Formato dei file MBDB e MBDX


Manifest.mbdb and Manifest.mbdx are the two files in the iPhone backup directory which provide information and data about all the other files, along with filesystem structure data.

The MBDX file is the index file of the backup, and indexes elements that will be found in Manifest.mbdb. It is made of a fixed length header and a number of fixed length records, one for each element to be listed.

Header structure:

uint8[6] containing the string “mbdx\2”.
uint32 containing the number of following records.

Records structure:

uint8[20] key of the referenced element, which is also the name of the element as saved in the backup directory.
uint32 offset of the corresponding record in Manifest.mbdb file. The offset doesn’t count the Manifest.mbdb header (6 bytes), so the absolute offset is calculated by adding 6 to the value read in the field.
uint16 file mode.

The file mode is a 16 bits value (from 15 to 0) whose fields contain:

bits 15 to 12 identify the file type: “A” for a symbolic link, “4” for a directory or “8” for a regular file.
bits 11 to 8 permissions for the file owner to read (bit 10), write (bit 9) and execute (bit 8) the element.
bits 7 to 4 permissions for the users in the file group to read (bit 6), write (bit 5) and execute (bit 4) the element.
bits 3 to 0 permissions for all the other users to read (bit 2), write (bit 1) and execute (bit 0) the element.



Con iTunes 9.2 è cambiato il file Manifest.plist, sono stati rimossi i file .mdinfo, e l’ estensione .mddata non viene più usata; comunque la chiave a 40 digit è la stessa.

Ora il database dei file è contenuto in due file: Manifest.mbdb e Manifest.mbdx. La lista delle applicazioni rimane in Manifest.plist, ma il formato è leggermente cambiato.


Importante : tutti i numeri sono big endian.


E’ il file indice.


uint8[6]    'mbdx\2\0'
uint32      record count in the file

record (fixed size of 26 bytes)

uint8[20]  the Key of the file, it's also the filename in the backup directory
           It's the same key as 9.1 backups.
uint32     offset of file record in .mbdb file
           Offsets are counted from the 7th byte. So you have to add 6 to this number
           to get the absolute position in the file.
uint16     file mode
           Axxx  symbolic link
           4xxx  directory
           8xxx  regular file
           The meaning of xxx is unknown to me, it corresponds to the Mode field
           in the old backup data.



uint8[6]    'mbdb\5\0'

record (variable size)

string     Domain
string     Path
string     LinkTarget          absolute path
string     DataHash            SHA.1 (some files only)
string     unknown             always N/A
uint16     Mode                same as mbdx.Mode
uint32     unknown             always 0
uint32     unknown
uint32     UserId
uint32     GroupId             mostly 501 for apps
uint32     Time1               relative to unix epoch (e.g time_t)
uint32     Time2               Time1 or Time2 is the former ModificationTime
uint32     Time3
uint64     FileLength          always 0 for link or directory
uint8      Flag                0 if special (link, directory), otherwise unknown
uint8      PropertyCount       number of properties following

Property is a couple of strings:

string      name
string      value               can be a string or a binary content

A string is composed of a uint16 that contains the length in bytes or 0xFFFF (for null or N/A) then the characters, in UTF-8 with canonical decomposition (Unicode normalization form D).

Lascia un commento

Inserisci i tuoi dati qui sotto o clicca su un'icona per effettuare l'accesso:


Stai commentando usando il tuo account Chiudi sessione / Modifica )

Foto Twitter

Stai commentando usando il tuo account Twitter. Chiudi sessione / Modifica )

Foto di Facebook

Stai commentando usando il tuo account Facebook. Chiudi sessione / Modifica )

Google+ photo

Stai commentando usando il tuo account Google+. Chiudi sessione / Modifica )

Connessione a %s...