What is a .PKG file?
The .pkg extension covers macOS installer packages and Bungie Destiny game packages.
macOS Installer Package
- What it is
- Apple's flat installer package - a XAR archive. Analyser lists the payload members, the checksum algorithm and the bundle version.
- How to tell it apart
- A macOS installer begins with the ASCII magic xar!.
- Did you know
- Apple's flat .pkg is really a XAR archive with an XML table of contents, which let an entire installer become one signable, downloadable file.
- The flat single-file .pkg arrived with Mac OS X 10.5 Leopard in 2007, replacing the older folder-style bundle packages.
- A .pkg can run pre- and post-install scripts as root, which is exactly why an unsigned installer package is a classic macOS malware vector.
Destiny package (Bungie Tiger engine)
- What it is
- A Bungie Tiger-engine asset package from Destiny and Destiny 2 - audio, models, textures and strings in a proprietary entry/block table. Analyser reads the package id, header version, build date and platform from the header.
- How to tell it apart
- A Tiger package starts with the bytes 35 00 02 00 and carries its package id at offset 0x10 (the hex id in the filename).
- Did you know
- Destiny 2 ships its assets in hundreds of these Tiger-engine packages; the four hex digits in each filename (like 02b8) are the package id stored at offset 0x10 inside.
- Because Bungie ships no official mod tools, fans reverse-engineered the Tiger .pkg format to pull out Destiny's models, textures and music, producing extractors like DestinyUnpacker.
- Each package header carries a build date, so the .pkg files can be traced back to the exact game patch that shipped them.
- Depth of analysis
- .PKG is an identification-grade format: Analyser recognises it from its bytes and decodes the header metadata it carries, rather than opening it in a full viewer. Formats that do get a full viewer are marked "Full" on the formats page.
- Open a .PKG file
- Drag a .PKG file onto the Analyser home page (or tap to pick one). It is identified entirely in your browser - nothing is uploaded, there is no account, and it works offline once installed.