<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Highlight on DBG.RE</title><link>https://dbg.re/tags/highlight/</link><description>Recent content in Highlight on DBG.RE</description><generator>Hugo</generator><language>en</language><lastBuildDate>Sun, 25 Jan 2026 19:31:52 +0100</lastBuildDate><atom:link href="https://dbg.re/tags/highlight/index.xml" rel="self" type="application/rss+xml"/><item><title>A Deep Dive into Apple's .car File Format</title><link>https://dbg.re/posts/car-file-format/</link><pubDate>Sun, 25 Jan 2026 19:31:52 +0100</pubDate><guid>https://dbg.re/posts/car-file-format/</guid><description>&lt;p&gt;Every modern iOS, macOS, watchOS, and tvOS application uses Asset Catalogs to manage images, colors, icons, and other resources. When you build an app with Xcode, your &lt;code&gt;.xcassets&lt;/code&gt; folders are compiled into binary &lt;code&gt;.car&lt;/code&gt; files that ship with your application. Despite being a fundamental part of every Apple app, there is little to none official documentation about this file format.&lt;/p&gt;
&lt;p&gt;In this post, I&amp;rsquo;ll walk through the process of reverse engineering the &lt;code&gt;.car&lt;/code&gt; file format, explain its internal structures, and show how to parse these files programmatically. This knowledge could be useful for security research and building developer tools that does not rely on Xcode or Apple&amp;rsquo;s proprietary tools.&lt;/p&gt;
&lt;p&gt;As part of this research, I&amp;rsquo;ve built a custom parser and compiler for &lt;code&gt;.car&lt;/code&gt; files that doesn&amp;rsquo;t depend on any of Apple&amp;rsquo;s private frameworks or proprietary tools. To make this research practical, I&amp;rsquo;ve compiled my parser to WebAssembly so it runs entirely in your browser, so no server uploads required. You can drop any &lt;code&gt;.car&lt;/code&gt; file into the &lt;a href="#interactive-demo"&gt;interactive demo&lt;/a&gt; below to explore its content. I&amp;rsquo;m considering open-sourcing these tools, but no promises yet!&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;&lt;em&gt;Join the discussion on &lt;a href="https://lobste.rs/s/z6myes"&gt;Lobsters&lt;/a&gt; or &lt;a href="https://news.ycombinator.com/item?id=47014002"&gt;Hacker News&lt;/a&gt;, or reach out on &lt;a href="https://x.com/ordinal0"&gt;X&lt;/a&gt;.&lt;/em&gt;&lt;/p&gt;
&lt;/blockquote&gt;</description></item></channel></rss>