CyberChef P-list Viewer

Category: Data Formats Operation: P-list Viewer
Property List macOS iOS XML Binary NeXTSTEP

What is a Property List?

In the macOS, iOS, NeXTSTEP, and GNUstep programming frameworks, property list files are files that store serialized objects. Apple uses plist files extensively throughout their operating systems to store user preferences, application settings, and configuration data.

Property lists (often called "plists") provide a structured way to store hierarchical data using dictionaries, arrays, strings, numbers, dates, and binary data. They serve as a lightweight database format for simple data storage needs.

Common Use Cases: You'll find plist files storing everything from system preferences (~/Library/Preferences/*.plist) to application settings, launch daemons configuration (/Library/LaunchDaemons/*.plist), and Info.plist files inside application bundles that define app metadata.

Property List Formats

Property lists can be stored in three different formats, each with its own advantages:

1. XML Property Lists

The XML format is human-readable and text-based, making it easy to edit manually and version control. This is the format CyberChef's P-list Viewer operation primarily works with.

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ApplicationName</key> <string>MyApp</string> <key>Version</key> <real>1.5</real> <key>EnableFeature</key> <true/> </dict> </plist>

2. Binary Property Lists

Binary plists are more compact and faster to parse than XML plists. Apple's tools often convert plists to binary format for production use. CyberChef can help you analyze these by first converting them using the "From Binary" operation before viewing.

3. OpenStep/ASCII Format

An older, legacy format that uses a syntax similar to JSON or JavaScript object literals. Rarely used in modern systems but still supported for backward compatibility.

Property List Data Types

<dict>
Dictionary containing key-value pairs
<array>
Ordered collection of values
<string>
UTF-8 text data
<integer>
Whole numbers (64-bit)
<real>
Floating-point numbers
<true/> <false/>
Boolean values
<date>
ISO 8601 formatted dates
<data>
Base64-encoded binary data

Using CyberChef's P-list Viewer

The P-list Viewer operation in CyberChef parses property list data and displays it in a readable, structured format. This is particularly useful when analyzing configuration files, application preferences, or examining plist data extracted from system forensics.

Basic Usage Steps:

  1. Load your plist file data into CyberChef's input pane
  2. Add the "P-list Viewer" operation from the Data format category
  3. The output will show the parsed structure in a readable format
  4. Use the "JSON" format option to convert the plist to JSON for further processing
Pro Tip: If you have a binary plist, chain the operations: "From Binary" → "P-list Viewer" to first convert and then view the data. You can also use "To JSON" after P-list Viewer to get a standard JSON representation.

Example: Application Preferences

Sample P-list Structure
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>User</key> <dict> <key>Username</key> <string>john_doe</string> <key>UserID</key> <integer>501</integer> </dict> <key>RecentFiles</key> <array> <string>/Users/john/Documents/report.pdf</string> <string>/Users/john/Documents/data.xlsx</string> </array> <key>LastLogin</key> <date>2024-03-15T14:30:00Z</date> <key>DarkModeEnabled</key> <true/> </dict> </plist>
User: Username: john_doe UserID: 501 RecentFiles: [0]: /Users/john/Documents/report.pdf [1]: /Users/john/Documents/data.xlsx LastLogin: 2024-03-15T14:30:00Z DarkModeEnabled: true

Common Analysis Scenarios

1. Examining System Preferences

Analyze user preferences and settings stored in ~/Library/Preferences/ to understand application configuration or troubleshoot issues.

2. Application Bundle Analysis

Every macOS and iOS application contains an Info.plist file that defines the app's capabilities, permissions, and metadata. Use P-list Viewer to inspect these files during security analysis or reverse engineering.

3. Launch Daemon Configuration

System launch daemons and agents are configured using plist files. Analyzing these can reveal persistence mechanisms, scheduled tasks, and system service configurations.

4. Mobile Device Backups

iOS backups contain numerous plist files storing app data, settings, and user information. P-list Viewer helps parse these for forensic analysis or data recovery.

Working with Binary Plists in CyberChef

Binary plist files begin with the magic bytes "bplist". To work with them in CyberChef:

  1. First, identify the format by checking for "bplist00" or "bplist15" at the start
  2. Use macOS command line tools to convert: plutil -convert xml1 file.plist
  3. Or use Python's plistlib module to convert before importing to CyberChef
  4. Once converted to XML, use P-list Viewer operation normally
Note: CyberChef's P-list Viewer primarily handles XML format. For binary plists, external conversion is typically needed before analysis.

Recipe Ideas

Here are some useful CyberChef recipe combinations involving P-list Viewer:

Security Considerations

When analyzing plist files, be aware that they may contain:

Always handle plist data from untrusted sources with appropriate security controls and never expose sensitive plist contents publicly.

← Back to Operations Guide