iphone - restaurar - Cómo analizar el archivo Manifest.mbdb en una copia de seguridad de iOS 4.0 iTunes

restaurar copia de seguridad iphone

Question

En iOS 4.0, Apple ha rediseñado el proceso de copia de seguridad.

iTunes solía almacenar una lista de nombres de archivos asociados con los archivos de copia de seguridad en el archivo Manifest.plist, pero en iOS 4.0 ha movido esta información a un Manifest.mbdb

Puede ver un ejemplo de este archivo haciendo una copia de seguridad con sus dispositivos con iOS 4.0 y buscando en su carpeta ~ / Library / Application Support / MobileSync / Backup (Mire dentro de las subcarpetas con la fecha más reciente)

Aquí hay una captura de pantalla de cómo se ve el archivo en un editor de texto:

texto alternativo http://supercrazyawesome.com/images/mbdb.png

¿Cómo puedo analizar esto en una aplicación Cocoa para que pueda actualizar mi aplicación (gratuita) Backup Extractor de iPhone ( http://supercrazyawesome.com ) para iOS 4.0?

Answer 1

Aquí puede encontrar información y una pequeña descripción del formato MBDB / MBDX:

http://code.google.com/p/iphonebackupbrowser/

Esta es mi aplicación para explorar los archivos de respaldo. Intenté documentar el formato de los nuevos archivos que vienen con iTunes 9.2.

Answer 2

En iOS 5, se eliminó el archivo Manifest.mbdx. A los efectos de este artículo, era redundante de todos modos, porque el dominio y la ruta se encuentran en Manifest.mbdb y el hash de ID se puede generar con SHA1.

Aquí está mi actualización del código de galloglass, por lo que funciona con copias de seguridad de dispositivos iOS 5. Los únicos cambios son la eliminación de process_mbdx_file () y la adición de algunas líneas en process_mbdb_file ().

Probado con copias de seguridad de un iPhone 4S y un iPad 1, ambos con muchas aplicaciones y archivos.

#!/usr/bin/env python
import sys
import hashlib

mbdx = {}

def getint(data, offset, intsize):
    """Retrieve an integer (big-endian) and new offset from the current offset"""
    value = 0
    while intsize > 0:
        value = (value<<8) + ord(data[offset])
        offset = offset + 1
        intsize = intsize - 1
    return value, offset

def getstring(data, offset):
    """Retrieve a string and new offset from the current offset into the data"""
    if data[offset] == chr(0xFF) and data[offset+1] == chr(0xFF):
        return '''', offset+2 # Blank string
    length, offset = getint(data, offset, 2) # 2-byte length
    value = data[offset:offset+length]
    return value, (offset + length)

def process_mbdb_file(filename):
    mbdb = {} # Map offset of info in this file => file info
    data = open(filename).read()
    if data[0:4] != "mbdb": raise Exception("This does not look like an MBDB file")
    offset = 4
    offset = offset + 2 # value x05 x00, not sure what this is
    while offset < len(data):
        fileinfo = {}
        fileinfo[''start_offset''] = offset
        fileinfo[''domain''], offset = getstring(data, offset)
        fileinfo[''filename''], offset = getstring(data, offset)
        fileinfo[''linktarget''], offset = getstring(data, offset)
        fileinfo[''datahash''], offset = getstring(data, offset)
        fileinfo[''unknown1''], offset = getstring(data, offset)
        fileinfo[''mode''], offset = getint(data, offset, 2)
        fileinfo[''unknown2''], offset = getint(data, offset, 4)
        fileinfo[''unknown3''], offset = getint(data, offset, 4)
        fileinfo[''userid''], offset = getint(data, offset, 4)
        fileinfo[''groupid''], offset = getint(data, offset, 4)
        fileinfo[''mtime''], offset = getint(data, offset, 4)
        fileinfo[''atime''], offset = getint(data, offset, 4)
        fileinfo[''ctime''], offset = getint(data, offset, 4)
        fileinfo[''filelen''], offset = getint(data, offset, 8)
        fileinfo[''flag''], offset = getint(data, offset, 1)
        fileinfo[''numprops''], offset = getint(data, offset, 1)
        fileinfo[''properties''] = {}
        for ii in range(fileinfo[''numprops'']):
            propname, offset = getstring(data, offset)
            propval, offset = getstring(data, offset)
            fileinfo[''properties''][propname] = propval
        mbdb[fileinfo[''start_offset'']] = fileinfo
        fullpath = fileinfo[''domain''] + ''-'' + fileinfo[''filename'']
        id = hashlib.sha1(fullpath)
        mbdx[fileinfo[''start_offset'']] = id.hexdigest()
    return mbdb

