Open the file in a hex editor (0xED, for example), if it has the text "plist" 
near the beginning, it may have been archived with NSKeyedArchiver. If instead 
it displays 0x3 or 0x4 followed by 0xb followed by "typedstream" or 
"streamtyped" at the beginning of the file, it was probably archived with 
NSArchiver.

In either case, examining the file should give you some clues as to the class 
contents. 

If they are all stock NSClasses, just use the appropriate unarchiver class's 
methods.

If the root is a custom class, you are sort of toast unless you can Google the 
class -- and even then you may be going down a wrong path. 

You could write an app that would let you select subtrees of the archive and 
decode them perhaps. Sounds like an interesting project. 

Or you could subclass the appropriate archiver class and add some error 
handling/exception handling so that it could proceed as best it could when 
encountering unknown classes. Might need to swizzle in a subclass of NSCoder 
also.

You could substitute an NSMutableDictionary instance for unknown classes 
NSArchiver finds and dynamically create entries in the dictionary for any 
decodable items. 

It isn't going to be drop-dead easy -- and there is always the possibility 
(however unlikely) that the originator of the file had subclassed NSCoder 
itself to do something custom.

Could be an interesting tool, if you can make it even half work. Might find a 
market in forensic computing and related areas.

If you are just looking for text, it may be staring at you in the hex editor.


> I am trying to decode a Yahoo chat file which has been encoded using
> NSArchiver.  The problem is I don't have the definition of the class it has
> encoded and I want to be able to decode it to view the chat conversation.
> Any ideas on how I go about working out the definition to decode the file?
_______________________________________________

Cocoa-dev mailing list (Cocoa-dev@lists.apple.com)

Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com

Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com

This email sent to arch...@mail-archive.com

Reply via email to