{"id":48422,"date":"2025-07-09T14:55:34","date_gmt":"2025-07-09T18:55:34","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=48422"},"modified":"2025-10-11T12:17:22","modified_gmt":"2025-10-11T16:17:22","slug":"archaeology-1-3","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2025\/07\/09\/archaeology-1-3\/","title":{"rendered":"Archaeology 1.3"},"content":{"rendered":"<p><a href=\"https:\/\/www.mothersruin.com\/software\/Archaeology\/\">Mothers Ruin Software<\/a>:<\/p>\n<blockquote cite=\"https:\/\/www.mothersruin.com\/software\/Archaeology\/\"><p>macOS uses many different binary file formats.<\/p><p>Some &mdash; like binary property lists &mdash; have broad tool support and are relatively easy to inspect&#8230;<\/p><p>Some &mdash; like X.509 certificates, configuration and provisioning profiles\nor App Store receipts &mdash; use standard formats, but lack macOS-native inspection tools, or\nonly have command-line tools that can be awkward to use&#8230;<\/p><p>Some &mdash; like compiled nibs, keyed archives, code signatures or URL bookmarks &mdash; use Apple-proprietary formats\nthat are not documented and that have no (public) inspection tools.<\/p><p>Even a file in a well-known format often contains data blobs encoded in\none of the other formats &mdash; such as an app&rsquo;s preferences property list, which might contain\nURL bookmarks or an archive of serialized objects.<\/p><p>Archaeology gives you a way to dig into a number of these binary files.<\/p><\/blockquote>\n<p>This is a delightful app from the developer of <a href=\"https:\/\/www.mothersruin.com\/software\/Apparency\/\">Apparency<\/a> and <a href=\"https:\/\/www.mothersruin.com\/software\/SuspiciousPackage\/\">Suspicious Package<\/a>. Aside from what&rsquo;s mentioned above, it supports more <a href=\"https:\/\/www.mothersruin.com\/software\/Archaeology\/formats.html\">formats<\/a> such as notarization tickets and Mach-O binaries (showing embedded <tt>Info.plist<\/tt> files, SDK info, and linked libraries).<\/p>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2024\/12\/10\/suspicious-package-keeps-on-tickin\/\">Suspicious Package Keeps on Tickin&rsquo;<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2023\/03\/07\/how-troubleshooting-has-changed-with-macos-security\/\">How Troubleshooting Has Changed With macOS Security<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/09\/04\/auto-linking-in-macho-explorer\/\">Auto Linking in MachO-Explorer<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/01\/27\/core-data-lab-1-0\/\">Core Data Lab 1.0<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2003\/04\/09\/machoview\/\">MachOView<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Mothers Ruin Software: macOS uses many different binary file formats.Some &mdash; like binary property lists &mdash; have broad tool support and are relatively easy to inspect&#8230;Some &mdash; like X.509 certificates, configuration and provisioning profiles or App Store receipts &mdash; use standard formats, but lack macOS-native inspection tools, or only have command-line tools that can be [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2025-07-09T18:55:36Z","apple_news_api_id":"d4ac9b2c-215e-453d-9c15-e150b5ebf234","apple_news_api_modified_at":"2025-07-10T00:21:27Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAA==","apple_news_api_share_url":"https:\/\/apple.news\/A1KybLCFeRT2cFeFQtevyNA","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[2793,466,75,1396,370,507,30,32,2792,2598,2742,1842,2848,2669],"class_list":["post-48422","post","type-post","status-publish","format-standard","hentry","category-technology","tag-archaeology","tag-codesigning","tag-developertool","tag-disk-image","tag-interfacebuilder","tag-json","tag-mac","tag-macapp","tag-mach-o","tag-macos-15-sequoia","tag-macos-tahoe-26","tag-notarization","tag-provisioning-profiles","tag-security-scoped-bookmarks"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/48422","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=48422"}],"version-history":[{"count":2,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/48422\/revisions"}],"predecessor-version":[{"id":48426,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/48422\/revisions\/48426"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=48422"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=48422"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=48422"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}