Does anyone here have any useful information on reading the Mozilla cache file format?
I've searched on Google, and even tried reading the Mozilla source code, and haven't found anything useful yet.
The best I can determine is that records start on 256 byte boundaries, and contain some kind of field-delimited structure with the headers and the content stored in it.
Hi !
Take a look at these links
http//
http//
😉
Very nice.
A few inaccurate points here and there, but overall, it was very useful in helping me to decipher this format.
In case someone comes across this page in trying to determine how to deal with this format, here is what I found.
From the second article
Now, we need to know how large the blocks are for a particular cache block file. Mozilla browsers define the block size by left shifting the number 256 by the following number of bits subtract one from the cache block file number and then multiply the result by two. Therefore, when N=1 the block size is 256 bytes. When N=2, the block size is 512 bytes. When N=3, the block size is 1,024 bytes.
This had me stumped for a while. The statement, "left shifting the number 256 by the following number of bits subtract one from the cache block file number and then multiply the result by two" is correct, but the calculation was wrong. Here's the correct calculation
Block file 1 256 << (1 - 1) = 256
Block file 2 256 << ((2 - 1) * 2) = 1024
Block file 3 256 << ((3 - 1) * 2) = 4096
In addition to this, it's important to note that the "block count" field is also offset by one – if the block count is 0 then the data or metadata takes up 1 block, and if the block count is 3 then it takes up 4 blocks. This allows for a maximum of 16 kilobytes of data to be stored inside the cache block files themselves, although for some reason, I occasionally see smaller files stored outside of the block files.
Some information on the metadata structure
Metadata = (36 byte header) + (URL section) + (properties section)
36-byte header
First 24 bytes, not sure, but I don't seem to have a need for them yet.
Offset 24 UInt32, length of the data (needed when reading the data out of the block file as you can't tell how long it is based merely on the number of blocks.
Offset 28 UInt32, length of the URL section which follows.
Offset 32 UInt32, length of the properties section.
URL section
Seems to contain the name of the protocol (in most cases "HTTP") then a colon, and then the URL (so the whole thing says "HTTPhttp//…".) This section is null-terminated as well.
Properties section
Contains null-terminated ASCII strings. The strings are interleaved property keys and values, and the keys are named intuitively enough for most people to figure out what they mean.
That's all, folks. -)