Open DMG File

DMG File Format

DMG file format is rather complex and requires significant experience and proficiency in file systems. Thus in this article we will only give a brief introduction to a DMG file format.

DMG format is based on UDIF and NDIF file structure. An interesting aspect of both UDIF and NDIF file formats is that meta information about the disk image is stored at the end of the file – or more specifically 512 bytes from the end of the file. This meta information is called koly or UDIF footer. Below is a structure which maps UDIF footer.

typedef struct DMGUDIF
{
uint32_t u32Magic; /**< 0x000 - Magic, 'koly' (DMGUDIF_MAGIC). */
uint32_t u32Version; /**< 0x004 - The UDIF version (DMGUDIF_VER_CURRENT). */
uint32_t cbFooter; /**< 0x008 - The size of the this structure (512). */
uint32_t fFlags; /**< 0x00c - Flags. */
uint64_t offRunData; /**< 0x010 - Where the running data fork starts (usually 0). */
uint64_t offData; /**< 0x018 - Where the data fork starts (usually 0). */
uint64_t cbData; /**< 0x020 - Size of the data fork (in bytes). */
uint64_t offRsrc; /**< 0x028 - Where the resource fork starts (usually cbData or 0). */
uint64_t cbRsrc; /**< 0x030 - The size of the resource fork. */
uint32_t iSegment; /**< 0x038 - The segment number of this file. */
uint32_t cSegments; /**< 0x03c - The number of segments. */
DMGUDIFID SegmentId; /**< 0x040 - The segment ID. */
DMGUDIFCKSUM DataCkSum; /**< 0x050 - The data checksum. */
uint64_t offXml; /**< 0x0d8 - The XML offset (.plist kind of data). */
uint64_t cbXml; /**< 0x0e0 - The size of the XML. */
uint8_t abUnknown[120]; /**< 0x0e8 - Unknown stuff, hdiutil doesn't dump it... */
DMGUDIFCKSUM MasterCkSum; /**< 0x160 - The master checksum. */
uint32_t u32Type; /**< 0x1e8 - The image type. */
uint64_t cSectors; /**< 0x1ec - The sector count. Warning! Unaligned! */
uint32_t au32Unknown[3]; /**< 0x1f4 - Unknown stuff, hdiutil doesn't dump it... */
} DMGUDIF;


That’s why in order to find out what is stored in DMG file software will first need to look at the very end of the file and read UDIF footer. From there it is possible to get the offset and size of an XML file which contains a list (in .plist format) of properties of the DMG file. This plist contains so called BLKX data which specifies start of the raw data and its block map in a DMG file.