Module format 

The kych container: file header, tables, records, attribute values.

Layout per the dtformats specification, with the details it leaves open ([yellow-background]*Unknown* fields, padding, value encodings) pinned down against keychains written by macOS. Everything is big-endian.

file header (20 bytes)
tables array: size, count, count x offset
  table: header (28 bytes), slot array, records, index data
    record: header (24 bytes), attribute offsets, key data, attribute values

The model keeps every field, including the ones whose meaning is unknown and the opaque per-table index data, so that parsing and re-serializing a macOS-written keychain reproduces it byte for byte. That round trip is the test that this understanding of the layout is complete — see tests/keychain_roundtrip.rs.

Structs

Keychain

A parsed keychain database.

Record

Table

Enums

Slot

One entry of a table’s record-slot array.

TableIndexes

A table’s index region: understood, or preserved as-is.

Value

An attribute value, in the format the schema declares for it.

Constants

HEADER_LEN

HEADER_SIZE_FIELD

Value of the header’s size field, which is 4 less than the header itself.

RECORD_HEADER_LEN

SIGNATURE

TABLE_HEADER_LEN

VERSION

Combined major/minor version: major 1, minor 0.

Functions

records_by_type

Group the live records of every table by record type.

trim_nul