Nova 3 backup zip is password-protected

[timbertson]

This is not an issue with your software, but I was hoping maybe you'd know about it. I tried to use this on a backup zip from my new nova 3, but the archive is password-protected.

I posted about it on the boox forums, but no answers so far and I thought maybe you'd have details. I wonder if it's specific to a newer firmware or the nova 3?

[timbertson]

Finally figured it out. Double-posting here for posterity, in case anything happens to the above onyx forum post:

I sent feedback via the device, and the response was that the notes are encrypted with my "user ID". I didn't know what this was - I had setup dropbox sync and a google account, but the email address associated with either of these didn't work as a decryption key. They later clarified it's "an attribute of your onyx account".

To find out your own user ID (which doubles as the encryption key for backed up notes):

• go to settings, setup/login to your onyx account

• create a new notes backup

• go to push.boox.com on a computer

• open the developer tools -> network tab in your browser

• refresh the page

• filter for the url https://push.boox.com/api/1/users/me

• look in the response pane, there should be a JSON document. The uid value is the internal user is the encryption key for your backed-up notes.

I still don't know what the encryption key is when not signed in to an onyx account, the onyx folks claimed that notes are unencrypted when not logged into an onyx account, but that wasn't the case for me.

[mleithner]

@timbertson @bobek Here's a little addendum after a bit of reverse engineering...

The password used for backups that are not created in combination with an Onyx account is share_user.

If this was the only change, we'd just have to add a call to https://docs.python.org/3/library/zipfile.html#zipfile.ZipFile.setpassword while opening it, but it seems (according to #10) that the format has also changed, so there's more work than that...

ETA: For future reference in case they decide to change it: com/onyx/android/sdk/note/ui/backup/request/UnzipBackupFileRequest contains the logic related to unzipping backups, including the three types of passwords (Onyx uid, hardcoded share_user, or null) they support.