Every modern iOS, macOS, watchOS, and tvOS application uses Asset Catalogs to manage images, colors, icons, and other resources. When you build an app with Xcode, your .xcassets folders are compiled into binary .car files that ship with your application. Despite being a fundamental part of every Apple app, there is little to none official documentation about this file format.
In this post, I’ll walk through the process of reverse engineering the .car file format, explain its internal structures, and show how to parse these files programmatically. This knowledge could be useful for security research and building developer tools that does not rely on Xcode or Apple’s proprietary tools.
As part of this research, I’ve built a custom parser and compiler for .car files that doesn’t depend on any of Apple’s private frameworks or proprietary tools. To make this research practical, I’ve compiled my parser to WebAssembly so it runs entirely in your browser, so no server uploads required. You can drop any .car file into the interactive demo below to explore its content. I’m considering open-sourcing these tools, but no promises yet!
What is a .car File?
When you call UIImage(named: "MyImage") in Swift (or [UIImage imageNamed:@"MyImage"] in Objective-C), the private CoreUI.framework opens your app’s Assets.car file and retrieves the appropriate image for the current device context (screen scale, appearance mode, size class, etc)
The “CAR” extension likely stands for “Compiled Asset Record” based on method names found in Xcode’s IBFoundation framework. You can inspect car files using Apple’s closed-source tools:
actool : Compiles asset catalogs (usually invoked by Xcode)
: Compiles asset catalogs (usually invoked by Xcode) assetutil: Processes and inspects car files
Running assetutil -I Assets.car produces a JSON dump of all assets:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 [ { "Appearances" : { "UIAppearanceAny" : 0 }, "AssetStorageVersion" : "Xcode 12.5 (12E262) via IBCocoaTouchImageCatalogTool" , "Authoring Tool" : "@(#)PROGRAM:CoreThemeDefinition PROJECT:CoreThemeDefinition-491
... continue reading