def modestr(val):
    def mode(val):
        if (val & 0x4): r = ''r''
        else: r = ''-''
        if (val & 0x2): w = ''w''
        else: w = ''-''
        if (val & 0x1): x = ''x''
        else: x = ''-''
        return r+w+x
    return mode(val>>6) + mode((val>>3)) + mode(val)

def fileinfo_str(f, verbose=False):
    if not verbose: return "(%s)%s::%s" % (f[''fileID''], f[''domain''], f[''filename''])
    if (f[''mode''] & 0xE000) == 0xA000: type = ''l'' # symlink
    elif (f[''mode''] & 0xE000) == 0x8000: type = ''-'' # file
    elif (f[''mode''] & 0xE000) == 0x4000: type = ''d'' # dir
    else: 
        print >> sys.stderr, "Unknown file type %04x for %s" % (f[''mode''], fileinfo_str(f, False))
        type = ''?'' # unknown
    info = ("%s%s %08x %08x %7d %10d %10d %10d (%s)%s::%s" % 
            (type, modestr(f[''mode'']&0x0FFF) , f[''userid''], f[''groupid''], f[''filelen''], 
             f[''mtime''], f[''atime''], f[''ctime''], f[''fileID''], f[''domain''], f[''filename'']))
    if type == ''l'': info = info + '' -> '' + f[''linktarget''] # symlink destination
    for name, value in f[''properties''].items(): # extra properties
        info = info + '' '' + name + ''='' + repr(value)
    return info

verbose = True
if __name__ == ''__main__'':
    mbdb = process_mbdb_file("Manifest.mbdb")
    for offset, fileinfo in mbdb.items():
        if offset in mbdx:
            fileinfo[''fileID''] = mbdx[offset]
        else:
            fileinfo[''fileID''] = "<nofileID>"
            print >> sys.stderr, "No fileID found for %s" % fileinfo_str(fileinfo)
        print fileinfo_str(fileinfo, verbose)

Answer 3

Este script de Python es impresionante.

Aquí está mi versión de Ruby (con una mejora menor) y capacidades de búsqueda. (para iOS 5)

# encoding: utf-8
require ''fileutils''
require ''digest/sha1''

class ManifestParser
  def initialize(mbdb_filename, verbose = false)
    @verbose = verbose
    process_mbdb_file(mbdb_filename)
  end

  # Returns the numbers of records in the Manifest files.
  def record_number
    @mbdb.size
  end

  # Returns a huge string containing the parsing of the Manifest files.
  def to_s
    s = ''''
    @mbdb.each do |v|
      s += "#{fileinfo_str(v)}/n"
    end
    s
  end

  def to_file(filename)
    File.open(filename, ''w'') do |f|
      @mbdb.each do |v|
        f.puts fileinfo_str(v)
      end
    end
  end

  # Copy the backup files to their real path/name.
  # * domain_match Can be a regexp to restrict the files to copy.
  # * filename_match Can be a regexp to restrict the files to copy.
  def rename_files(domain_match = nil, filename_match = nil)
    @mbdb.each do |v|
      if v[:type] == ''-'' # Only rename files.
        if (domain_match.nil? or v[:domain] =~ domain_match) and (filename_match.nil? or v[:filename] =~ filename_match)
          dst = "#{v[:domain]}/#{v[:filename]}"
          puts "Creating: #{dst}"
          FileUtils.mkdir_p(File.dirname(dst))
          FileUtils.cp(v[:fileID], dst)
        end
      end
    end
  end

  # Return the filename that math the given regexp.
  def search(regexp)
    result = Array.new
    @mbdb.each do |v|
      if "#{v[:domain]}::#{v[:filename]}" =~ regexp
        result << v
      end
    end
    result
  end

  private
  # Retrieve an integer (big-endian) and new offset from the current offset
  def getint(data, offset, intsize)
    value = 0
    while intsize > 0
      value = (value<<8) + data[offset].ord
      offset += 1
      intsize -= 1
    end
    return value, offset
  end

