[HN Gopher] Reverse Engineering Apple's typedstream Format
___________________________________________________________________
Reverse Engineering Apple's typedstream Format
Author : css
Score : 96 points
Date : 2025-02-03 15:36 UTC (7 hours ago)
(HTM) web link (chrissardegna.com)
(TXT) w3m dump (chrissardegna.com)
| swiftcoder wrote:
| Nice writeup! I wonder if gnustep's NSUnarchiver could be
| augmented for full compatibility with Foundation?
| nativeit wrote:
| Question from a relatively uninformed sysadmin/freelance I.T.
| provider--will these new iMessage functions allow for 3rd-party
| applications (ie--CRMs, client support platforms, etc.) to read
| and/or work with incoming iMessages from my iCloud account? The
| only thing I really miss since coming from Android was my ability
| to consolidate all of my client communications, many of whom send
| text messages first and foremost (which I prefer).
| css wrote:
| Apple provides Messages for Business [0], but if you have a
| machine that can read the iMessages as they come in, you could
| use the library [1] that powers `imessage-exporter` as a
| bridge.
|
| [0]: https://register.apple.com/messages
|
| [1]: https://docs.rs/imessage-database/latest/
| bengarney wrote:
| I have a product that does exactly this. E-mail me at ben AT
| theengine DOT co, I'd love to show it to you and see if it
| would help.
| setr wrote:
| Don't know if it helps, but I know iMessage stores message data
| on MacBooks inside a SQLite file; I was scanning through it
| previously because I was trying to do a bulk search
| dbyte wrote:
| The grandfather of protobuf. Lost in the tales of time.
| css wrote:
| iMessage uses a very strange amalgamation of typedstream
| (message content), keyed archives (app messages, sticker data),
| and protobufs (Digital Touch, handwriting) for different
| features. I wonder what motivated all of those design
| decisions.
| bengarney wrote:
| This is stuff is such a PIA to parse. I assume it's just
| different teams doing different features over the years, and
| being alternately repulsed/seduced by each format. Probably
| features are implemented as libraries so there isn't a master
| oversight - they aren't trying to make iMessage's internal
| formats follow a consistent plan, just let all the libs
| coexist...
| pixel_tracing wrote:
| As someone who used to work on that team, it's so
| interesting hearing thoughts from external public on the
| team.
| meibo wrote:
| Maybe they should be repulsed, considering all of the
| journalists that are getting persecuted and/or murdered
| because they are getting pwned through iMessage
| serialization bugs :)
| dim13 wrote:
| Grandfather of Protobuf is ASN.1
| foobiekr wrote:
| Very much so. Pretty much all of these protocols are
| simplifications of asn1 and in some cases (like protobuf)
| there are a handful of things that got lost because the wire
| formats didn't have them as they didn't need them. A schema
| indicator being the single biggest flaw in protobuf.
| lt_snuffles wrote:
| I was curious how chat gpt can analyze this giving some general
| instructions
| https://chatgpt.com/share/67a102b0-b3e4-8003-974d-2ef73a738a...
| wpm wrote:
| This is perfectly timed, as I wanted to find a way to
| programmatically modify my Mac's AppleScript display
| settings/theme. For whatever reason, they're stored as
| typedstream format, embedded in a plist in base64. Found an old
| implementation/header from 1999 from Mac OS X Server v1.2, signed
| by Bertrand Serlet, and was going to dig in when I found the
| time. Now I can dig into this.
| css wrote:
| The plist is probably a binary plist (header bytes `bplist00`)
| generated by NSKeyedArchiver, and then the specific data you
| need is encoded inside. Edited iMessages are stored in the
| exact same way. Luckily the plist itself is not that complex-
| but typedstream is pesky to work with.
___________________________________________________________________
(page generated 2025-02-03 23:01 UTC)