HackTricks
HackTricks
Ask or search…
K
Links
Comment on page

macOS Bundles

Basic Information

Basically, a bundle is a directory structure within the file system. Interestingly, by default this directory looks like a single object in Finder.
The common frequent bundle we will encounter is the .app bundle, but many other executables are also packaged as bundles, such as .framework and .systemextension or .kext.
The types of resources contained within a bundle may consist of applications, libraries, images, documentation, header files, etc. All these files are inside <application>.app/Contents/
ls -lR /Applications/Safari.app/Contents
  • Contents/_CodeSignature -> Contains code-signing information about the application (i.e., hashes, etc.).
    • openssl dgst -binary -sha1 /Applications/Safari.app/Contents/Resources/Assets.car | openssl base64
  • Contents/MacOS -> Contains the application’s binary (which is executed when the user double-clicks the application icon in the UI).
  • Contents/Resources -> Contains UI elements of the application, such as images, documents, and nib/xib files (that describe various user interfaces).
  • Contents/Info.plist -> The application’s main “configuration file.” Apple notes that “the system relies on the presence of this file to identify relevant information about [the] application and any related files”.