I do have some brief notes on the "Notes.app" format here:
https://github.com/dunhamsteve/notesutils/blob/master/notes....
But I didn't discuss my methodology -- Generic decoding of protobuf, building up a schema as you go -- the tricky part there is that a byte array and a substructure look the same, so you have to try to decode it, and if successful, try that schema on the next example.
Here is another fun technique - scanning through a disassembly of an Apple framework looking for assembly patterns that match the protobuf compiler output (this was dependent on which language was targeted by protobuf):
https://gist.github.com/dunhamsteve/224e26a7f56689c33cea4f0f...
So you find the serializer / deserializer code and figure out what the original protbuf spec looked like.
