decoding data from plist file

user3100193 picture user3100193 · Dec 16, 2014 · Viewed 10.2k times · Source

I have lost some data from my text files written in Textwrangler on Macbook Air. I have found some of them in file which have extension .plist. File is written in xml and looks like this:

 <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<key>/Applications/MAMP/htdocs/04. Clock-box/login.php</key>
        <dict>
            <key>BBEditStateData</key>
            <dict>
                <key>MainScrollBar</key>
                <integer>0</integer>
                <key>PrintDateIsModificationDate</key>
                <string>asmo</string>
                <key>PrintingFont</key>
                <data>
                YnBsaXN0MDDUAQIDBAUIKClUJHRvcFgkb2JqZWN0c1gk
                dmVyc2lvblkkYXJjaGl2ZXLRBgdUcm9vdIABqQkKDxka
                GxwdJFUkbnVsbNILDA0OViRjbGFzc18QGk5TRm9udERl
                c2NyaXB0b3JBdHRyaWJ1dGVzgAiAAtMQCxESFRZaTlMu
                b2JqZWN0c1dOUy5rZXlzohMUgAWABoAHohcYgAOABF8Q
                E05TRm9udE5hbWVBdHRyaWJ1dGVfEBNOU0ZvbnRTaXpl
                QXR0cmlidXRlXU1lbmxvLVJlZ3VsYXIiQUAAANIeHyAh
                WCRjbGFzc2VzWiRjbGFzc25hbWWjISIjXxATTlNNdXRh
                YmxlRGljdGlvbmFyeVxOU0RpY3Rpb25hcnlYTlNPYmpl
                Y3TSHh8lJ6ImI18QEE5TRm9udERlc2NyaXB0b3JfEBBO
                U0ZvbnREZXNjcmlwdG9yEgABhqBfEA9OU0tleWVkQXJj
                aGl2ZXIACAARABYAHwAoADIANQA6ADwARgBMAFEAWAB1
                AHcAeQCAAIsAkwCWAJgAmgCcAJ8AoQCjALkAzwDdAOIA
                5wDwAPsA/wEVASIBKwEwATMBRgFZAV4AAAAAAAACAQAA
                AAAAAAAqAAAAAAAAAAAAAAAAAAABcA==
                </data>
                <key>SelectionEnd</key>
                <integer>892</integer>
                <key>SelectionStart</key>
                <integer>0</integer>
                <key>WindowShape</key>
                <string>rect(45,14,1011,1317)</string>
            </dict>
            <key>LastAccessed</key>
            <date>2014-12-09T14:22:18Z</date>
            <key>MD5</key>
            <data>
            QTYyMjQ4QjkwMERCRDhEMDgyQjlBMkUxMUZGODBEMkI=
            </data>
        </dict>

How could I decode data inside "data" tags?

Answer

Daniel picture Daniel · Dec 16, 2014

The code in data is Base64, which can be easily decoded with any online tool, like this one.

The data for PrintingFont will decode into a binary file wich contains information that will look more or less like this if converted to ASCII (obviously excluding the comment):

// !!! BINARY PROPERTY LIST WARNING !!!
//
// The pretty-printed property list below has been created
// from a binary version on disk and should not be saved as
// the ASCII format is a subset of the binary representation!
//
{   "$archiver" = "NSKeyedArchiver";
    "$objects" = (
        "$null",
        {   "$class" = :false;
            NSFontDescriptorAttributes = :false;
        },
        {   "$class" = :false;
            NS.keys = ( :false, :false );
            NS.objects = ( :false, :false );
        },
        "NSFontNameAttribute",
        "NSFontSizeAttribute",
        "Menlo-Regular",
        12,
        {   "$classes" = ( "NSMutableDictionary", "NSDictionary", "NSObject" );
            "$classname" = "NSMutableDictionary";
        },
        {   "$classes" = ( "NSFontDescriptor", "NSObject" );
            "$classname" = "NSFontDescriptor";
        },
    );
    "$top" = { root = :false; };
    "$version" = 100000;
}

The MD5 data decodes to A62248B900DBD8D082B9A2E11FF80D2B, which I would say is a MD5 hash.