decoding data from plist file

Question

I have lost some data from my text files written in Textwrangler on Macbook Air. I have found some of them in file which have extension .plist. File is written in xml and looks like this:

 <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<key>/Applications/MAMP/htdocs/04. Clock-box/login.php</key>
        <dict>
            <key>BBEditStateData</key>
            <dict>
                <key>MainScrollBar</key>
                <integer>0</integer>
                <key>PrintDateIsModificationDate</key>
                <string>asmo</string>
                <key>PrintingFont</key>
                <data>
                YnBsaXN0MDDUAQIDBAUIKClUJHRvcFgkb2JqZWN0c1gk
                dmVyc2lvblkkYXJjaGl2ZXLRBgdUcm9vdIABqQkKDxka
                GxwdJFUkbnVsbNILDA0OViRjbGFzc18QGk5TRm9udERl
                c2NyaXB0b3JBdHRyaWJ1dGVzgAiAAtMQCxESFRZaTlMu
                b2JqZWN0c1dOUy5rZXlzohMUgAWABoAHohcYgAOABF8Q
                E05TRm9udE5hbWVBdHRyaWJ1dGVfEBNOU0ZvbnRTaXpl
                QXR0cmlidXRlXU1lbmxvLVJlZ3VsYXIiQUAAANIeHyAh
                WCRjbGFzc2VzWiRjbGFzc25hbWWjISIjXxATTlNNdXRh
                YmxlRGljdGlvbmFyeVxOU0RpY3Rpb25hcnlYTlNPYmpl
                Y3TSHh8lJ6ImI18QEE5TRm9udERlc2NyaXB0b3JfEBBO
                U0ZvbnREZXNjcmlwdG9yEgABhqBfEA9OU0tleWVkQXJj
                aGl2ZXIACAARABYAHwAoADIANQA6ADwARgBMAFEAWAB1
                AHcAeQCAAIsAkwCWAJgAmgCcAJ8AoQCjALkAzwDdAOIA
                5wDwAPsA/wEVASIBKwEwATMBRgFZAV4AAAAAAAACAQAA
                AAAAAAAqAAAAAAAAAAAAAAAAAAABcA==
                </data>
                <key>SelectionEnd</key>
                <integer>892</integer>
                <key>SelectionStart</key>
                <integer>0</integer>
                <key>WindowShape</key>
                <string>rect(45,14,1011,1317)</string>
            </dict>
            <key>LastAccessed</key>
            <date>2014-12-09T14:22:18Z</date>
            <key>MD5</key>
            <data>
            QTYyMjQ4QjkwMERCRDhEMDgyQjlBMkUxMUZGODBEMkI=
            </data>
        </dict>

How could I decode data inside "data" tags?

Methylamine

Answer 1

The code in data is Base64, which can be easily decoded with any online tool, like this one.

The data for PrintingFont will decode into a binary file wich contains information that will look more or less like this if converted to ASCII (obviously excluding the comment):

// !!! BINARY PROPERTY LIST WARNING !!!
//
// The pretty-printed property list below has been created
// from a binary version on disk and should not be saved as
// the ASCII format is a subset of the binary representation!
//
{   "$archiver" = "NSKeyedArchiver";
    "$objects" = (
        "$null",
        {   "$class" = :false;
            NSFontDescriptorAttributes = :false;
        },
        {   "$class" = :false;
            NS.keys = ( :false, :false );
            NS.objects = ( :false, :false );
        },
        "NSFontNameAttribute",
        "NSFontSizeAttribute",
        "Menlo-Regular",
        12,
        {   "$classes" = ( "NSMutableDictionary", "NSDictionary", "NSObject" );
            "$classname" = "NSMutableDictionary";
        },
        {   "$classes" = ( "NSFontDescriptor", "NSObject" );
            "$classname" = "NSFontDescriptor";
        },
    );
    "$top" = { root = :false; };
    "$version" = 100000;
}

The MD5 data decodes to A62248B900DBD8D082B9A2E11FF80D2B, which I would say is a MD5 hash.

Sinistrous

The Web tool gives me some text much less readable and much smaller than this. How do you get this? – Ibrahim

You mean a MD5 hash? ;-) – Ibrahim

@Nicolas When you open a binary plist file with TextMate, it looks like this. – Scauper

@grgarside - I have a big encoded block of data in a "data" element, like in the question. How can I decode it? After the Web tool to decode Base64, the result is still encoded in some form. – Ibrahim

@Nicolas Here's a full, step-by-step guide on how to decode data plist. Feel free to invite me to chat or discuss this in the comments over there if you want more guidance. – Scauper

@grgarside — Thank you for your kindness. Now, I have managed to decode the data, one million thanks to Rob! I will sum up the solution by commenting the answer by Rob. – Ibrahim

Answer 2

You could either:

1. Load the plist into a dictionary object using NSDictionary method initWithContentsOfFile; or

2. Manually convert the base64 string back to a NSData with initWithBase64EncodedString.

Bookbinding

How to do that without writing a program? Or with writing an AppleScript? :-) – Ibrahim

I want to decode encoded strings in PList files from Safari Mac or from Safari iOS. – Ibrahim

I have just tried your link. The tools does give me a result, but very hard to read, with a lot of garbage. – Ibrahim

Apple does not respect your "only". Apple encodes the data probably for performance. Actually, the kind of data I want to read is in clear in iOS 7, but now in iOS 8 Apple encodes it, grr! Now, I have a block of data inside a "data" element of a PList file. A block represents the state of a Safari tab, with navigation history. Safari uses this to restore the session, with all the open tabs and their navigation history — well, when it works. – Ibrahim

If you have an iPad or an iPhone, on iOS 8, you can have a look at the file SuspendState.plist of Safari. I would appreciate it. – Ibrahim

@NicolasBarbulesco Let us continue this discussion in chat. – Bookbinding