Archaeology 1.4
Mothers Ruin Software (Mastodon):
Enhanced the decoding of Saved Application State to extract a couple of categories of data that were previously being ignored:
- For a sandboxed, document-based app, the security-scoped bookmarks that are associated with an
NSDocumentwill now be shown, usually as an additional archive labeled _NSDocument [Security-Scoped Bookmarks]. This is an array of bookmark data blobs, and is where AppKit squirrels away the security-scoped URL for a document, such that the app can re-open it upon restoration.- For an
NSResponderthat opts into the+restorableStateKeyPathsmechanism, the associated data will now be shown as an archive with the suffix [Keyed State Data]. This is a dictionary of saved values, by key path.[…]
When showing Mach-O information (after opening a bundle or a bare executable), if the executable is part of a Universal binary, Archaeology now shows the offset and size of the architecture slice within that binary (since we can never remember the right
otool(1)incantation for this). Archaeology also now shows the linker-assigned UUID for each Mach-O architecture (which is even more arcane to extract).
Previously:
