dpp-tool 0.4.3

CLI to explore Apple DMG disk images: DMG → HFS+/APFS → PKG → PBZX → files
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178

<div align="center">

# dpp-tool

[![Crates.io](https://img.shields.io/crates/v/dpp-tool.svg)](https://crates.io/crates/dpp-tool)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
![Platform](https://img.shields.io/badge/platform-windows%20%7C%20linux%20%7C%20macos-lightgrey)

**Cross-platform pure Rust CLI for exploring Apple DMG disk images.**

Navigate the full stack from DMG container down to individual files — no macOS required:

```
DMG (UDIF) → HFS+ or APFS filesystem → PKG installer (XAR) → Payload (PBZX/CPIO) → files
```

<img src="../demo/demo.gif" alt="dpp-tool demo" width="800">

</div>


## Install

```bash
cargo install dpp-tool
```

## Quick Start

```bash
# Overview of everything inside a DMG
dpp-tool info Kernel_Debug_Kit.dmg

# Auto-detect filesystem and browse (works with HFS+ and APFS)
dpp-tool fs tree Kernel_Debug_Kit.dmg /

# Browse the HFS+ filesystem
dpp-tool hfs tree Kernel_Debug_Kit.dmg /

# Inspect a PKG installer inside the DMG
dpp-tool pkg ls Kernel_Debug_Kit.dmg /KernelDebugKit.pkg

# Extract a file from a PKG payload to stdout
dpp-tool payload cat Kernel_Debug_Kit.dmg /KernelDebugKit.pkg com.apple.pkg.KDK /usr/bin/some_tool > tool
```

## Global Options

| Flag | Description |
|------|-------------|
| `--temp-file` | Extract partitions via temp file **(default)** — low memory (~4 KB) |
| `--in-memory` | Buffer partitions in memory — faster for small DMGs |
| `--no-color` | Disable colored output (auto-detected when stdout is not a terminal) |

```bash
# Use in-memory mode for a small DMG
dpp-tool --in-memory fs info small.dmg

# Explicit temp-file mode (same as default)
dpp-tool --temp-file info large.dmg
```

## Commands

| Command | Description |
|---------|-------------|
| `dpp-tool info <dmg>` | Full pipeline overview |
| `dpp-tool bench <dmg>` | Benchmark each pipeline stage |
| **dmg** | |
| `dpp-tool dmg info <dmg>` | DMG format and compression stats |
| `dpp-tool dmg ls <dmg>` | List partitions |
| `dpp-tool dmg cat <dmg> [id]` | Extract raw partition data |
| **fs** (auto-detect) | |
| `dpp-tool fs info <dmg>` | Volume info (auto-detect HFS+/APFS) |
| `dpp-tool fs ls <dmg> <path>` | List directory |
| `dpp-tool fs tree <dmg> [path]` | Browse filesystem tree |
| `dpp-tool fs cat <dmg> <path>` | Extract file to stdout |
| `dpp-tool fs stat <dmg> <path>` | File metadata |
| `dpp-tool fs find <dmg> [opts]` | Find files by name/type |
| **hfs** | |
| `dpp-tool hfs info <dmg>` | HFS+ volume header |
| `dpp-tool hfs ls <dmg> <path>` | List directory |
| `dpp-tool hfs tree <dmg> [path]` | Browse filesystem tree |
| `dpp-tool hfs cat <dmg> <path>` | Extract file to stdout |
| `dpp-tool hfs stat <dmg> <path>` | File metadata |
| `dpp-tool hfs find <dmg> [opts]` | Find files by name/type |
| **apfs** | |
| `dpp-tool apfs info <dmg>` | APFS volume info |
| `dpp-tool apfs ls <dmg> <path>` | List directory |
| `dpp-tool apfs tree <dmg> [path]` | Browse filesystem tree |
| `dpp-tool apfs cat <dmg> <path>` | Extract file to stdout |
| `dpp-tool apfs stat <dmg> <path>` | File metadata |
| `dpp-tool apfs find <dmg> [opts]` | Find files by name/type |
| **pkg** | |
| `dpp-tool pkg info <dmg> <pkg>` | Package statistics |
| `dpp-tool pkg ls <dmg> <pkg>` | List XAR contents |
| `dpp-tool pkg find <dmg> <pkg> [opts]` | Find XAR entries |
| `dpp-tool pkg cat <dmg> <pkg> <file>` | Extract XAR entry |
| **payload** | |
| `dpp-tool payload info <dmg> <pkg> <comp>` | Payload stats |
| `dpp-tool payload ls <dmg> <pkg> <comp> [path]` | List payload files |
| `dpp-tool payload tree <dmg> <pkg> <comp>` | Browse payload tree |
| `dpp-tool payload find <dmg> <pkg> <comp> [opts]` | Find payload files |
| `dpp-tool payload cat <dmg> <pkg> <comp> <file>` | Extract payload file |

## Examples

### DMG layer

```bash
# Compression format and partition map
dpp-tool dmg info Kernel_Debug_Kit.dmg

# List all partitions in the DMG
dpp-tool dmg ls Kernel_Debug_Kit.dmg

# Dump raw partition data
dpp-tool dmg cat Kernel_Debug_Kit.dmg 0 > partition.bin
```

### Filesystem (auto-detect)

```bash
# Auto-detect HFS+ or APFS and show volume info
dpp-tool fs info Kernel_Debug_Kit.dmg

# Browse the directory tree (works with both HFS+ and APFS)
dpp-tool fs tree Kernel_Debug_Kit.dmg /Library

# Find all .pkg files
dpp-tool fs find Kernel_Debug_Kit.dmg

# File metadata
dpp-tool fs stat Kernel_Debug_Kit.dmg /Library/Developer/KDKs
```

### HFS+ filesystem

```bash
# Browse the directory tree
dpp-tool hfs tree Kernel_Debug_Kit.dmg /Library

# List a specific directory
dpp-tool hfs ls Kernel_Debug_Kit.dmg /Library/Developer

# Find all .kext bundles
dpp-tool hfs find Kernel_Debug_Kit.dmg -name "*.kext" -type d

# Extract a file
dpp-tool hfs cat Kernel_Debug_Kit.dmg /System/Library/Kernels/kernel > kernel
```

### PKG installer (XAR)

```bash
# List components inside a PKG
dpp-tool pkg ls Kernel_Debug_Kit.dmg /KernelDebugKit.pkg

# Package statistics
dpp-tool pkg info Kernel_Debug_Kit.dmg /KernelDebugKit.pkg
```

### Payload (PBZX/CPIO)

```bash
# List files inside a payload
dpp-tool payload ls Kernel_Debug_Kit.dmg /KernelDebugKit.pkg com.apple.pkg.KDK /

# Browse payload tree
dpp-tool payload tree Kernel_Debug_Kit.dmg /KernelDebugKit.pkg com.apple.pkg.KDK

# Extract a file from the payload
dpp-tool payload cat Kernel_Debug_Kit.dmg /KernelDebugKit.pkg com.apple.pkg.KDK /usr/bin/some_tool > tool
```

## License

MIT