy execution without touching the disk.

## TODO

The only remaining enhancement for `SharpNotesReader` is support for reading active unsaved chunks in real-time. Currently, the tool requires Notepad to be closed before it can retrieve "proper" notes from the binaries files.