.PAGES File Format – IWA archives

Chunk framing

The file is a run of chunks, each with a 4-byte header. It is close to Snappy’s framing format, but iWork leaves out the stream identifier chunk and the CRC-32C checksums.

Decompress each chunk and join the results to get the object stream.

Snappy blocks

A Snappy block (Google’s published format) starts with the uncompressed length as a varint, then a series of elements. The low two bits of each element’s tag byte give its kind:

A copy repeats length bytes starting offset bytes back in the output; the ranges may overlap.

Object stream

The decompressed data is a sequence of objects. Each is a varint giving the length of an ArchiveInfo message, that message, and then the payloads it describes:

varint  archiveInfoLength
ArchiveInfo  (archiveInfoLength bytes)
payload 1    (MessageInfo[0].length bytes)
…            (in practice there is one payload per object)

message ArchiveInfo {
  optional uint64 identifier = 1;              // unique across the document
  repeated MessageInfo message_infos = 2;
}

message MessageInfo {
  required uint32 type = 1;                    // which message the payload is
  repeated uint32 version = 2 [packed = true]; // format version, 1.0.5 when documented
  required uint32 length = 3;                  // payload length in bytes
  repeated FieldInfo field_infos = 4;          // not seen in practice
  repeated uint64 object_references = 5 [packed = true];
  repeated uint64 data_references = 6 [packed = true];
}

• identifier is how other objects refer to this one, across all the .iwa files of the document.
• object_references lists the identifiers this object points to, and data_references the data files (in Data/) it uses; both are bookkeeping for cross-references.
• The payload is a Protocol Buffers message whose type is given by type. Protocol Buffers are not self-describing, so a reader must know each message’s definition; iWorkFileFormat recovered the definitions from the iWork programs with its proto-dump tool.

Message types

Each iWork program maps type numbers to messages in its TSPRegistry; the shared frameworks use the same numbers in Pages, Keynote and Numbers, and each program adds its own. The numbers below are those iWorkFileFormat extracted from the 2013 programs; later versions add more.

Most of the other TP types (10101 and up) are undo commands, such as TP.InsertDrawablesCommandArchive (10101) and TP.InsertFootnoteCommandArchive (10113). Every number is listed on message type numbers.

The text of the document is in TSWP.StorageArchive objects. The fields of the messages are on document messages, text and styles and drawables.