What character encoding or file format does NSKeyedArchiver use?

2
votes

I am currently investigating a crash during unarchiving of a file supposedly stored through NSKeyedArchiver. The crash log contains the first 8 byte quartets of the file (I only included the first 2 below).

Fatal Exception: NSInvalidArgumentException
*** -[NSKeyedUnarchiver initForReadingWithData:]: incomprehensible archive (0xffffffa6, 0xffffff9e, ...)

I have been unable to decode these bytes into anything useful using ASCII, Base64, UTF8 or UTF16. Does anyone know what kind of file format and/or character encoding NSKeyedArchiver uses or how I could decode these bytes to something human readable?

1
iosnscodingnskeyedarchiver
Perhaps the fact that you can't decode it into anything sensible is precisely because it's corrupted. - Avi
@Avi Yes, that could be correct. It's just weird that the only way the file is written is through an NSKeyedArchiver - at least as far as I can see. Hence, I was hoping there was a way to manually decode an archive into something human readable. - hennes
It might a binary plist. - Avi
It is indeed a binary plist. You can use plutil -p on your archive file. There are also other options to check the integrity. - Avi
@Avi Thank you. Unfortunately, the plutil command doesn't seem to be able to generate a human-readable format from just the start of the file. I only have the first few bytes as the crash log is from Fabric. - hennes

1 Answers

2
votes

Keyed archives are stored as binary plists. You can use the plutil command line utility to print, verify or manipulate the contents.