  # Retrieve a string and new offset from the current offset into the data
  def getstring(data, offset)
    return '''', offset + 2 if data[offset] == 0xFF.chr and data[offset + 1] == 0xFF.chr # Blank string
    length, offset = getint(data, offset, 2) # 2-byte length
    value = data[offset...(offset + length)]
    return value, (offset + length)
  end

  def process_mbdb_file(filename)
    @mbdb = Array.new
    data = File.open(filename, ''rb'') { |f| f.read }
    puts "MBDB file read. Size: #{data.size}"
    raise ''This does not look like an MBDB file'' if data[0...4] != ''mbdb''
    offset = 4
    offset += 2 # value x05 x00, not sure what this is
    while offset < data.size
      fileinfo = Hash.new
      fileinfo[:start_offset] = offset
      fileinfo[:domain], offset = getstring(data, offset)
      fileinfo[:filename], offset = getstring(data, offset)
      fileinfo[:linktarget], offset = getstring(data, offset)
      fileinfo[:datahash], offset = getstring(data, offset)
      fileinfo[:unknown1], offset = getstring(data, offset)
      fileinfo[:mode], offset = getint(data, offset, 2)
      if (fileinfo[:mode] & 0xE000) == 0xA000 # Symlink
        fileinfo[:type] = ''l''
      elsif (fileinfo[:mode] & 0xE000) == 0x8000 # File
        fileinfo[:type] = ''-''
      elsif (fileinfo[:mode] & 0xE000) == 0x4000 # Dir
        fileinfo[:type] = ''d''
      else
        # $stderr.puts "Unknown file type %04x for #{fileinfo_str(f, false)}" % f[''mode'']
        fileinfo[:type] = ''?''
      end
      fileinfo[:unknown2], offset = getint(data, offset, 4)
      fileinfo[:unknown3], offset = getint(data, offset, 4)
      fileinfo[:userid], offset = getint(data, offset, 4)
      fileinfo[:groupid], offset = getint(data, offset, 4)
      fileinfo[:mtime], offset = getint(data, offset, 4)
      fileinfo[:atime], offset = getint(data, offset, 4)
      fileinfo[:ctime], offset = getint(data, offset, 4)
      fileinfo[:filelen], offset = getint(data, offset, 8)
      fileinfo[:flag], offset = getint(data, offset, 1)
      fileinfo[:numprops], offset = getint(data, offset, 1)
      fileinfo[:properties] = Hash.new
      (0...(fileinfo[:numprops])).each do |ii|
        propname, offset = getstring(data, offset)
        propval, offset = getstring(data, offset)
        fileinfo[:properties][propname] = propval
      end
      # Compute the ID of the file.
      fullpath = fileinfo[:domain] + ''-'' + fileinfo[:filename]
      fileinfo[:fileID] = Digest::SHA1.hexdigest(fullpath)
      # We add the file to the list of files.
      @mbdb << fileinfo
    end
    @mbdb
  end

  def modestr(val)
    def mode(val)
      r = (val & 0x4) ? ''r'' : ''-''
      w = (val & 0x2) ? ''w'' : ''-''
      x = (val & 0x1) ? ''x'' : ''-''
      r + w + x
    end
    mode(val >> 6) + mode(val >> 3) + mode(val)
  end

  def fileinfo_str(f)
    return "(#{f[:fileID]})#{f[:domain]}::#{f[:filename]}" unless @verbose
    data = [f[:type], modestr(f[:mode]), f[:userid], f[:groupid], f[:filelen], f[:mtime], f[:atime], f[:ctime], f[:fileID], f[:domain], f[:filename]]
    info = "%s%s %08x %08x %7d %10d %10d %10d (%s)%s::%s" % data
    info += '' -> '' + f[:linktarget] if f[:type] == ''l'' # Symlink destination
    f[:properties].each do |k, v|
      info += " #{k}=#{v.inspect}"
    end
    info
  end
end

if __FILE__ == $0
  mp = ManifestParser.new ''Manifest.mbdb'', true
  mp.to_file ''filenames.txt''
end

Answer 4

Gracias a la respuesta de galloglass. El código funciona muy bien con Python 2.7. Solo hay una cosa que quiero decir. Cuando lea el archivo manifest.mbdb, debe usar el modo binario. De lo contrario, no se lee todo el contenido.

