Archaeology @Archaeology@indieapps.space

From the "We built it for ourselves but maybe someone else will want it?" department at Mothers Ruin Software, a new debugging app for macOS:

Archaeology makes it easier -- or just possible -- to inspect different kinds of binary files that are common on macOS ... and to follow the trail of one binary format that wraps another one.

https://www.mothersruin.com/software/Archaeology/

#MacArchaeology #MacAdmins #MacDev

Speaking of documentation, this project involved a LOT of reverse-engineering work. We wrote up what we learned about many of these formats and how they work here:

https://www.mothersruin.com/software/Archaeology/reverse/

Which may (or may not) prove more useful than the app itself...

But why? When trying to debug problems on macOS, we got tired of:

$ file app-state
app-state: data

And then it gained a life of its own!

We never intended to release it as a product, because who else would WANT such a thing? But then we kept using it over and over again. So we thought, "hey, why not spend another month writing documentation and put it out there in case someone else can use it?"

And here we are.

There's still more that it can do. We've explained all of the binary formats that Archaeology can handle here:

https://www.mothersruin.com/software/Archaeology/formats.html

You can even verify CMS signatures, and inspect the certificates that issued them:

Or a URL bookmark, with file path info and sandbox access rights:

When you find one of those embedded data values, you can drill down into it, whether it's in the same format, or maybe ...

A code signature, with its CMS signature, entitlements and so on:

Even app bundles or standalone Mach-O binaries. See what's embedded in the Mach-O, like code signatures or plists:

Or notarization tickets. See the digests that are considered notarized:

Or keyed archives, such as compiled nib files or app-specific state. Follow the object graph, and see the class names and key-value pairs. You can even search for specific keys, values or classes:

What can you open using Archaeology?

For example, BER-encoded ASN.1 files, such as configuration profiles or App Store receipts. See and navigate the data structure, even if you don't have the definition:

From the "We built it for ourselves but maybe someone else will want it?" department at Mothers Ruin Software, a new debugging app for macOS:

Archaeology makes it easier -- or just possible -- to inspect different kinds of binary files that are common on macOS ... and to follow the trail of one binary format that wraps another one.

https://www.mothersruin.com/software/Archaeology/

#MacArchaeology #MacAdmins #MacDev