What are TTComp archive data files and how can i decrypt them? I am searching for the iOS system-roots keychain. I found a file (certsTable.data) in /System/Library/Frameworks/Security.framework/, it could be, but i can't open it because if i unextract it with ttdecomp i get a data file which contains only apparently random data, in the unextracted state strings find some human readable stings like ")Starfield Class 2 Certification Authority" in the same folder there was a certsIndex.data file
Take a look at OTATrustUtilities, which is Apple's implementation of extracting data from the system keychain. Specifically the InitializeAnchorTable function looks at extracting the data from those two files. The certsIndex.data file is a Database Index file that contains an array which can be read using NSData, this contains a list of sha1 hashes and offsets. These offsets correspond to the start of the certificate data found in the certsTable.data file, so you can start reading from the offset to the end of the certificate. It is worth noting that an application which accesses these private files will not be accepted onto the AppStore and this should only really be used for personal use or jailbreak development.