Reverse Engineering iWork (andrews.substack.com)

A developer reverse-engineered Apple’s modern iWork file format (Pages/Keynote/Numbers) and built a native Swift parser so documents can be decoded client-side without exporting to PDF or sending files to servers. They recovered embedded Protocol Buffer descriptors from Apple’s binaries by scanning for ".proto" signatures and walking the protobuf wire format, used SwiftProtobuf’s visitor API to reconstruct human-readable .proto schemas, and extracted a runtime mapping of numeric type IDs to Objective‑C prototype classes from TSPRegistry (via Frida). With those pieces they generate Swift decoders that handle message type dispatch and protobuf extensions automatically. On the storage/IO side, they implemented Apple’s custom IWA container parsing: Index.zip contains IWA archives made of Snappy‑compressed protobuf chunks. Apple’s Snappy variant omits CRC framing and uses a simple single‑byte header plus 24‑bit length, so they wrote a pure‑Swift decompressor and standard Snappy literal/copy handling. Each archive chunk is a varint‑length prefixed TSP.ArchiveInfo describing repeated MessageInfo entries (type ID + length), followed by payloads decoded using the generated maps. The result preserves object hierarchies, inheritance-like “super” references, and extensions — enabling high‑fidelity, privacy‑preserving extraction of structured document content for ML pipelines, search, or downstream models without lossy OCR/PDF conversion.