Safari cookies

From Just Solve the File Format Problem
(Difference between revisions)
Jump to: navigation, search
(Documentation)
(Documentation)
Line 1: Line 1:
 
Safari cookies ({{ext|binarycookies}}) are cookies made by a WebKit browser. [https://github.com/as0ler/BinaryCookieReader This command-line Phyton tool can open them]. [https://github.com/cixtor/binarycookies This tool might be able to read these files]
 
Safari cookies ({{ext|binarycookies}}) are cookies made by a WebKit browser. [https://github.com/as0ler/BinaryCookieReader This command-line Phyton tool can open them]. [https://github.com/cixtor/binarycookies This tool might be able to read these files]
 
==Documentation==
 
==Documentation==
##Cookies.binarycookies Format
+
Cookies.binarycookies Format
  
 
Cookies.binarycookies file is composed of several pages and each page can have one or more cookies. The complete file format is explained below:
 
Cookies.binarycookies file is composed of several pages and each page can have one or more cookies. The complete file format is explained below:
  
###File Format:
+
===File Format:===
  
 
The file starts with a 4 byte magic string: cook. It is used to identify the file type. <br>
 
The file starts with a 4 byte magic string: cook. It is used to identify the file type. <br>
Line 12: Line 12:
 
Next to that, the file contains the actual page content. Each page is of length corresponding to the page size. Page format is explained below.  <br>
 
Next to that, the file contains the actual page content. Each page is of length corresponding to the page size. Page format is explained below.  <br>
 
The file ends with an 8 byte value and it might be file checksum.` <br>
 
The file ends with an 8 byte value and it might be file checksum.` <br>
###Page Format:
+
===Page Format:===
  
 
Every page starts with a 4 byte page header: 0x00000100.  <br>
 
Every page starts with a 4 byte page header: 0x00000100.  <br>
Line 19: Line 19:
 
Next to that, the page contains the actual cookie contents. Each cookie is of variable length. Cookie format is explained below.  <br>
 
Next to that, the page contains the actual cookie contents. Each cookie is of variable length. Cookie format is explained below.  <br>
 
Page ends with a 4 byte value and it is always 0x00000000.  <br>
 
Page ends with a 4 byte value and it is always 0x00000000.  <br>
###Cookie Format:
+
===Cookie Format:===
  
 
First 4 bytes in the cookie is the size of the cookie.  <br>
 
First 4 bytes in the cookie is the size of the cookie.  <br>

Revision as of 11:54, 24 November 2021

Safari cookies (.binarycookies) are cookies made by a WebKit browser. This command-line Phyton tool can open them. This tool might be able to read these files

Contents

Documentation

Cookies.binarycookies Format

Cookies.binarycookies file is composed of several pages and each page can have one or more cookies. The complete file format is explained below:

File Format:

The file starts with a 4 byte magic string: cook. It is used to identify the file type.
Next four bytes is an integer specifying the number of pages in the file.
Following that, a 4 byte integer for each page, represents the page size.
Next to that, the file contains the actual page content. Each page is of length corresponding to the page size. Page format is explained below.
The file ends with an 8 byte value and it might be file checksum.`

Page Format:

Every page starts with a 4 byte page header: 0x00000100.
Next four bytes is an integer specifying the number of cookies in the page.
Following that, a 4 byte integer for each cookie, represents the cookie offset. Offset specifies the start of the cookie in bytes from the start of the page.
Next to that, the page contains the actual cookie contents. Each cookie is of variable length. Cookie format is explained below.
Page ends with a 4 byte value and it is always 0x00000000.

Cookie Format:

First 4 bytes in the cookie is the size of the cookie.
The next 4 bytes are unknown (may be related to cookies flags).
The next four bytes are the cookie flags. This is an integer value (1=Secure, 4=HttpOnly, 5= Secure+HttpOnly).
The next 4 bytes are unknown.
The next 4 bytes is an integer specifying the start of the url field in bytes from the start of the cookie record.
The next 4 bytes is an integer specifying the start of the name field in bytes from the start of the cookie record.
The next 4 bytes is an integer specifying the start of the path field in bytes from the start of the cookie record.
The next 4 bytes is an integer specifying the start of the value field in bytes from the start of the cookie record.
The next 8 bytes represents the end of the cookie and it is always 0x0000000000000000.
The next 8 bytes are the cookie expiration date. Date is in Mac epoch format (Mac absolute time). Mac epoch format starts from Jan 2001.
The next 8 bytes are the cookie creation date.
Next to that, the cookie contains the actual cookie domain, name, path & value. The order is not specific and they can appear in any order.

Personal tools
Namespaces

Variants
Actions
Navigation
Toolbox