wader/fq
1
1
Fork 0
mirror of https://github.com/wader/fq.git synced 2024-12-23 05:13:30 +03:00
Code Issues Projects Releases Wiki Activity

doc: remake

Browse Source
This commit is contained in:
David McDonald 2022-12-03 17:36:56 -06:00
parent b45f9fa67b
commit b872b1a337
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
doc/formats.md
View File

@ -160,8 +160,6 @@ Decode value as aac_frame
## apple_bookmark
## Apple bookmarkData format
Apple's `bookmarkData` format is used to encode information that can be resolved
into a `URL` object for a file even if the user moves or renames it. Can also
contain security scoping information for App Sandbox support.
@ -182,13 +180,12 @@ Property Lists. Notable examples include:
For more information about these types of files, see Sarah Edwards' excellent
research on the subject (link in references).
Locating `bookmarkData` objects in plist files, especially those of the
`NSKeyedArchiver` type, is a place where `fq`'s recursive searching really
shines. Here, we recursively descend through the decoded tree, probing for and
selecting any `bookmark` blobs, then converting them to readable JSON with
`torepr`:
`fq`'s `grep_by` function can be used to recursively descend through the decoded
tree, probing for and selecting any `bookmark` blobs, then converting them to
readable JSON with `torepr`:
```
fq '.. | select(format=="bookmark") | .map(. | torepr)' com.apple.LSSharedFileList.RecentApplications.sfl2
fq 'grep_by(.type=="data" and .value[0:4] == "book") | .value | apple_bookmark |
torepr' <sfl2 file>
```
### Authors