> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/ios-appsec/static-analysis/tools/plutil.md).

# plutil

`plutil` (Property List Utility) is the built-in macOS command-line tool for working with Apple Property List (plist) files. It can validate, convert between formats (binary ↔ XML ↔ JSON), pretty-print, and extract parts of plists.

#### What `plutil` does

* Validate plist syntax (`.plist` in binary or XML form.
* Convert between formats: binary, XML (`xml1`), JSON (`json1`).
* Print (pretty/human readable) plists to STDOUT.
* Extract a single key/subtree (in newer macOS versions).
* Useful for inspecting `Info.plist`, `embedded.mobileprovision` (after decoding), and other plist resources inside `.app` bundles.

***

### Common formats

* `binary1` — Apple's compact binary plist (common in shipped apps).
* `xml1` — human-readable XML plist.
* `json1` — JSON representation.

***

### Basic syntax (canonical)

```
plutil [options] file1 [file2 ...]
```

Important flags you will use:

* `-convert <format>` — convert file(s) to `xml1|json1|binary1` (can include `-o` for output).
* `-p` — print a property list in a readable format (useful for quick inspection).
* `-lint` — validate file(s) (checks syntax and reports errors).
* `-extract <key> <format>` — extract a subtree keyed by `<key>` and output in `<format>` (e.g. `xml1` or `json1`).
* `-o <path>` — used with `-convert` or `-extract` to set output file (or `-o -` for STDOUT).
* `-help` — show available options&#x20;

***

### Examples

Assume you are inside `Payload/MyApp.app/` or pointing at any `.plist` file.

* Convert binary plist to XML and print to terminal

```
plutil -convert xml1 Info.plist -o -
```

* Convert binary plist to JSON (writes back to file unless you use `-o`)

```
plutil -convert json1 Info.plist -o Info.json
```

* Validate (lint) one or more files

```
plutil -lint Info.plist
plutil -lint *.plist
```

* Pretty-print a plist (human-readable; good for quick browsing)

```
plutil -p Info.plist
```

* Extract a specific key/subtree (if supported)

```
plutil -extract CFBundleIdentifier xml1 -o - Info.plist
```

That prints the `CFBundleIdentifier` value as XML to STDOUT. You can extract nested keys using dot notation, e.g. `-extract NSAppTransportSecurity.NSAllowsArbitraryLoads xml1 -o - Info.plist` (behaviour depends on `plutil` version).

* Inspect `embedded.mobileprovision` after decoding

`embedded.mobileprovision` is a CMS file; to decode on macOS:

```bash
security cms -D -i embedded.mobileprovision > prov.plist
plutil -convert xml1 prov.plist -o -
```