Reverse-Engineering Samsung Notes' Locked Handwriting Format
A developer reverse-engineered Samsung Notes' undocumented .sdocx stroke format, decoding NEON-optimized native code to unlock trapped handwriting data.
Samsung Notes stores handwritten strokes inside .sdocx files, a ZIP wrapper around an entirely undocumented binary format. The app only offers flat image or PDF exports, leaving the actual stroke geometry permanently locked away from users.
Starting in October 2025, one developer decompiled the Android APK with jadx to map out the page/layer/stroke object hierarchy, then discovered that the delta-encoded geometry itself is never decoded in Java — it's passed across the JNI boundary to a native library, libSPenModel.so. Disassembling that library in IDA revealed the exact bit layout inside SPen::ObjectStrokeBinaryHandler::sm_RestoreStroke, an ARM NEON-optimized routine: each 16-bit delta splits into a 10-bit integer part, 5-bit fraction, and sign bit, with pressure encoded separately.
The resulting decoder and renderer are now on GitHub. Prior work only went as far as a 2021 script extracting typed text; a January 2026 effort by TimGmbH read point arrays from memory via Frida hooks; and a March 2026 Rust library, twangodev/sdocx, reads the on-disk format directly but gets the delta math wrong, distorting some strokes. One contributor used the new decoder to build a G-code converter that drives a pen plotter to redraw the handwriting stroke-by-stroke in its original order.