Mac Bookmark Format =================== *Everything below is little-endian unless otherwise mentioned.* The Bookmark format is a more modern alternative to the alias record. Bookmarks consist of a set of dictionaries mapping keys to values; each dictionary has its own Table of Contents (TOC) structure. The record starts with a header: ====== ==== ======== Offset Size Contents ====== ==== ======== 0 4 Magic number ('book' or 'alis') 4 4 Total size in bytes 8 4 Unknown (0x10040000) - might be a version? 12 4 Size of header (48) 16 32 Reserved ====== ==== ======== All offsets stored in the file are relative to the *end* of this header. This is immediately followed at location 48 by a 4-byte offset to the first TOC structure. It seems odd that this is not part of the header, but for some reason best known to the engineers at Apple, it isn't. A TOC starts with its own header: ====== ==== ======== Offset Size Contents ====== ==== ======== 0 4 Size of TOC in bytes, minus 8 4 4 Magic number (0xfffffffe) 8 4 Identifier (just a number) 12 4 Next TOC offset (or 0 if none) 16 4 Number of entries in this TOC ====== ==== ======== This is followed by an array of TOC entries. There is code that does a binary search of the TOC structure, so they *must* be stored in *key* order. A TOC entry looks like this: ====== ==== ======== Offset Size Contents ====== ==== ======== 0 4 Key 4 4 Offset to data record 8 4 Reserved (0) ====== ==== ======== If the key has its top bit set (0x80000000), then (key & 0x7fffffff) gives the offset of a string record. Each data record has the following fields: ====== ==== ======== Offset Size Contents ====== ==== ======== 0 4 Length of data (n) 4 4 Type 8 n Data bytes ====== ==== ======== Known data types are as follows: ====== ====================== ======== Code Type Encoding ====== ====================== ======== 0x0101 String UTF-8 0x0201 Data Raw bytes 0x0301 Number (signed 8-bit) 1-byte number 0x0302 Number (signed 16-bit) 2-byte number 0x0303 Number (signed 32-bit) 4-byte number 0x0304 Number (signed 64-bit) 8-byte number 0x0305 Number (32-bit float) IEEE single precision 0x0306 Number (64-bit float) IEEE double precision 0x0400 Date *Big-endian* IEEE double precision seconds since 2001-01-01 00:00:00 UTC 0x0500 Boolean (false) No data 0x0501 Boolean (true) No data 0x0601 Array Array of 4-byte offsets to data items 0x0701 Dictionary Array of pairs of 4-byte (key, value) data item offsets 0x0801 UUID Raw bytes 0x0901 URL UTF-8 string 0x0902 URL (relative) 4-byte offset to base URL, 4-byte offset to UTF-8 string ====== ====================== ======== The first TOC in the file generally has its identifier set to 1. As mentioned, the keys in each TOC can be strings, in which case the key field will contain the offset to the string, or they can be certain special values. Currently known values are: ====== ======================= ===== Key Meaning Value ====== ======================= ===== 0x1003 Target URL A URL 0x1004 Target path Array of individual path components 0x1005 Target CNID path Array of CNIDs 0x1010 Target flags Data - see below 0x1020 Target filename String 0x1030 Target CNID 4-byte integer 0x1040 Target creation date Date 0x1054 Unknown Unknown 0x1055 Unknown Unknown 0x1056 Unknown Unknown 0x1101 Unknown Unknown 0x1102 Unknown Unknown 0x2000 TOC path Array - see below 0x2002 Volume path Array of individual path components 0x2005 Volume URL URL of volume root 0x2010 Volume name String 0x2011 Volume UUID String (not a UUID!) 0x2012 Volume size 8-byte integer 0x2013 Volume creation date Date 0x2020 Volume flags Data - see below 0x2030 Volume is root True if the volume was the filesystem root 0x2040 Volume bookmark TOC identifier for disk image 0x2050 Volume mount point URL 0x2070 Unknown Unknown 0xc001 Containing folder index Integer index of containing folder in target path array 0xc011 Creator username Name of user that created bookmark 0xc012 Creator UID UID of user that created bookmark 0xd001 File reference flag True if creating URL was a file reference URL 0xd010 Creation options Integer containing flags passed to CFURLCreateBookmarkData 0xe003 URL length array Array of integers - see below 0xf017 Display name String 0xf020 Icon data icns format data 0xf021 Icon image Data 0xf022 Type binding info dnib byte array 0xf030 Bookmark creation time 64-bit float seconds since January 1st 2001 0xf080 Sandbox RW extension Looks like a hash with data and an access right 0xf081 Sandbox RO extension As above ====== ======================= ===== The target flags (0x1010) are encoded as a Data object containing three 8-byte integers. The first contains flags describing the target; the second says which flags are valid, and the third appears to always be zero. Supported flags can be found in CFURLPriv.h, which is part of CF-Lite; for the target flags field, it's the "resource property flags" that are valid. Similarly the volume flags (0x2020) are encoded in the same manner, but this time it's the "volume property flags" that are interesting. The TOC path (0x2000) is only used if there are multiple volumes between the target and the filesystem root. In that case, it contains an array, with every other item holding a TOC ID for a dictionary describing a volume; the values between TOC IDs appear to be zero. The array starts from the filesystem root. The URL length array (0xe003) is used to indicate how the path components were originally broken up; if the URL encoded by the bookmark has a base URL, each entry in the length array gives the number of path elements that come from that base URL.