4

I have lost some data from my text files written in Textwrangler on Macbook Air. I have found some of them in file which have extension .plist. File is written in xml and looks like this: 

 <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<key>/Applications/MAMP/htdocs/04. Clock-box/login.php</key>
        <dict>
            <key>BBEditStateData</key>
            <dict>
                <key>MainScrollBar</key>
                <integer>0</integer>
                <key>PrintDateIsModificationDate</key>
                <string>asmo</string>
                <key>PrintingFont</key>
                <data>
                YnBsaXN0MDDUAQIDBAUIKClUJHRvcFgkb2JqZWN0c1gk
                dmVyc2lvblkkYXJjaGl2ZXLRBgdUcm9vdIABqQkKDxka
                GxwdJFUkbnVsbNILDA0OViRjbGFzc18QGk5TRm9udERl
                c2NyaXB0b3JBdHRyaWJ1dGVzgAiAAtMQCxESFRZaTlMu
                b2JqZWN0c1dOUy5rZXlzohMUgAWABoAHohcYgAOABF8Q
                E05TRm9udE5hbWVBdHRyaWJ1dGVfEBNOU0ZvbnRTaXpl
                QXR0cmlidXRlXU1lbmxvLVJlZ3VsYXIiQUAAANIeHyAh
                WCRjbGFzc2VzWiRjbGFzc25hbWWjISIjXxATTlNNdXRh
                YmxlRGljdGlvbmFyeVxOU0RpY3Rpb25hcnlYTlNPYmpl
                Y3TSHh8lJ6ImI18QEE5TRm9udERlc2NyaXB0b3JfEBBO
                U0ZvbnREZXNjcmlwdG9yEgABhqBfEA9OU0tleWVkQXJj
                aGl2ZXIACAARABYAHwAoADIANQA6ADwARgBMAFEAWAB1
                AHcAeQCAAIsAkwCWAJgAmgCcAJ8AoQCjALkAzwDdAOIA
                5wDwAPsA/wEVASIBKwEwATMBRgFZAV4AAAAAAAACAQAA
                AAAAAAAqAAAAAAAAAAAAAAAAAAABcA==
                </data>
                <key>SelectionEnd</key>
                <integer>892</integer>
                <key>SelectionStart</key>
                <integer>0</integer>
                <key>WindowShape</key>
                <string>rect(45,14,1011,1317)</string>
            </dict>
            <key>LastAccessed</key>
            <date>2014-12-09T14:22:18Z</date>
            <key>MD5</key>
            <data>
            QTYyMjQ4QjkwMERCRDhEMDgyQjlBMkUxMUZGODBEMkI=
            </data>
        </dict>

How could I decode data inside "data" tags?

user3100193
  • 531
  • 4
  • 6
  • 16

2 Answers2

2

The code in data is Base64, which can be easily decoded with any online tool, like this one.

The data for PrintingFont will decode into a binary file wich contains information that will look more or less like this if converted to ASCII (obviously excluding the comment):

// !!! BINARY PROPERTY LIST WARNING !!!
//
// The pretty-printed property list below has been created
// from a binary version on disk and should not be saved as
// the ASCII format is a subset of the binary representation!
//
{   "$archiver" = "NSKeyedArchiver";
    "$objects" = (
        "$null",
        {   "$class" = :false;
            NSFontDescriptorAttributes = :false;
        },
        {   "$class" = :false;
            NS.keys = ( :false, :false );
            NS.objects = ( :false, :false );
        },
        "NSFontNameAttribute",
        "NSFontSizeAttribute",
        "Menlo-Regular",
        12,
        {   "$classes" = ( "NSMutableDictionary", "NSDictionary", "NSObject" );
            "$classname" = "NSMutableDictionary";
        },
        {   "$classes" = ( "NSFontDescriptor", "NSObject" );
            "$classname" = "NSFontDescriptor";
        },
    );
    "$top" = { root = :false; };
    "$version" = 100000;
}

The MD5 data decodes to A62248B900DBD8D082B9A2E11FF80D2B, which I would say is a MD5 hash.

Daniel
  • 20,420
  • 10
  • 92
  • 149
  • 1
    The Web tool gives me some text much less readable and much smaller than this. How do you get this? – Nicolas Barbulesco Mar 28 '15 at 20:03
  • You mean a MD5 hash? ;-) – Nicolas Barbulesco Mar 29 '15 at 14:17
  • @Nicolas When you open a binary plist file with TextMate, it looks like this. – grg Mar 29 '15 at 19:07
  • @grgarside - I have a big encoded block of data in a "data" element, like in the question. How can I decode it? After the Web tool to decode Base64, the result is still encoded in some form. – Nicolas Barbulesco Mar 31 '15 at 19:05
  • 4
    @Nicolas Here's a full, step-by-step guide on how to [decode data plist](https://georgegarside.com/blog/decode-data-plist/). Feel free to invite me to chat or discuss this in the comments over there if you want more guidance. – grg Apr 01 '15 at 10:27
  • @grgarside — Thank you for your kindness. Now, I have managed to decode the data, one million thanks to Rob! I will sum up the solution by commenting the answer by Rob. – Nicolas Barbulesco Apr 01 '15 at 20:24
0

You could either:

  1. Load the plist into a dictionary object using NSDictionary method initWithContentsOfFile; or

  2. Manually convert the base64 string back to a NSData with initWithBase64EncodedString.

Rob
  • 415,655
  • 72
  • 787
  • 1,044
  • 1
    How to do that without writing a program? Or with writing an AppleScript? :-) – Nicolas Barbulesco Mar 28 '15 at 20:05
  • I want to decode encoded strings in PList files from Safari Mac or from Safari iOS. – Nicolas Barbulesco Mar 29 '15 at 13:49
  • I have just tried your link. The tools does give me a result, but very hard to read, with a lot of garbage. – Nicolas Barbulesco Mar 29 '15 at 13:55
  • Apple does not respect your "only". Apple encodes the data probably for performance. Actually, the kind of data I want to read is in clear in iOS 7, but now in iOS 8 Apple encodes it, grr! Now, I have a block of data inside a "data" element of a PList file. A block represents the state of a Safari tab, with navigation history. Safari uses this to restore the session, with all the open tabs and their navigation history — well, when it works. – Nicolas Barbulesco Mar 29 '15 at 14:29
  • If you have an iPad or an iPhone, on iOS 8, you can have a look at the file SuspendState.plist of Safari. I would appreciate it. – Nicolas Barbulesco Mar 29 '15 at 14:35
  • 1
    @NicolasBarbulesco Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/74035/discussion-between-rob-and-nicolas-barbulesco). – Rob Mar 29 '15 at 15:07