También hice algunos cambios menores para hacer que el código funcione con Python 3.4. Aquí está el código.

#!/usr/bin/env python
import sys
import hashlib

mbdx = {}

def getint(data, offset, intsize):
    """Retrieve an integer (big-endian) and new offset from the current offset"""
    value = 0
    while intsize > 0:
        value = (value << 8) + data[offset]
        offset = offset + 1
        intsize = intsize - 1
    return value, offset

def getstring(data, offset):
    """Retrieve a string and new offset from the current offset into the data"""
    if chr(data[offset]) == chr(0xFF) and chr(data[offset + 1]) == chr(0xFF):
        return '''', offset + 2  # Blank string
    length, offset = getint(data, offset, 2)  # 2-byte length
    value = data[offset:offset + length]
    return value.decode(encoding=''latin-1''), (offset + length)

def process_mbdb_file(filename):
    mbdb = {}  # Map offset of info in this file => file info
    data = open(filename, ''rb'').read()  # ''b'' is needed to read all content at once
    if data[0:4].decode() != "mbdb": raise Exception("This does not look like an MBDB file")
    offset = 4
    offset = offset + 2  # value x05 x00, not sure what this is
    while offset < len(data):
        fileinfo = {}
        fileinfo[''start_offset''] = offset
        fileinfo[''domain''], offset = getstring(data, offset)
        fileinfo[''filename''], offset = getstring(data, offset)
        fileinfo[''linktarget''], offset = getstring(data, offset)
        fileinfo[''datahash''], offset = getstring(data, offset)
        fileinfo[''unknown1''], offset = getstring(data, offset)
        fileinfo[''mode''], offset = getint(data, offset, 2)
        fileinfo[''unknown2''], offset = getint(data, offset, 4)
        fileinfo[''unknown3''], offset = getint(data, offset, 4)
        fileinfo[''userid''], offset = getint(data, offset, 4)
        fileinfo[''groupid''], offset = getint(data, offset, 4)
        fileinfo[''mtime''], offset = getint(data, offset, 4)
        fileinfo[''atime''], offset = getint(data, offset, 4)
        fileinfo[''ctime''], offset = getint(data, offset, 4)
        fileinfo[''filelen''], offset = getint(data, offset, 8)
        fileinfo[''flag''], offset = getint(data, offset, 1)
        fileinfo[''numprops''], offset = getint(data, offset, 1)
        fileinfo[''properties''] = {}
        for ii in range(fileinfo[''numprops'']):
            propname, offset = getstring(data, offset)
            propval, offset = getstring(data, offset)
            fileinfo[''properties''][propname] = propval
        mbdb[fileinfo[''start_offset'']] = fileinfo
        fullpath = fileinfo[''domain''] + ''-'' + fileinfo[''filename'']
        id = hashlib.sha1(fullpath.encode())
        mbdx[fileinfo[''start_offset'']] = id.hexdigest()
    return mbdb

def modestr(val):
    def mode(val):
        if (val & 0x4):
            r = ''r''
        else:
            r = ''-''
        if (val & 0x2):
            w = ''w''
        else:
            w = ''-''
        if (val & 0x1):
            x = ''x''
        else:
            x = ''-''
        return r + w + x
    return mode(val >> 6) + mode((val >> 3)) + mode(val)

def fileinfo_str(f, verbose=False):
    if not verbose: return "(%s)%s::%s" % (f[''fileID''], f[''domain''], f[''filename''])
    if (f[''mode''] & 0xE000) == 0xA000:
        type = ''l''  # symlink
    elif (f[''mode''] & 0xE000) == 0x8000:
        type = ''-''  # file
    elif (f[''mode''] & 0xE000) == 0x4000:
        type = ''d''  # dir
    else:
        print >> sys.stderr, "Unknown file type %04x for %s" % (f[''mode''], fileinfo_str(f, False))
        type = ''?''  # unknown
    info = ("%s%s %08x %08x %7d %10d %10d %10d (%s)%s::%s" %
            (type, modestr(f[''mode''] & 0x0FFF), f[''userid''], f[''groupid''], f[''filelen''],
             f[''mtime''], f[''atime''], f[''ctime''], f[''fileID''], f[''domain''], f[''filename'']))
    if type == ''l'': info = info + '' -> '' + f[''linktarget'']  # symlink destination
    for name, value in f[''properties''].items():  # extra properties
        info = info + '' '' + name + ''='' + repr(value)
    return info

