Type Protocol Buffer XML
Jump to navigation
Jump to search
| Defined Constant | Type_Protocol_Buffer_XML
|
| File Type Value | 1042 |
| Parent Type | XML |
| Carve | Yes |
| Format Details | No |
| MIME Type | text/xml
|
| Filename Extension | xml
|
Protocol Buffer XML
Description
Protocol Buffer converted to XML format.
Details
This file is not seen in the wild. It is generated by Truxton to make protocol buffers humanly readable.
Sample
It is common for plists to be embedded in protocol buffer fields (and that plist can have protocol buffer embedded in it!).
When plist data is found, it will be converted to XML as highlighted below.
When Truxton produces the XML, integer values that appear to be timestamps will be output as a timestamp element as highlighted below.
<protocolbuffer>
<f1 type="array" offset="8351623" length="10437">
<plist version="1.0" offset="8351623" length="10437">
<dict>
<key offset="8351641" length="8">$version</key>
<integer offset="8351674" length="4">100000</integer>
<key offset="8352445" length="4">$top</key>
<dict>
<key offset="8351753" length="7">NS.data</key>
<data offset="8351764" length="10107">
<f1 type="array" offset="8351766" length="19">com.apple.mobilecal</f1>
<f3 type="varint" offset="8351786" length="6">
<unsigned>1634136035360</unsigned>
<signed>1634136035360</signed>
<hex>17c7a191020</hex>
<timestamp format="unixmillisecond">2021-10-13T14:40:35.36Z</timestamp>
</f3>
<f4 type="array" offset="8351790" length="9582">
<plist version="1.0" offset="8351790" length="9582">
<dict>
<key offset="8351816" length="8">$version</key>
<real timestamp="2020-09-18T07:00:33.212011Z" format="cocoa" offset="8351849" length="8">622105233.212011</real>
</dict>
</plist>
</f4>
</data>
</dict>
</dict>
</plist>
</f1>
<f5 type="fixed64" offset="8327396" length="8">
<unsigned>4744642132057505105</unsigned>
<signed>4744642132057505105</signed>
<hex>41d85ae183a3bd51</hex>
<float>1634436622.55843</float>
<timestamp format="unix">2021-10-17T02:10:22.55843Z</timestamp>
</f5>
</protocolbuffer>
