2

In Firefox 64 on macOS, when I view one of the disk cache entries under about:cache I see a page that looks something like the code I pasted below. I have deleted most of the long string of code after "security-info" and all but the first three lines of the hex and ascii codes at the end.

How can I restore the content of the file into a human readable format?

I have found quite a few solutions which require tools that only run under Windows, but I'm on macOS. I have also tried to save the hex code (e.g. for the first line: 00000000: 1f 8b 08 00 00 00 00 00 00 03 ed bd fb 72 db 48) into a file with UTF-8 encoding and UNIX linefeeds and .gzip as the file ending and then unpacking it, but all I got was the same hex code again. Do I need to delete the 00000000: at the beginning? Use another file format? Another file ending and/or decoder?

Cache entry information
key:    https://www.some-site.com/
fetch count:    2
last fetched:   2018-12-16 20:17:21
last modified:  2018-12-17 06:31:53
expires:    Expired Immediately
Data size:  17911 B
Security:   This is a secure document.
strongly-framed:    1
security-info:  FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEap ... (and so on)
request-method:     POST
request-Accept-Encoding:    gzip, deflate, br
request-User-Agent:     Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:64.0) Gecko/20100101 Firefox/64.0
response-head:  HTTP/1.1 200 OK
Server: Server
Date: Sun, 16 Dec 2018 19:17:14 GMT
Content-Type: text/html; charset=utf-8
Status: 200 OK
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Request-Id: 2K84AFOOBARX4FNG9D4
ETag: W/"76e8cacfoobar0b8be5"
Cache-Control: max-age=0, private, must-revalidate
X-Runtime: 0.300085
X-Content-Type-Options: nosniff, nosniff
Content-Encoding: gzip
x-amz-rid: 2K84AFOOBARX4FNG9D4
Vary: Accept-Encoding,User-Agent
original-response-headers:  Server: Server
Date: Sun, 16 Dec 2018 19:17:14 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Status: 200 OK
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Request-Id: 2K84AFOOBARX4FNG9D4
ETag: W/"76e8cacfoobar0b8be5"
Cache-Control: max-age=0, private, must-revalidate
X-Runtime: 0.300085
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Set-Cookie: _session_id2=9f298foobarfb208b; path=/; expires=Mon, 17 Dec 2018 01:17:14 -0000; HttpOnly
x-amz-rid: 2K84AFOOBARX4FNG9D4
Vary: Accept-Encoding,User-Agent
net-response-time-onstart:  1266
net-response-time-onstop:   1274

00000000:  1f  8b  08  00  00  00  00  00  00  03  ed  bd  fb  72  db  48  .............r.H
00000010:  92  2f  fc  f7  f8  29  d0  9c  d9  96  fc  b5  78  27  75  b3  ./...)......x'u.
00000020:  25  1f  59  b6  dc  ee  76  bb  dd  96  3c  9e  6e  af  83  01  %.Y...v...<.n...
... (and so on)

1 Answers1

3

You need to extract the hexadecimal from between the colon and the dots or whatever on the right, and convert that back to binary. You will then have, in the case shown, a gzip stream that can be decompressed by gzip. You can use xxd -r -p to convert the hex into binary.

Mark Adler
  • 101,978
  • 13
  • 118
  • 158
  • Thank you. I have used XCode as described in on of the answers to this question: https://stackoverflow.com/questions/827326/whats-a-good-hex-editor-viewer-for-the-mac, which like so many useful questions on SO has been closed as "not constructive". –  Dec 17 '18 at 20:09
  • Just saved me re-writing 1000+ characters! If you'd like to use `regex` to select and delete the sides, use: `^.{8}:` to select the left side, and `.{16}$` to select the right side. Just delete the selected parts then (e.g. replace with "") – Peter Nov 30 '19 at 10:43