Archaeology - Network

Version 1.2 fixes a bug in the decoding of ASN.1 BIT STRINGs. These are now always shown in binary, but you can select one and see it as an...

Version 1.2 fixes a bug in the decoding of ASN.1 BIT STRINGs. These are now always shown in binary, but you can select one and see it as an integer (in various radixes) in the info pane.

Also, the context menu in the property list view now has commands for copying just keys, values or hex-encoded data, in addition to an XML-format plist.

https://www.mothersruin.com/software/Archaeology/update.html

Version 1.1 can decode launch constraints, new in macOS Sonoma. Archaeology shows these as Boolean expressions, akin to the Code Signing...

Version 1.1 can decode launch constraints, new in macOS Sonoma. Archaeology shows these as Boolean expressions, akin to the Code Signing Requirement language, which is (we think) easier to read. You can even test evaluation of constraints.

Speaking of Code Signing Requirements, this version can also decode the designated requirement found is basically every code signature (and supports evaluating these as well).

https://www.mothersruin.com/software/Archaeology/update.html

Speaking of documentation, this project involved a LOT of reverse-engineering work. We wrote up what we learned about many of these formats...

Speaking of documentation, this project involved a LOT of reverse-engineering work. We wrote up what we learned about many of these formats and how they work here:

https://www.mothersruin.com/software/Archaeology/reverse/

Which may (or may not) prove more useful than the app itself...

But why? When trying to debug problems on macOS, we got tired of:$ file app-stateapp-state: dataAnd then it gained a life of its own!We...

But why? When trying to debug problems on macOS, we got tired of:

$ file app-state
app-state: data

And then it gained a life of its own!

We never intended to release it as a product, because who else would WANT such a thing? But then we kept using it over and over again. So we thought, "hey, why not spend another month writing documentation and put it out there in case someone else can use it?"

And here we are.

There's still more that it can do. We've explained all of the binary formats that Archaeology can handle...

There's still more that it can do. We've explained all of the binary formats that Archaeology can handle here:

https://www.mothersruin.com/software/Archaeology/formats.html

You can even verify CMS signatures, and inspect the certificates that issued them:

You can even verify CMS signatures, and inspect the certificates that issued them:

Or a URL bookmark, with file path info and sandbox access rights:

Or a URL bookmark, with file path info and sandbox access rights:

When you find one of those embedded data values, you can drill down into it, whether it's in the same format, or maybe ...A code...

When you find one of those embedded data values, you can drill down into it, whether it's in the same format, or maybe ...

A code signature, with its CMS signature, entitlements and so on:

Even app bundles or standalone Mach-O binaries. See what's embedded in the Mach-O, like code signatures or plists:

Even app bundles or standalone Mach-O binaries. See what's embedded in the Mach-O, like code signatures or plists:

Or notarization tickets. See the digests that are considered notarized:

Or notarization tickets. See the digests that are considered notarized:

Or keyed archives, such as compiled nib files or app-specific state. Follow the object graph, and see the class names and key-value pairs....

Or keyed archives, such as compiled nib files or app-specific state. Follow the object graph, and see the class names and key-value pairs. You can even search for specific keys, values or classes:

What can you open using Archaeology?For example, BER-encoded ASN.1 files, such as configuration profiles or App Store receipts. See and...

What can you open using Archaeology?

For example, BER-encoded ASN.1 files, such as configuration profiles or App Store receipts. See and navigate the data structure, even if you don't have the definition:

From the "We built it for ourselves but maybe someone else will want it?" department at Mothers Ruin Software, a new debugging app...

From the "We built it for ourselves but maybe someone else will want it?" department at Mothers Ruin Software, a new debugging app for macOS:

Archaeology makes it easier -- or just possible -- to inspect different kinds of binary files that are common on macOS ... and to follow the trail of one binary format that wraps another one.

https://www.mothersruin.com/software/Archaeology/

#MacArchaeology #MacAdmins #MacDev