gehaxelt / python-dsstore

A library for parsing .DS_Store files and extracting file names

Python .DS_Store parser

This repository contains a parser for Apple's .DS_Store file format.

A sample file form a CTF is included in the ./samples/ directory and the you can try the parser using python3 main.py ./samples/.DS_Store.ctf.

Here's my blogpost that tries to explain the structure and format in detail: https://0day.work/parsing-the-ds_store-file-format/

Usage

$ python main.py samples/.DS_Store.ctf 
Count:  6
favicon.ico
flag
static
templates
vulnerable.py
vulnerable.wsgi

Useful ressources

I found the following links to be quite helpful while developing the parser:

• https://wiki.mozilla.org/DS_Store_File_Format
• http://search.cpan.org/~wiml/Mac-Finder-DSStore/DSStoreFormat.pod
• https://digi.ninja/projects/fdb.php

License

MIT - See License.md

python-dsstore's Issues

recovery path

Excuse me, can you retrieve the recovery path of each file in the Trash directory by analyzing the .DS.Store file in Trash?

bad print statement

I apologize, I just do a little scripting for work, I don't know how to use git to do this myself but when I tried to run this script I would get this error:

Traceback (most recent call last):
  File "C:\Tools\ds_store_python\Python-dsstore-master\main.py", line 1, in <module>
    import dsstore
  File "C:\Tools\ds_store_python\Python-dsstore-master\dsstore.py", line 117
    print("[DEBUG] ", *args)
                      ^
SyntaxError: invalid syntax

I changed line 117 to:

print("[DEBUG] {}".format(*args))

and it ran successfully. Just wanted to report it to you so it can be fixed