Mac OS 9 Software Update

Scattered notes on reverse engineering how the Mac OS 9 Software Update system works.

URL?

In the Software Update Engine extension, resource ulsu ID = 128 has this URL:

• http://si.info.apple.com/updates/scanningpoints1_2.xml

Unfortunately, no samples of this XML file seem to be archived anywhere.

XML templates

Pieces of a possible request or response format

Hints at the data structures used for requests, responses, and logging.

Log format

From STR# ID = 20000, then prettyprinted. Caret-prefixed numbers are template placeholders.

<DOCUMENT>
    <VERSION>0</VERSION>
    <LOG>
        <DATE>^0</DATE>
        <NAME>^1</NAME>
        <VERSION>^2</VERSION>
        <STATUS>^3</STATUS>
    </LOG>
    <!-- additional log entries... -->
</DOCUMENT>

Network traffic?

I have not done any disassembly yet, so these notes come from poking around in ResEdit.

• Files may have used binhex, StuffIt, and self-extracting archives.
• Though the baked-in URL is http://, the following are likely also supported: ftp://, https://, urlproxy: (?), and file:///.