README
¶
[WIP] go-apfs 🚧
APFS parser written in pure Go
Originally from this ipsw branch
Install
go get github.com/blacktop/go-apfs
apfs cli
Install
go install github.com/blacktop/go-apfs/cmd/apfs@latest
With Homebrew
brew install blacktop/tap/apfs
OR download from Releases
Build
git clone https://github.com/blacktop/go-apfs.git
cd go-apfs
make build
List files
Extract filesystem DMG from IPSW using ipsw
❯ ipsw extract --dmg IPSW
• Extracting File System DMG
• Created 018-62379-017.dmg
List the / directory
❯ apfs ls 018-62379-017.dmg
DT_DIR - 06Jun21 02:54:21 - .ba
DT_DIR - 06Jun21 02:54:22 - .mb
DT_DIR - 06Jun21 02:54:22 - Applications
DT_DIR - 06Jun21 02:54:54 - Developer
DT_DIR - 06Jun21 02:54:54 - Library
DT_DIR - 06Jun21 02:55:03 - System
DT_DIR - 06Jun21 03:01:39 - bin
DT_DIR - 06Jun21 03:01:39 - cores
DT_DIR - 06Jun21 03:01:39 - dev
DT_DIR - 06Jun21 03:01:39 - private
DT_DIR - 06Jun21 03:01:39 - sbin
DT_DIR - 06Jun21 03:01:39 - usr
DT_LNK - 06Jun21 03:01:39 - etc
DT_LNK - 06Jun21 03:01:39 - tmp
DT_LNK - 06Jun21 03:01:53 - var
DT_REG - 06Jun21 02:54:21 - .file
Cat files
❯ apfs cat APFS.dmg /System/Library/FeatureFlags/Global.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>SiriUI</key>
<dict>
<key>Pym</key>
<dict>
<key>Enabled</key>
<true/>
Copy files
❯ apfs cp APFS.dmg /System/Library/Caches/com.apple.dyld/dyld_shared_cache_arm64e
❯ ls -lah dyld_shared_cache_arm64e
-rwxr-xr-x 1 blacktop staff 1.4G Sep 9 23:56 dyld_shared_cache_arm64e
Spec
Supports up to version 2020-06-22 of the APFS specification
License
Apache 2.0 Copyright (c) 2020-2023 blacktop
Documentation
¶
Overview ¶
Package apfs implements access to and creation of APFS volumes.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type APFS ¶
type APFS struct {
Container *types.NxSuperblock
Valid *types.NxSuperblock
Volume *types.ApfsSuperblock
FSRootBtree types.BTreeNodePhys
// contains filtered or unexported fields
}
APFS apple file system object
func NewAPFS ¶
NewAPFS creates a new APFS for accessing a apple filesystem container or file in an underlying reader. The apfs is expected to start at position 0 in the ReaderAt.
func Open ¶ added in v1.0.23
Open opens the named file using os.Open and prepares it for use as an APFS.
func (*APFS) Close ¶
Close closes the APFS. If the APFS was created using NewFile directly instead of Open, Close has no effect.
Source Files
Directories