The structure of a .mobileprovision file looks something like this:
<!-- small binary data -->
<?xml version="1.0" encoding="UTF-8"?>
<!-- plist data -->
</plist>
<!-- large binary data -->
I have a few questions around this:
Specifically, I will consider this question as answered (and award the +100 bounty alongwith it) when both Q1 and Q3 above are answered.
I finally got the answer from an answer to another question on SO.
Basically the .mobileprovision file is a CMS encrypted XML file. It can be decoded using security
on OS X:
security cms -D -i /path/to/profile.mobileprovision