Reverse engineering/decoding Plist data

Question

Created Sep ’21

Replies 3

Boosts 0

Views 3.1k

Participants 3

I have plist files that have around 60K lines of code (per BBEdit), and I'm trying to decode some data points saved in these files. The database company I purchased the software through will not convert my data out to another format (CSV or otherwise) that I can use with a competitor's product, and they will not convert it internally and send me the exported data. I've started to go through and change one value at a time in my program and then look at the plist and see where the change was made, and I'm trying to figure out if there is a way to find out what the integers are referencing?

I am not a programmer, though I'm attempting to learn due to this problem I'm experiencing. I've searched for information on how Plists work, and it seems as though the integer value is referencing some place earlier in the plist document, but as I did not write this program, nor do I have access to source or any help from the company, so I'm going to have to reverse engineer this so that I can export the data points I want to save. A royal PITA, but there you have it. CF$UID appears to be a Core Foundation unique identifier, but that's all I've got and I haven't found much info as to what it does or how it works, and the values inside the tags are not those of what I enter in the program. Any suggestions on where to start would be most helpful.

<dict>
    <key>$archiver</key>
    <string>NSKeyedArchiver</string>
    <key>$objects</key>
    <array>
    ...some 30-40K lines later
    <dict>
        <key>$class</key>
        <dict>
            <key>CF$UID</key>
            <integer>153</integer>
        </dict>
        <key>stringValue</key>
        <dict>
            <key>CF$UID</key>
            <integer>24</integer>   <--- this is the value that's changing for my particular data point I'm interested in.
        </dict>

... so on and so forth, then at the end, something like this.

    </array>
    <key>$top</key>
    <dict>
        <key>root</key>
        <dict>
            <key>CF$UID</key>
            <integer>1</integer>
        </dict>
    </dict>
    <key>$version</key>
    <integer>100000</integer>
</dict>
</plist>

I'm also not used to this Apple Discussion method of just asking a question, but not seeing any forum categories. I'm trying to assign a tag, but tags I see aren't those of what I think I'm asking so I apologize if this is routed to the wrong area, or worse it never gets seen. Why does Apple have a "Overview" page with 15-16 posts on it, vs. discussion forum categories like any other forum? Would make looking for and seeing questions so much easier, unless there's some hidden view preferences I'm missing.

Boost

Answer 1

Claude31 OP

Sep ’21

Is it the info.plist or a specific plist ?

What you could do:

if info.plist:

create a new "empty" project.
Then open the info.plist as Source Code
You'll get this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CFBundleDevelopmentRegion</key>
	<string>$(DEVELOPMENT_LANGUAGE)</string>
	<key>CFBundleExecutable</key>
	<string>$(EXECUTABLE_NAME)</string>
	<key>CFBundleIdentifier</key>
	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>

// etc…

	<key>UILaunchStoryboardName</key>
	<string>LaunchScreen</string>
	<key>UIMainStoryboardFile</key>
	<string>Main</string>
	<key>UIRequiredDeviceCapabilities</key>
	<array>
		<string>armv7</string>
	</array>
	<key>UISupportedInterfaceOrientations</key>
	<array>
		<string>UIInterfaceOrientationPortrait</string>
		<string>UIInterfaceOrientationLandscapeLeft</string>
		<string>UIInterfaceOrientationLandscapeRight</string>
	</array>
	<key>UISupportedInterfaceOrientations~ipad</key>
	<array>
		<string>UIInterfaceOrientationPortrait</string>
		<string>UIInterfaceOrientationPortraitUpsideDown</string>
		<string>UIInterfaceOrientationLandscapeLeft</string>
		<string>UIInterfaceOrientationLandscapeRight</string>
	</array>
</dict>
</plist>

Copy the 60K, at the end, just before the last
Reopen as Property List

See if it is more readable

if not info.plist:

create a new file in Xcode, selecting Property list type:

New Property List.png

open the info.plist as Source Code
Paste the 60K lines
open as Property List

0

Answer 2

Scott J OP

Sep ’21

That's the file format for an object graph serialized by the NSKeyedArchiver API. As you've found, it’s built on Apple's lower level property list structure, which uses XML, but it’s definitely not intended to be human-readable. The format isn't officially documented that I know of, but a quick search turned up these pages that may be helpful:

https://www.mac4n6.com/blog/2016/1/1/manual-analysis-of-nskeyedarchiver-formatted-plist-files-a-review-of-the-new-os-x-1011-recent-items
https://digitalinvestigation.wordpress.com/2012/04/04/geek-post-nskeyedarchiver-files-what-are-they-and-how-can-i-use-them/

There are a few approaches you could try. The various tools referenced from those pages purport to convert this format into something more usable, though you'd still need more processing to yield your data in the format you want, using the programming language of your choice. Or you could try to reverse engineer the app's data model from the metadata in the file (class names, inheritance, and member names) and then mock up an equivalent data model in a Swift program to deserialize the file directly.

0

Answer 3

Scott J OP

Sep ’21

You didn't miss anything on forum usage; indeed it’s a single stream of messages with tags. Personally I just check in a few times per day and scan through the full overview list to see if there's anything interesting.

0