Reverse engineering iWork '13 formats

Question

Prior versions of Apple\'s iWork suite used a very simple document format:

• documents were Bundles of resources (folders, zipped or not)
• the bundle contain

Answer 1

Interesting project, I like it! Here is what I have found so far.

The first 4 bytes of each of the iwa files appear to be a length, with a tweak. So it looks like there will not be any 'magic' to verify file type.

Look at Slide1.iwa:
First 4 bytes are 00 79 02 00
File size is 637 bytes
take the first 00 off, and reverse the bytes: 00 02 79
00 02 79 == 633
637 - 633 = 4 bytes that hold the size of the file.

This checks out for the 4 files I looked at: Slide1.iwa, Slide2.iwa, Document.iwa, DocumentStylesheet.iwa

Answer 2

I've done some work reverse engineering the format and published my results here. I've written up a description of the format and provided a sample project as well.

Basically, the .iwa files are Protobuf streams compressed using Snappy.

Hope this helps!