5
AAAAAAFuAAIAAAZNYWMgT1MAAAAAAAAAAAAAAAAAAAAAAAAAAADMrsHTSCsAAAALuG8NYWxleHN1Y2tzLmRpYwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPJXS83SjIoAAAAAAAAAAP////8AAAkgAAAAAAAAAAAAAAAAAAAAB0Rlc2t0b3AAABAACAAAzK6zwwAAABEACAAAzdJ+egAAAAEADAALuG8AC7hIAADK3wACADFNYWMgT1M6VXNlcnM6AGFuZHJld3ByeWRlOgBEZXNrdG9wOgBhbGV4c3Vja3MuZGljAAAOABwADQBhAGwAZQB4AHMAdQBjAGsAcwAuAGQAaQBjAA8ADgAGAE0AYQBjACAATwBTABIAJ1VzZXJzL2FuZHJld3ByeWRlL0Rlc2t0b3AvYWxleHN1Y2tzLmRpYwAAEwABLwAAFQACABL//wAA

It's a data field from the ~/Library/Preferences/com.microsoft.office.plist file for Microsoft Office 2011 Mac.

It partially decodes using base64 but doesn't appear to be completely base64.

Edit: Here is another example.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<data>AAAAAAFWAAIAAAZNYWMgT1MAAAAAAAAAAAAAAAAAAAAAAAAAAADMrsHTSCsAAAALuG8HMm5kLmRpYwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgev83SjIoAAAAAAAAAAP////8AAAkgAAAAAAAAAAAAAAAAAAAAB0Rlc2t0b3AAABAACAAAzK6zwwAAABEACAAAzdJ+egAAAAEADAALuG8AC7hIAADK3wACACtNYWMgT1M6VXNlcnM6AGFuZHJld3ByeWRlOgBEZXNrdG9wOgAybmQuZGljAAAOABAABwAyAG4AZAAuAGQAaQBjAA8ADgAGAE0AYQBjACAATwBTABIAIVVzZXJzL2FuZHJld3ByeWRlL0Rlc2t0b3AvMm5kLmRpYwAAEwABLwAAFQACABL//wAA</data>
</plist>
Prydie
  • 1,807
  • 1
  • 20
  • 30

4 Answers4

2

base64 is usually used to encode decode binary files like images. As you would have seen on decoding the above file, it contains few recognizable ASCII strings but most of it is binary.

Property list is a format for storing serialized objects. It is also used for storing settings in Office 2011 Mac. If you are interested in the details for this particular file you can check it here. Scroll to ~/Library/Preferences/com.microsoft.office.plist for the specific format details.

This will help you understand what the ASCII strings mean. To extract and view the plist completely (even binary part) you can use Property List Editor and plutil. (See the source). There are several programs which can do the same.

But if you need to learn how to read and write from plist file (Property List), you can check these links:

  1. http://en.wikipedia.org/wiki/Property_list
  2. http://developer.apple.com/library/mac/#documentation/Cocoa/Conceptual/PropertyLists/Introduction/Introduction.html
user568109
  • 47,225
  • 17
  • 99
  • 123
2

It appears to be Base64. The decoded string is

    n   Mac OS                     Ì®ÁÓH+   ¸o
alexsucks.dic                                                   òWKÍÒŒŠ        ÿÿÿÿ                     Desktop     Ì®³Ã      ÍÒ~z     ¸o ¸H  Êß  1Mac OS:Users: andrewpryde: Desktop: alexsucks.dic    
 a l e x s u c k s . d i c    M a c   O S  'Users/andrewpryde/Desktop/alexsucks.dic   /    ÿÿ
user2097804
  • 1,122
  • 4
  • 13
  • 22
  • 2
    Apart from being one of the answers.. `alexsucks.dic` caught my attention in the first place – Shankar Narayana Damodaran Jun 13 '13 at 15:00
  • My sense of of humour might have been a little inappropriate here but oh well. I'm more interested in reverse engineering what the base 64 is encoding. Yes it is base64 (in fact I think it is xcode encoding the data as base64 when I copy it from the `.plist` as it appears to be displayed as hex values in the editor) but what interests me is how do I write one of these with my own file path. – Prydie Jun 15 '13 at 19:30
1

The encoding is base64, it decodes correctly to a binary file.

Something you'll often see in binary files containing strings is the byte immediately before a string contains the length of the string. This one is no different. If you look at it with a hex editor, the byte immediately before the word "Desktop" has a value of 7.

You're probably stuck with reverse-engineering the point of the file, if there's something other than the text you intend to get out of it, but it mostly just appears to be a reference to some sort of "cleverly" named dictionary file.

FWIW, I used this tool to decode the file.

Kevin Stricker
  • 17,178
  • 5
  • 45
  • 71
  • Any thoughts on the reverse engineering? I need to be able to write to this field in the `.plist` :-( – Prydie Jun 07 '13 at 00:41
  • I'm afraid I can't be *too* much help there. There are [guides](http://en.wikibooks.org/wiki/Reverse_Engineering/File_Formats) online for this sort of thing, and other related Stack Overflow questions: http://stackoverflow.com/questions/492751/tools-to-help-reverse-engineer-binary-file-formats – Kevin Stricker Jun 07 '13 at 01:01
  • This tool for Mac (from the linked SO question) actually looks pretty cool: http://www.synalysis.net/ – Kevin Stricker Jun 07 '13 at 01:05
  • Could also look at the definition of files containing similar data (eg: .lnk files) to get ideas as to what some bits of data could be: http://msdn.microsoft.com/en-us/library/dd871305.aspx – Kevin Stricker Jun 07 '13 at 01:25
  • What key is this data under, incidentally? – Kevin Stricker Jun 07 '13 at 14:58
  • It's config for custom dictionaries: `14\MS Proofing Tools\MS Proofing Tools\Custom Dictionary\1` – Prydie Jun 07 '13 at 16:26
0

looks like a binary file defining a dictionary with 32-bit keys (ints?), strings are prefixed with a byte containing the length of the string. Some of the values seems to be padded by zeros. What values do you need to write to?

edit: this tool might help: Package maker

Lorentz Vedeler
  • 5,101
  • 2
  • 29
  • 40
  • Thanks for your reply. I need to be able to create one of these that references a file path and contains all the information for Word Mac 2011 to read it and then include the dictionary in their custom dictionary listing. – Prydie Jun 15 '13 at 19:27