apfs

README

[WIP] go-apfs 🚧

APFS parser written in pure Go

---

Originally from this ipsw branch

Install

go get github.com/blacktop/go-apfs

apfs cli

Install

go install github.com/blacktop/go-apfs/cmd/apfs@latest

With Homebrew

brew install blacktop/tap/apfs

OR download from Releases

Build

git clone https://github.com/blacktop/go-apfs.git
cd go-apfs
make build

List files

Extract filesystem DMG from IPSW using ipsw

❯ ipsw extract --dmg IPSW
   • Extracting File System DMG
   • Created 018-62379-017.dmg

List the / directory

❯ apfs ls 018-62379-017.dmg

DT_DIR - 06Jun21 02:54:21 - .ba
DT_DIR - 06Jun21 02:54:22 - .mb
DT_DIR - 06Jun21 02:54:22 - Applications
DT_DIR - 06Jun21 02:54:54 - Developer
DT_DIR - 06Jun21 02:54:54 - Library
DT_DIR - 06Jun21 02:55:03 - System
DT_DIR - 06Jun21 03:01:39 - bin
DT_DIR - 06Jun21 03:01:39 - cores
DT_DIR - 06Jun21 03:01:39 - dev
DT_DIR - 06Jun21 03:01:39 - private
DT_DIR - 06Jun21 03:01:39 - sbin
DT_DIR - 06Jun21 03:01:39 - usr
DT_LNK - 06Jun21 03:01:39 - etc
DT_LNK - 06Jun21 03:01:39 - tmp
DT_LNK - 06Jun21 03:01:53 - var
DT_REG - 06Jun21 02:54:21 - .file

Cat files

❯ apfs cat APFS.dmg /System/Library/FeatureFlags/Global.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>SiriUI</key>
        <dict>
                <key>Pym</key>
                <dict>
                        <key>Enabled</key>
                        <true/>

Copy files

❯ apfs cp APFS.dmg /System/Library/Caches/com.apple.dyld/dyld_shared_cache_arm64e

❯ ls -lah dyld_shared_cache_arm64e

-rwxr-xr-x  1 blacktop  staff   1.4G Sep  9 23:56 dyld_shared_cache_arm64e

Spec

Supports up to version 2020-06-22 of the APFS specification

License

Apache 2.0 Copyright (c) 2020-2023 blacktop

Documentation

Overview

Package apfs implements access to and creation of APFS volumes.

Index

• type APFS
  • func NewAPFS(dev disk.Device) (*APFS, error)
  • func (a *APFS) Cat(path string) error
  • func (a *APFS) Close() error
  • func (a *APFS) Copy(src, dest string) (err error)
  • func (a *APFS) List(path string) error
  • func (a *APFS) OidInfo(oid uint64) error
  • func (a *APFS) Tree(path string) error

Types

type APFS

type APFS struct {
	Container   *types.NxSuperblock
	Valid       *types.NxSuperblock
	Volume      *types.ApfsSuperblock
	FSRootBtree types.BTreeNodePhys
	// contains filtered or unexported fields
}

APFS apple file system object

func NewAPFS

func NewAPFS(dev disk.Device) (*APFS, error)

NewAPFS creates a new APFS for accessing a apple filesystem container or file in an underlying reader. The apfs is expected to start at position 0 in the ReaderAt.

func (*APFS) Cat

func (a *APFS) Cat(path string) error

Cat prints a file at a given path to stdout

func (*APFS) Close

func (a *APFS) Close() error

Close closes the APFS. If the APFS was created using NewFile directly instead of Open, Close has no effect.

func (*APFS) Copy

func (a *APFS) Copy(src, dest string) (err error)

Copy copies the contents of the src file to the dest file TODO: finish this

func (*APFS) List

func (a *APFS) List(path string) error

List lists files at a given path

func (*APFS) OidInfo

func (a *APFS) OidInfo(oid uint64) error

func (*APFS) Tree

func (a *APFS) Tree(path string) error

Tree list contents of directories in a tree-like format. TODO: finish this