Instantly share code, notes, and snippets.

What would you like to do?
Working with SharedFileList (.sfl) files from OSX 10.11 El Capitan in python
from Foundation import NSKeyedUnarchiver
from struct import unpack
# This entire function is black magic of the highest order and I'll blog about it later
def extract_share(bookmark_data):
content_offset, = unpack('I', bookmark_data[12:16])
first_TOC, = unpack('I', bookmark_data[content_offset:content_offset+4])
first_TOC += content_offset
TOC_len, rec_type, level, next_TOC, record_count = unpack('IIIII', bookmark_data[first_TOC:first_TOC+20])
TOC_cursor = first_TOC + 20
record_offsets = {}
for i in range(record_count):
record_id, offset = unpack('<IQ', bookmark_data[TOC_cursor:TOC_cursor+12])
record_offsets[record_id] = offset + content_offset
TOC_cursor += 12
mount_record = record_offsets.get(0x2050, None)
# Check to see if we actually had a volMountURL record
if mount_record is not None:
mount_length, rec_type = unpack('II', bookmark_data[mount_record:mount_record+8])
mount_record += 8
mount_URL = (bookmark_data[mount_record:mount_record+mount_length]).decode('utf-8')
return mount_URL
return None
def get_recentservers(sfl_file_path):
# Read the file (located in ~/Library/Application Support/ on 10.11+)
with open(sfl_file_path, 'rb') as f:
raw_data =
# It's NSKeyedArchiver data - let's decode it!
recent_servers = NSKeyedUnarchiver.unarchiveObjectWithData_(buffer(raw_data))
# Build an empty set
server_URLs = []
# Add in our discovered server URLs from the SFLListItems and return in 'SFLListItem.order' order
for x in sorted(recent_servers['items'], lambda y,_: int(y.order())):
url = extract_share(x.bookmark()[:].tobytes())
if url is not None:
return server_URLs
# Example usage:
# get_recentservers('')

This comment has been minimized.

jacobsalmela commented Dec 30, 2015

What about FavoriteServers? Will it work for that?


This comment has been minimized.

linjinxing commented Nov 29, 2017

it doesn't work now.
recent_servers = NSKeyedUnarchiver.unarchiveObjectWithData_(buffer(raw_data))
objc.error: NSInvalidUnarchiveOperationException - *** -[NSKeyedUnarchiver decodeObjectForKey:]: cannot decode object of class (SFLListItem) for key (NS.objects); the class may be defined in source code or a library that is not linked

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment