Home/ Questions/Q 8326013
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-09T00:37:55+00:00

I’m trying to write a script to extract the original download URL from disk

  • 0

I’m trying to write a script to extract the original download URL from disk images downloaded with Safari on OS X using xattr, so that I can rename them but still easily obtain their original names for reference.

This command prints the hex representation of the URL that the given file was downloaded from, as an example:

xattr -p com.apple.metadata:kMDItemWhereFroms *.dmg

gives

62 70 6C 69 73 74 30 30 A1 01 5F 10 4F 68 74 74
70 3A 2F 2F 61 64 63 64 6F 77 6E 6C 6F 61 64 2E
61 70 70 6C 65 2E 63 6F 6D 2F 4D 61 63 5F 4F 53
5F 58 2F 6D 61 63 5F 6F 73 5F 78 5F 31 30 2E 36
2E 31 5F 62 75 69 6C 64 5F 31 30 62 35 30 34 2F
30 34 31 35 30 37 33 61 2E 64 6D 67 08 0A 00 00
00 00 00 00 01 01 00 00 00 00 00 00 00 02 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 5C

The URL starts at the 14th byte (if I counted correctly) and is NULL terminated. How can I format this string so that I get a string output as follows:

http://adcdownload.apple.com/Mac_OS_X/mac_os_x_10.6.1_build_10b504/0415073a.dmg

(don’t worry, this link doesn’t work unless you’re logged in to ADC)

…essentially, the same thing Finder will display in Get Info. I tried piping xattr’s output to xxd but I’m not sure how to specify the offset so the string starts at the right place.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    So, after looking at the binary data returned by xattr -p, I realized that it was actually a binary plist… hence “bplist” at the front of the data. For some reason I didn’t notice this before, but in light of this, here’s a proper solution that should work on every OS X from 10.5 to 10.8.

    To avoid duplication, I’ll link to the source instead of pasting it: https://github.com/jakepetroules/wherefrom

    • 0