Safari 5.1 cookie 格式规范
SAFARI 存储 cookie 的方式在 SAFARI 5.1 中发生了变化 他们添加了一种完整性控制代码 在文件的最后 8 个字节中:
该文件是 %APPDATA%\Apple Computer\Safari\Cookies\Cookies.binarycookies
有谁知道最后 8 个字节对应什么?
CRC32 校验 ?
请帮忙
the way of storing cookie for SAFARI has changed whith SAFARI 5.1
and that they add a kind of integrity control code
in the last 8 bytes of the file :
The file is %APPDATA%\Apple Computer\Safari\Cookies\Cookies.binarycookies
Does anybody know what s the last 8 bytes corresponds to ?
CRC32 check ?
Please help
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(6)
Cookie.binarycookies:
我认为这会有所帮助。我使用十六进制编辑器对文件进行逆向工程,并开始更改 cookie。
一般说明:
该文件由多个页面组成,每个页面内可以有一个或多个cookie。每个页面都有一个 header,它是可变的,0x10、0x14 和 0x1c 是我们可以看到的常见值。
文件:
文件以不感兴趣的 4 字节标头开头。
接下来的 4 个字节非常有趣,因为它们指示文件中的页数。
然后我们得到每页的长度,也用 4 字节数字表示。重要的是要知道所有这些数字都是以大端方式写入的。因此,我们有 4* 字节数页,然后是页。
最后有 8 个字节,这也是我们不感兴趣的。
页面:
每页都有一个页眉,其长度可以从一页到另一页变化。要知道标头的长度,我们必须丢弃前 5 个字节,接下来的 4 个字节将指示标头的长度。
在标头后面,我们将得到由 4 个字节表示的 cookie 长度,以小端排序!该长度还包括表示长度所需的 4 个字节。
当此 cookie 结束时,另一个 cookie 将启动,依此类推,直至页面末尾。
Cookie:
每个cookie的日期从0x2B开始。日期由 4 个字节组成,按小端顺序排列。日期以秒为单位,但不是自纪元以来,因此我们需要减去这个数字:1706047360。(它只适用于 2017 年的某一天)
下一个感兴趣的字段从 0x38 开始。这些字段是动态字段,因此它们由 NULL“0x00”字节分隔,并且按以下顺序排列:名称、值、url、路径。
示例:
http://i52.tinypic.com/2qcqix2.jpg
整个 cookie 的长度将为 0x82。
如果与页面长度相对应,则在此 cookie 旁边将以完全相同的格式启动另一个 cookie。
Cookie.binarycookies:
I think this will be helpful. I reversed engineer the file with an hex-editor and start changing the cookies.
General description:
The file is composed of several pages, each one can have one or more cookies inside. Each page has a header, which is variable, 0x10, 0x14 and 0x1c are common values we can see.
File:
The file start with an 4 bytes header that is of no interest.
The next 4 bytes are of real interest because they indicate the number of pages there are in the file.
Then we have the length of each page, also represented by an 4 byte number. It's important to know that all these numbers are written in big-endian. So, we have 4*number of pages of bytes and then the pages.
We have 8 bytes at the end which also are of no interest.
Page:
Each page has a header whose length can change from one page to another. To know the length of the header, we must discard the first five bytes and the next 4 bytes will indicate the length of the header.
Following the header we will have the length of the cookie represented by 4 bytes, ordered in little-endian! This length also includes the 4 bytes needed for representing the length.
When this cookie ends another will start and so on to the end of the page.
Cookie:
The date of each cookies starts at 0x2B. The date is composed by 4 bytes ordered in little-endian. The date is represented in seconds but not since epoch so we need to subtract this number: 1706047360. (It only works for until some day in 2017)
The next field of interest starts from 0x38. This fields are dynamic fields so they are separated by an NULL “0x00” byte and are in this order: name, value, url, path.
Example:
http://i52.tinypic.com/2qcqix2.jpg
The length of the entire cookie will be 0x82.
Next to this cookie will start another one in exactly the same format if corresponds with the page length.
这不会准确回答您的问题,但希望它能触及您想要做的事情的核心。
您可以使用
NSHTTPCookieStorage
类读取位于~/Library/Cookies/Cookies.binarycookies
的二进制 cookie 文件的内容,如以下代码片段所示:This isn't going to answer your question exactly, but hopefully it gets to the heart of what you're trying to do.
You can read the contents of the binary cookie file located at
~/Library/Cookies/Cookies.binarycookies
using theNSHTTPCookieStorage
class, as shown in the following snippet:我编写了一个 MacRuby 脚本来执行您要查找的操作:
https://gist.github.com/1385008
您需要安装 MacRuby,但这将以 CSV 格式打印出您的 cookie。它也可以轻松地与 cookies.txt 兼容。
I've written a MacRuby script to do what you're looking for:
https://gist.github.com/1385008
You need to install MacRuby, but then this will print out your cookies in a CSV format. It can easily be made to be cookies.txt compatible, as well.
我为 Swift 编写了一个解析器,可以为您做到这一点。我需要这个,因为
NSHTTPCookieStorage.sharedHTTPCookieStorage()
在沙箱中不允许您访问全局 cookie。https://github.com/icodeforlove/BinaryCookies.swift
你可以这样使用
目前有有一些项目也可以用其他语言执行此操作:
I wrote a parser for Swift that can do this for you. I needed this because
NSHTTPCookieStorage.sharedHTTPCookieStorage()
doesn't give you access to the global cookies when sandboxed.https://github.com/icodeforlove/BinaryCookies.swift
You can use it like this
Currently there are a few projects that can do this in other languages as well:
我刚刚得到了一个网址列表:
$ 字符串 Cookies.binarycookies | grep '^A\.' |唯一性
I just got a list of urls from:
$ strings Cookies.binarycookies | grep '^A\.' | uniq
负责此操作的相关类是
The relevant classes responsible for this are,