.DS_Store pBB0 blob format

Readme.md

.DS_Store pBB0 blob format

This blob contains many values which look like file offsets, but the blob itself isn't big enough for any of the offsets to make sense, so they must be offsets inside some other, larger structure. Possibly the pBBk entry?

Header

offset	content	meaning
@0x000	00 00 00 00	sint4? 0
@0x004	13 20 00 00	sint4? 0x2013
@0x008	44 03 00 00	sint4? 0x0344
@0x00c	00 00 00 00	sint4? 0
@0x010	20 20 00 00	sint4? 0x2020
@0x014	80 03 00 00	sint4? 0x380
@0x018	00 00 00 00	sint4? 0

Data Records

offset	content	meaning
@0x01c	04 00 00 00	4 = data length
@0x020	03 03 00 00	0x303 = type sint32
@0x024	00 f0 00 00	0xf000

offset	content	meaning
@0x028	04 00 00 00	4 = data length
@0x02c	03 03 00 00	0x303 = type sint32
@0x030	00 00 00 00	0

offset	content	meaning
@0x034	04 00 00 00	4 = data length
@0x038	03 03 00 00	0x303 = type sint32
@0x03c	01 00 00 00	1

offset	content	meaning
@0x040	14 00 00 00	20 = data length
@0x044	01 06 00 00	0x601 = type ARRAY?
@0x048	c8 05 00 00 d4 05 00 00 e0 05 00 00 d4 05 00 00 d4 05 00 00	offsets but to where?

offset	content	meaning
@0x05c	b9 00 00 00	0xb9 = data length
@0x060	01 02 00 00	0x0201 = type DATA (but it's actually ASCII!)
@0x064	30 66 30 36 32 66 65 39 39 66 39 36 36 62 66 62 63 35 66 38 37 32 33 36 66 34 38 35 35 38 36 36 33 63 34 37 66 65 64 39 3b 30 30 30 30 30 30 30 30 3b 30 30 30 30 30 30 30 30 3b 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 3b 63 6f 6d 2e 61 70 70 6c 65 2e 61 70 70 2d 73 61 6e 64 62 6f 78 2e 72 65 61 64 2d 77 72 69 74 65 3b 30 30 30 30 30 30 30 31 3b 30 31 30 30 30 30 30 62 3b 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 3b 2f 76 6f 6c 75 6d 65 73 2f 61 63 6d 65 2f 2e 62 61 63 6b 67 72 6f 75 6e 64 2f 62 61 63 6b 67 72 6f 75 6e 64 2e 70 6e 67 00	Null-terminated ASCII string, length 0xb8, "0f062fe99f966bfbc5f87236f48558663c47fed9;00000000;00000000;0000000000000020;com.apple.app-sandbox.read-write;00000001;0100000b;0000000000000014;/volumes/acme/.background/background.png\0" - This appears to be a NSURLDocumentIdentifierKey
@0x11d	00 00 00	padding to 4-byte boundary?

offset	content	meaning
@0x120	c0 00 00 00	12 = length of following header?
@0x124	fe ff ff ff	End of records marker, start of some kind of index?

Index Header?

offset	content	meaning
@0x128	01 00 00 00	similar to number of TOCs in bookmark files?
@0x12c	6c 05 00 00	offset to somewhere
@0x130	0f 00 00 00	15 = number of records following?

Index Records?

offset	content	meaning
@0x134	04 10 00 00	0x1004 = kBookmarkPath
@0x138	4c 00 00 00 00 00 00 00	offset?

offset	content	meaning
@0x140	05 10 00 00	0x1005 = kBookmarkCNIDPath
@0x144	a4 00 00 00 00 00 00 00	offset?

offset	content	meaning
@0x14c	10 10 00 00	0x1010 = kBookmarkFileProperties
@0x150	cc 00 00 00 00 00 00 00	offset?

offset	content	meaning
@0x158	40 10 00 00	0x1040 = kBookmarkFileCreationDate
@0x15c	bc 00 00 00 00 00 00 00	offset?

offset	content	meaning
@0x164	00 20 00 00	0x2000 = kBookmarkTOCPath
@0x168	ec 05 00 00 00 00 00 00	offset?

offset	content	meaning
@0x170	02 20 00 00	0x2002 = kBookmarkVolumePath
@0x174	54 05 00 00 00 00 00 00	offset?

offset	content	meaning
@0x17c	10 20 00 00	0x2010 = kBookmarkVolumeName
@0x180	14 00 00 00 00 00 00 00	offset?

offset	content	meaning
@0x188	11 20 00 00	0x2011 = kBookmarkVolumeUUID
@0x18c	14 01 00 00 00 00 00 00	offset?

offset	content	meaning
@0x194	12 20 00 00	0x2012 = kBookmarkVolumeSize
@0x198	f4 00 00 00 00 00 00 00	offset?

offset	content	meaning
@0x1a0	13 20 00 00	0x2013 = kBookmarkVolumeCreationDate
@0x1a4	04 01 00 00 00 00 00 00	offset?

offset	content	meaning
@0x1ac	20 20 00 00	0x2020 = kBookmarkVolumeProperties
@0x1b0	40 01 00 00 00 00 00 00	offset?

offset	content	meaning
@0x1b8	40 20 00 00	0x2040 = kBookmarkVolumeBookmark
@0x1bc	60 01 00 00 00 00 00 00	offset?

offset	content	meaning
@0x1c4	01 d0 00 00	0xd001 = kBookmarkWasFileReference
@0x1c8	ec 00 00 00 00 00 00 00	offset?

offset	content	meaning
@0x1d0	10 d0 00 00	0xd010 = kBookmarkCreationOptions
@0x1d4	ac 03 00 00 00 00 00 00	offset?

offset	content	meaning
@0x1dc	80 f0 00 00	0xf080 = kBookmarkSandboxRwExtension
@0x1e0	08 06 00 00 00 00 00 00	offset?