Support Handwritten messages

[ReagentX]

Details are here: https://support.apple.com/en-us/HT206894

[raleighlittles]

@ReagentX Is this currently being worked on?

[ReagentX]

Handwritten (com.apple.Handwriting.HandwritingProvider) messages store their data in a payload_data BLOB, and the data inside is pretty difficult to understand.

[raleighlittles]

Interesting. I don't know anything about iOS development, or that specific library (I tried searching for it and nothing came up).

The handwritten messages on the UI side are handled like images, so maybe there's a Base64 representation there? I see an "=" at byte 0x95, so maybe that's where the sequence ends.

Maybe send several different handwritten messages, and then diff the payload data blob across each of them to try to look for commonalities? @ReagentX

[jnopnop]

@ReagentX , there’s an XZ archive magic number at offset 78: FD 37 7A 58 5A 00. I actually tried stripping off everything before this sequence and the rest is indeed a valid archive. However the unXZipped binary doesn’t look like anything meaningful.
unfortunately I didn’t manage to solve it, maybe you’ll have better luck