verbose = True
if __name__ == ''__main__'':
    mbdb = process_mbdb_file(
        r"Manifest.mbdb")
    for offset, fileinfo in mbdb.items():
        if offset in mbdx:
            fileinfo[''fileID''] = mbdx[offset]
        else:
            fileinfo[''fileID''] = "<nofileID>"
            print >> sys.stderr, "No fileID found for %s" % fileinfo_str(fileinfo)
        print(fileinfo_str(fileinfo, verbose))

Answer 5

Gracias, user374559 y reneD: ese código y descripción son muy útiles.

Apuñalé a Python para analizar e imprimir la información en un formato Unix ls-l like:

#!/usr/bin/env python
import sys

def getint(data, offset, intsize):
    """Retrieve an integer (big-endian) and new offset from the current offset"""
    value = 0
    while intsize > 0:
        value = (value<<8) + ord(data[offset])
        offset = offset + 1
        intsize = intsize - 1
    return value, offset

def getstring(data, offset):
    """Retrieve a string and new offset from the current offset into the data"""
    if data[offset] == chr(0xFF) and data[offset+1] == chr(0xFF):
        return '''', offset+2 # Blank string
    length, offset = getint(data, offset, 2) # 2-byte length
    value = data[offset:offset+length]
    return value, (offset + length)

def process_mbdb_file(filename):
    mbdb = {} # Map offset of info in this file => file info
    data = open(filename).read()
    if data[0:4] != "mbdb": raise Exception("This does not look like an MBDB file")
    offset = 4
    offset = offset + 2 # value x05 x00, not sure what this is
    while offset < len(data):
        fileinfo = {}
        fileinfo[''start_offset''] = offset
        fileinfo[''domain''], offset = getstring(data, offset)
        fileinfo[''filename''], offset = getstring(data, offset)
        fileinfo[''linktarget''], offset = getstring(data, offset)
        fileinfo[''datahash''], offset = getstring(data, offset)
        fileinfo[''unknown1''], offset = getstring(data, offset)
        fileinfo[''mode''], offset = getint(data, offset, 2)
        fileinfo[''unknown2''], offset = getint(data, offset, 4)
        fileinfo[''unknown3''], offset = getint(data, offset, 4)
        fileinfo[''userid''], offset = getint(data, offset, 4)
        fileinfo[''groupid''], offset = getint(data, offset, 4)
        fileinfo[''mtime''], offset = getint(data, offset, 4)
        fileinfo[''atime''], offset = getint(data, offset, 4)
        fileinfo[''ctime''], offset = getint(data, offset, 4)
        fileinfo[''filelen''], offset = getint(data, offset, 8)
        fileinfo[''flag''], offset = getint(data, offset, 1)
        fileinfo[''numprops''], offset = getint(data, offset, 1)
        fileinfo[''properties''] = {}
        for ii in range(fileinfo[''numprops'']):
            propname, offset = getstring(data, offset)
            propval, offset = getstring(data, offset)
            fileinfo[''properties''][propname] = propval
        mbdb[fileinfo[''start_offset'']] = fileinfo
    return mbdb

def process_mbdx_file(filename):
    mbdx = {} # Map offset of info in the MBDB file => fileID string
    data = open(filename).read()
    if data[0:4] != "mbdx": raise Exception("This does not look like an MBDX file")
    offset = 4
    offset = offset + 2 # value 0x02 0x00, not sure what this is
    filecount, offset = getint(data, offset, 4) # 4-byte count of records 
    while offset < len(data):
        # 26 byte record, made up of ...
        fileID = data[offset:offset+20] # 20 bytes of fileID
        fileID_string = ''''.join([''%02x'' % ord(b) for b in fileID])
        offset = offset + 20
        mbdb_offset, offset = getint(data, offset, 4) # 4-byte offset field
        mbdb_offset = mbdb_offset + 6 # Add 6 to get past prolog
        mode, offset = getint(data, offset, 2) # 2-byte mode field
        mbdx[mbdb_offset] = fileID_string
    return mbdx

