.DMG

Introduction

A .dmg file is a disk image for macOS. Most Mac software downloaded from the web comes as a DMG: opening it mounts a virtual disk in the Finder, and the app is dragged from there to the Applications folder.

The format is Apple’s Universal Disk Image Format (UDIF). An image can be read-only or writable, compressed with one of several methods, and encrypted with a password. Apple has not published a specification, and what is known of the layout comes from other programmers’ work.

Structure

A UDIF image is read from the end. The last 512 bytes are a trailer that starts with the signature koly. Its big-endian fields give the format version, the position and length of the data, the position and length of an XML property list, checksums and the number of sectors in the disk.

The property list holds one block table for each partition of the disk, under the key blkx. Each table starts with mish and lists runs of sectors: where each run is stored in the data area and how, such as raw, zero-filled, or compressed with zlib, bzip2, LZFSE or LZMA. The data area at the start of the file holds these runs one after another. An encrypted image is different: it starts with encrcdsa and wraps the whole image in encryption.

Links