Live data from Hacker News

A deep dive into Apple's .car file format

dbg.re

11–20 of 73 posts

Re: A deep dive into Apple's .car file format

#11

Idea: pass the decompiled code through a "please rename variables according to their purpose" step using a coding agent. Not ideal, but arguably better than v03, v20. And almost zero effort at this time and age.

And have it hallucinate stuff? Nah, this stuff is hard enough without LLMs guessing.

Re: A deep dive into Apple's .car file format

#12
post #9

Looks very much like a format that should just have been gzipped JSON. Don't use binary formats when it isn't absolutely needed.

Strong disagree. I like binary formats because I can just fopen(), fseek() and fread() stuff. I don't need json parser dependency, and don't need to deal with compression. Binary formats are simple, fast and I need a way smaller buffer to read/write them normally. I don't like wasting resources.

Binary formats are painful to deal with from user perspective

Sane for 3rd party devs

Re: A deep dive into Apple's .car file format

#13
post #4

Looks very much like a format that should just have been gzipped JSON. Don't use binary formats when it isn't absolutely needed.

Uh. You want to store assets in JSON? Why? You generally want asset packs to be seekable so that you can extract just one asset, and why would you want to add the overhead of parsing potentially gigabytes of JSON and then, per asset, decoding potentially tens of megabytes of base64?

Someday JSON will be out of fashion - like XML is now.

Re: A deep dive into Apple's .car file format

#14
Claude is pretty good at turning (dis)assembly into Objective-C. i went exploring these systems looking for the secrets of glass icon rendering. i used ipsw to unpack all the class metadata in relevant system private frameworks. for each class, i extracted class header/interface, and a assembly file per method in the header. i wrote a ruby script to shell out to claude cli with a custom system prompt to give me readable-ish obj-c. It struggled with some patterns but with code as string-dispatch method-call-heavy as obj-c there’s lots of good hints for the ai.

i learned a lot about lldb debugging when i went spelunking through system service process memory. eventually i got too distracted learning about runtime introspection in Swift and obj-c and ended up building a dynamic object explorer/debugger instead of accomplishing my original goal. obj-c runtime dynamism is fascinating. it’s like, “what if we make C as dynamic as Ruby”. you can invent new classes at runtime, swap method implementations, create a new class that extends a specific existing object. you can even change what class an object is.

Swift is a lot less dynamic and a lot less introspectable at runtime :-( (there is a swift reflection api called Mirror but i struggled to do anything interesting with it)

Re: A deep dive into Apple's .car file format

#15
post #11

Idea: pass the decompiled code through a "please rename variables according to their purpose" step using a coding agent. Not ideal, but arguably better than v03, v20. And almost zero effort at this time and age.

And have it hallucinate stuff? Nah, this stuff is hard enough without LLMs guessing.

Well, I mean just choosing better names, don't touch the actual code. and you can also add a basic human filtering step if you want. You cannot possible say that "v12" is better than "header.size". I would argue that even hallucinated names are good: you should be able to think "but this position variable is not quite correctly updated, maybe this is not the position", which seems better than "this v12 variable is updated in some complicated way which I will ignore because it has no meaning".

Re: A deep dive into Apple's .car file format

#16

This is cool work. However, the author claims the following: > This knowledge could be useful for security research and building developer tools that does not rely on Xcode or Apple’s proprietary tools. Yes it could be. But if you developed it for such altruistic purposes, why tease the code? > I’m considering open-sourcing these tools, but no promises yet! Maybe OOP is thinking of selling their reverse engineering t…

I'm not sure it's about money. This maybe be increasingly hard to imagine in this age of AI-slop, but some devs actually don't want to publish code that is a terribly embarrassing mess, and prefer to clean it up first.

Re: A deep dive into Apple's .car file format

#17
post #11

Idea: pass the decompiled code through a "please rename variables according to their purpose" step using a coding agent. Not ideal, but arguably better than v03, v20. And almost zero effort at this time and age.

And have it hallucinate stuff? Nah, this stuff is hard enough without LLMs guessing.

i think for obj-c specifically (can’t speak to other langs) i’ve had a great experience. it does make little mistakes but ai oriented approach makes it faster/easier to find areas of interest to analyze or experiment with.

obj-c sendmsg use makes it more similar to understanding minified JS than decompiling static c because it literally calls many methods by string name.

Re: A deep dive into Apple's .car file format

#19

Looks very much like a format that should just have been gzipped JSON. Don't use binary formats when it isn't absolutely needed.

It's not new. BOMStore is a format inherited from NeXTStep. JSON didn't exist back then.

Also, it's a format designed to hold binary data. JSON can't do that without hacks like base64 encoding.

Binary file stores like this are very common in highly optimized software, which operating systems tend to be, especially if you go looking at the older parts. Windows has a similar format embedded in EXE/DLL files. Same concept: a kind of pseudo-filesystem used to hold app icons and other resources.

Re: A deep dive into Apple's .car file format

#20
post #4

Earlier quoted context omitted.

Uh. You want to store assets in JSON? Why? You generally want asset packs to be seekable so that you can extract just one asset, and why would you want to add the overhead of parsing potentially gigabytes of JSON and then, per asset, decoding potentially tens of megabytes of base64?

> You want to store assets in JSON? Why? Why not have both options? .gltf and .glb being possible for assets been more than helpful to me more than once, having the option gives you the best of both worlds :)

[deleted]
Post reply on HN