CODEWITHSUNDEEP
encodingms-office
Prydie
Prydie

Reputation: 1827

Can anyone tell me what encoding this is?

AAAAAAFuAAIAAAZNYWMgT1MAAAAAAAAAAAAAAAAAAAAAAAAAAADMrsHTSCsAAAALuG8NYWxleHN1Y2tzLmRpYwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPJXS83SjIoAAAAAAAAAAP////8AAAkgAAAAAAAAAAAAAAAAAAAAB0Rlc2t0b3AAABAACAAAzK6zwwAAABEACAAAzdJ+egAAAAEADAALuG8AC7hIAADK3wACADFNYWMgT1M6VXNlcnM6AGFuZHJld3ByeWRlOgBEZXNrdG9wOgBhbGV4c3Vja3MuZGljAAAOABwADQBhAGwAZQB4AHMAdQBjAGsAcwAuAGQAaQBjAA8ADgAGAE0AYQBjACAATwBTABIAJ1VzZXJzL2FuZHJld3ByeWRlL0Rlc2t0b3AvYWxleHN1Y2tzLmRpYwAAEwABLwAAFQACABL//wAA

It's a data field from the ~/Library/Preferences/com.microsoft.office.plist file for Microsoft Office 2011 Mac.

It partially decodes using base64 but doesn't appear to be completely base64.

Edit: Here is another example.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<data>AAAAAAFWAAIAAAZNYWMgT1MAAAAAAAAAAAAAAAAAAAAAAAAAAADMrsHTSCsAAAALuG8HMm5kLmRpYwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgev83SjIoAAAAAAAAAAP////8AAAkgAAAAAAAAAAAAAAAAAAAAB0Rlc2t0b3AAABAACAAAzK6zwwAAABEACAAAzdJ+egAAAAEADAALuG8AC7hIAADK3wACACtNYWMgT1M6VXNlcnM6AGFuZHJld3ByeWRlOgBEZXNrdG9wOgAybmQuZGljAAAOABAABwAyAG4AZAAuAGQAaQBjAA8ADgAGAE0AYQBjACAATwBTABIAIVVzZXJzL2FuZHJld3ByeWRlL0Rlc2t0b3AvMm5kLmRpYwAAEwABLwAAFQACABL//wAA</data>
</plist>

Upvotes: 5

Views: 2574

Answers (4)

Lorentz Vedeler
Lorentz Vedeler

Reputation: 5311

looks like a binary file defining a dictionary with 32-bit keys (ints?), strings are prefixed with a byte containing the length of the string. Some of the values seems to be padded by zeros. What values do you need to write to?

edit: this tool might help: Package maker

Upvotes: 0

user2097804
user2097804

Reputation: 1132

It appears to be Base64. The decoded string is

    n   Mac OS                     Ì®ÁÓH+   ¸o
alexsucks.dic                                                   òWKÍÒŒŠ        ÿÿÿÿ                     Desktop     Ì®³Ã      ÍÒ~z     ¸o ¸H  Êß  1Mac OS:Users: andrewpryde: Desktop: alexsucks.dic    
 a l e x s u c k s . d i c    M a c   O S  'Users/andrewpryde/Desktop/alexsucks.dic   /    ÿÿ

Upvotes: 2

user568109
user568109

Reputation: 48003

base64 is usually used to encode decode binary files like images. As you would have seen on decoding the above file, it contains few recognizable ASCII strings but most of it is binary.

Property list is a format for storing serialized objects. It is also used for storing settings in Office 2011 Mac. If you are interested in the details for this particular file you can check it here. Scroll to ~/Library/Preferences/com.microsoft.office.plist for the specific format details.

This will help you understand what the ASCII strings mean. To extract and view the plist completely (even binary part) you can use Property List Editor and plutil. (See the source). There are several programs which can do the same.

But if you need to learn how to read and write from plist file (Property List), you can check these links:

  1. http://en.wikipedia.org/wiki/Property_list
  2. http://developer.apple.com/library/mac/#documentation/Cocoa/Conceptual/PropertyLists/Introduction/Introduction.html

Upvotes: 2

Kevin Stricker
Kevin Stricker

Reputation: 17388

The encoding is base64, it decodes correctly to a binary file.

Something you'll often see in binary files containing strings is the byte immediately before a string contains the length of the string. This one is no different. If you look at it with a hex editor, the byte immediately before the word "Desktop" has a value of 7.

You're probably stuck with reverse-engineering the point of the file, if there's something other than the text you intend to get out of it, but it mostly just appears to be a reference to some sort of "cleverly" named dictionary file.

FWIW, I used this tool to decode the file.

Upvotes: 1

Related Questions