def modestr(val):
    def mode(val):
        if (val & 0x4): r = ''r''
        else: r = ''-''
        if (val & 0x2): w = ''w''
        else: w = ''-''
        if (val & 0x1): x = ''x''
        else: x = ''-''
        return r+w+x
    return mode(val>>6) + mode((val>>3)) + mode(val)

def fileinfo_str(f, verbose=False):
    if not verbose: return "(%s)%s::%s" % (f[''fileID''], f[''domain''], f[''filename''])
    if (f[''mode''] & 0xE000) == 0xA000: type = ''l'' # symlink
    elif (f[''mode''] & 0xE000) == 0x8000: type = ''-'' # file
    elif (f[''mode''] & 0xE000) == 0x4000: type = ''d'' # dir
    else: 
        print >> sys.stderr, "Unknown file type %04x for %s" % (f[''mode''], fileinfo_str(f, False))
        type = ''?'' # unknown
    info = ("%s%s %08x %08x %7d %10d %10d %10d (%s)%s::%s" % 
            (type, modestr(f[''mode'']&0x0FFF) , f[''userid''], f[''groupid''], f[''filelen''], 
             f[''mtime''], f[''atime''], f[''ctime''], f[''fileID''], f[''domain''], f[''filename'']))
    if type == ''l'': info = info + '' -> '' + f[''linktarget''] # symlink destination
    for name, value in f[''properties''].items(): # extra properties
        info = info + '' '' + name + ''='' + repr(value)
    return info

verbose = True
if __name__ == ''__main__'':
    mbdb = process_mbdb_file("Manifest.mbdb")
    mbdx = process_mbdx_file("Manifest.mbdx")
    for offset, fileinfo in mbdb.items():
        if offset in mbdx:
            fileinfo[''fileID''] = mbdx[offset]
        else:
            fileinfo[''fileID''] = "<nofileID>"
            print >> sys.stderr, "No fileID found for %s" % fileinfo_str(fileinfo)
        print fileinfo_str(fileinfo, verbose)

Answer 6

Me gustó el código de galloglas, y cambié la función principal para que muestre una lista ordenada de tamaño total por aplicación:

verbose = True
if __name__ == ''__main__'':
    mbdb = process_mbdb_file("Manifest.mbdb")
    mbdx = process_mbdx_file("Manifest.mbdx")
    sizes = {}
    for offset, fileinfo in mbdb.items():
        if offset in mbdx:
            fileinfo[''fileID''] = mbdx[offset]
        else:
            fileinfo[''fileID''] = "<nofileID>"
            print >> sys.stderr, "No fileID found for %s" % fileinfo_str(fileinfo)
        print fileinfo_str(fileinfo, verbose)
        if (fileinfo[''mode''] & 0xE000) == 0x8000:
        sizes[fileinfo[''domain'']]= sizes.get(fileinfo[''domain''],0) + fileinfo[''filelen'']
    for domain in sorted(sizes, key=sizes.get):
        print "%-60s %11d (%dMB)" % (domain, sizes[domain], int(sizes[domain]/1024/1024))

De esa forma puedes averiguar qué aplicación está consumiendo todo ese espacio.

Answer 7

Para aquellos que buscan una implementación Java de un lector de archivos MBDB, hay varios por ahí:

• Proyecto "iPhone Analyzer" (código muy limpio): http://sourceforge.net/p/iphoneanalyzer/code/HEAD/tree/trunk/library/src/main/java/com/crypticbit/ipa/io/parser/manifest/Mbdb.java

• Proyecto "iPhone Stalker": https://code.google.com/p/iphonestalker/source/browse/trunk/src/iphonestalker/util/io/MBDBReader.java

Answer 8

Terminé mi trabajo sobre esto, es decir, iOS 4 + actualización de iTunes 9.2 de mi biblioteca de decodificador de respaldo para Python - http://www.iki.fi/fingon/iphonebackupdb.py

Hace lo que necesito, poca documentación, pero puede copiar ideas desde allí ;-)

(Parece que funciona bien con mis copias de seguridad al menos).