views:

147

answers:

2

I am trying to reverse-engineer a preferences file (not for any nefarious purposes, just so that I can script usage of it) that, among other things, has arrays of coordinates stored within it.

This is the salient snippet from the property list:

<dict>
  <key>$class</key>
  <dict>
    <key>CF$UID</key>
    <integer>34</integer>
  </dict>
  <key>coordArray</key>
  <data>
  AAAAAAAAAAAAAAAAAAAAAT70vS8/M7xSPwAAAD8AAAA/AAAA
  </data>
  <key>coordCount</key>
  <integer>1</integer>
</dict>

I assume that data string is an array of coordinates (based on its key name). My question is, how can I figure out what data is stored there? If I simply base64-decode that string, I get gibberish. Is there a way to decode it and cast it into whatever format it came from (NSArray, I think)?

+2  A: 

Why don't you just load it as a property list and inspect the contents?

NSDictionary *plist = [NSDictionary dictionaryWithContentsOfFile:...];
Paul Lynch
The advantage of this solution being that the data element, whose contents are base64-encoded in the XML data, would be decoded automatically by the plist parser. The NSData object within the NSDictionary object would contain the decoded data.
Peter Hosey
Thanks, this is helpful. I'm a total noob with Objective-C still, and I'm trying to figure out how to write and compile a tiny program that could do this.
bantic
You can get the coordArray from the plist dictionary easily enough. From there try the various initWithData: methods to see if any of the Foundation class can handle it. There's no clear way to find out what you have there.
Paul Lynch
+2  A: 

That dictionary looks like an archived object graph to me; I'd try unarchiving it using -[NSKeyedUnarchiver unarchiveObjectWithData:] (or -unarchiveObjectWithFile:).

Wevah
It's not, it's a plist; the archiver works differently.
Paul Lynch
Pretty sure they keyed archiver outputs data that's a binary plist.
Wevah
It could be that there isn't enough data about the class to unarchive it directly, though.
Wevah
I just checked, if it's part of an object graph it's incomplete, so I concede that much; if that's all there is in the full plist, you will probably have to do what Paul suggested and deal with it manually.
Wevah