Sometimes you need to see what’s inside of that pkg file. But you also don’t want to install it. You just want to take a look at the files in it before installing it. Well, here is how to do it:
PKG files usually come in a DMG image. First mount that file by double clicking on it. Then open a Terminal window and go to the folder where it’s mounted. (Look under /Volumes)
Once you are in that folder you will see a file with a .pkg extension. Let’s say it is called Foo.pkg. Copy that file in a folder, I’ll copy it to /tmp.
cp Foo.pkg /tmp
cd /tmp
Mac OS X has a utility called pkgutil. You can do a ton of stuff with it, so check the manual page. (man pkgutil) But for our exercise we will just use it to expand the pkg file.
pkgutil --expand Foo.pkg /tmp/foo_package
cd /tmp/foo_package
This will open the pkg file to a flat structure. You will see some files and folders like Distribution, Resources, Foo.pkg. Go ahead and cd in the directory Foo.pkg:
cd Foo.pkg
In there you will several files. The important ones are Bom, Payload and PackageInfo:
Bom:
This file is called Bill of Materials. It describes what is in this pkg file and where they will be written to. If you will not do file/binary analysis of the contents of the pkg file and you want only to see which files will be written where, this is your file. You can also use this file’s contents to remove the package completely. (I leave this exercise up to you)
Bom is a binary file and there is a tool to list its contents: lsbom. (man lsbom for usage) Basic usage would be:
lsbom Bom
This will print file/directory structure of the contents on the screen.
Payload:
This is the file that contains all the files and directories in this pkg file. It’s a gzipped archive file.
$ file Payload
Payload: gzip compressed data, from Unix
$ mv Payload foo.gz
$ gunzip foo.gz
$ ls
foo
This will give you a file called foo. Now you need to use cpio to extract that archive.
$ cpio -iv < foo
.
./System
./System/Library
./usr
./System/Library/LaunchAgents
./usr/bin
......files files files.......
50002 blocks
$ ls
System foo usr
In my case it unarchived two folders called System and usr.
No you can go and browse these directory to find files you are looking for. Have fun 😉
