I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but you can upload them using the desktop application to the application's cloud server and from there download them to your iOS device for offline viewing. My findings so far:
- The header of the files is
58 54 5A 00, which isn't listed in any file signatures table I have searched in
- The usual suspects, commands
binwalk, do not identify the format
- The entropy histogram is flat
- Each time I download the same file from the server to the iOS device, a file of the exact same size but with different content (apart from the header 58 54 5A 00`) gets saved.
- Altering hex values
- last two bytes: file is read normally by the iOS app
- third byte from the end: app becomes unresponsive when opening the folder the file is in. Since each file is shown as a thumbnail of the musical score I suspect this byte has something to do with the thumbnail.
- Any other random byte: thumbnail is shown correctly, app doesn't crash, but a blank page appears when the file is opened
The following files are actually all the same file downloaded from the server 4 times.