Contents

interstateone/binarycookies

Read and write Apple's .binarycookies files

File Format

File

| Field | Endianness | Type | Size | Description | |-----------------|------------|----------------------|-------------|-----------------------------------------| | Magic | BE | UTF-8 | 4 | "cook", no terminator | | Number of pages | BE | Unsigned Int | 4 | | | Page N size | BE | Unsigned Int | 4 | Repeat for N pages | | Page N | | | Page N size | Page N content | | Checksum | BE | Unsigned Int | 4 | Sum every 4th byte for each page | | Footer | BE | | 8 | 0x071720050000004b | | Metadata | | Binary Property List | | Contains NSHTTPCookieAcceptPolicy value |

Page

| Field | Endianness | Type | Size | Description | |-------------------|------------|--------------|---------------|----------------------| | Header | BE | | 4 | 0x00000100 | | Number of cookies | LE | Unsigned Int | 4 | | | Cookie N offset | LE | Unsigned Int | 4 | Repeat for N cookies | | Footer | | | 4 | 0x00000000 | | Cookie N | | | Cookie N size | Cookie N content |

Cookie

| Field | Endianness | Type | Size | Description | |--------------------|------------|--------------|------|------------------------------------------------------------------------------| | Size | LE | Unsigned Int | 4 | Size in bytes | | Version | LE | Unsigned Int | 4 | 0 or 1 | | Flags | LE | Bit field | 4 | isSecure = 1, isHTTPOnly = 1 << 2, unknown1 = 1 << 3, unknown2 = 1 << 4 | | Has port | LE | Unsigned Int | 4 | 0 or 1 | | URL Offset | LE | Unsigned Int | 4 | Offset from the start of the cookie | | Name Offset | LE | Unsigned Int | 4 | Offset from the start of the cookie | | Path Offset | LE | Unsigned Int | 4 | Offset from the start of the cookie | | Value Offset | LE | Unsigned Int | 4 | Offset from the start of the cookie | | Comment Offset | LE | Unsigned Int | 4 | Offset from the start of the cookie, 0x00000000 if not present | | Comment URL Offset | LE | Unsigned Int | 4 | Offset from the start of the cookie, 0x00000000 if not present | | Expiration | LE | Double | 8 | Number of seconds since 00:00:00 UTC on 1 January 2001 | | Creation | LE | Double | 8 | Number of seconds since 00:00:00 UTC on 1 January 2001 | | Port | LE | Unsigned Int | 2 | Only present if the "Has port" field is 1 | | Comment | LE | String | | Null-terminated, optional | | Comment URL | LE | String | | Null-terminated, optional | | URL | LE | String | | Null-terminated | | Name | LE | String | | Null-terminated | | Path | LE | String | | Null-terminated | | Value | LE | String | | Null-terminated |

Reference

  • http://www.securitylearn.net/2012/10/27/cookies-binarycookies-reader/
  • https://it.toolbox.com/blogs/locutus/understanding-the-safari-cookiesbinarycookies-file-format-010712

Package Metadata

Repository: interstateone/binarycookies

Default branch: master

README: README.md