h00die h00die
williballenthin
/ bplist.py
Last active
April 1, 2020 19:05
parse SavedState artifacts extracted from OSX.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| """ | |
| derived from plistlib.py -- a tool to generate and parse MacOSX .plist files. | |
| edited by: Willi Ballenthin (william.ballenthin@fireeye.com) | |
| changes: | |
| - remove all but the binary plist parser | |
| - add support for UID fields, see https://bugs.python.org/issue26707 | |
| """ |