.KEY File Format – IWA archives

Chunk framing

The file is a run of chunks with 4-byte headers, like Snappy’s framing format but with no stream identifier chunk and no CRC-32C checksums.

Snappy blocks

A block starts with the uncompressed length as a varint, then elements whose tag byte’s low two bits give the kind:

A copy repeats bytes from offset bytes back in the output, possibly overlapping.

Object stream

The decompressed data is a sequence of objects: a varint length, an ArchiveInfo message of that length, and the payload or payloads it describes (in practice one).

message ArchiveInfo {
  optional uint64 identifier = 1;              // unique across the presentation
  repeated MessageInfo message_infos = 2;
}

message MessageInfo {
  required uint32 type = 1;                    // which message the payload is
  repeated uint32 version = 2 [packed = true]; // format version, 1.0.5 when documented
  required uint32 length = 3;                  // payload length in bytes
  repeated FieldInfo field_infos = 4;          // not seen in practice
  repeated uint64 object_references = 5 [packed = true];
  repeated uint64 data_references = 6 [packed = true];
}

Objects refer to each other by identifier, across files. object_references and data_references list the objects and data files an object uses. A reader needs each payload’s Protocol Buffers definition; iWorkFileFormat extracted them from the programs with proto-dump.

Message types

Type numbers come from each program’s TSPRegistry. Keynote uses the shared iWork frameworks’ numbers and its own KN types. These are the numbers iWorkFileFormat extracted from Keynote 6 (2013).

Types 100 to 148 are 43 undo commands and command helpers, such as KN.CommandShowInsertSlideArchive (101) and KN.CommandSlideInsertDrawablesArchive (104). Type 10011 is TSWP.SectionPlaceholderArchive in Keynote’s registry. Shared types include TSWP.StorageArchive (2001, text), TSD.DrawableArchive (3002), TSD.ImageArchive (3005), TSD.MovieArchive (3007), TST.TableInfoArchive (6000), TSP.PackageMetadata (11006) and TSP.ObjectContainer (11008). Every number is listed on message type numbers, and the fields of the messages on document messages, slides, builds and transitions, text and styles and drawables.