Skip to content

Instantly share code, notes, and snippets.

@np5
np5 / apple_model_identifiers.py
Last active March 22, 2023 19:36
How to get the Apple computer identifiers
import argparse
import urllib.request
PAGES = (
("https://support.apple.com/en-us/HT201862", "MacBook Air", "LAPTOP"),
("https://support.apple.com/en-us/HT201300", "MacBook Pro", "LAPTOP"),
("https://support.apple.com/en-us/HT201894", "Mac mini", "DESKTOP"),
("https://support.apple.com/en-us/HT213073", "Mac Studio", "DESKTOP"),
("https://support.apple.com/en-us/HT201634", "iMac", "DESKTOP"),
@nikolay-n
nikolay-n / defsmon.py
Last active October 29, 2022 14:26
Defaults Monitor - tool to sniff defaults keys and values using unified log
#!/usr/bin/python2.7
# -*- coding: utf-8 -*-
'''
Defaults Monitor - tool to sniff defaults keys and values using unified log
to launch use standard python 2.7, eg python2.7 ./defsmon.py
'''
import os
@gregneagle
gregneagle / Makefile
Created March 5, 2020 18:35
Make your own PPPC/TCC avoidance wrapper!
CC=gcc
CFLAGS=
SIGNINGIDENTITY="insert signing identity here"
IDENTIFIER=com.someorg.fudo.changeme
fudo: main.c
$(CC) -o fudo main.c
codesign -s $(SIGNINGIDENTITY) -i $(IDENTIFIER) fudo
@pudquick
pudquick / fdsetup-for-crypt.mobileconfig
Created July 17, 2019 01:31
Enable fdesetup for Crypt
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Privacy Preferences Policy Control</string>
<key>PayloadIdentifier</key>
@haircut
haircut / tcc-reset.py
Last active April 5, 2024 11:27
Completely reset TCC services database in macOS
#!/usr/bin/python
"""
Completely reset TCC services database in macOS
Note: Both the system and individual users have TCC databases; run the script as both
a user and as root to completely reset TCC decisions at all levels.
2018-08-15: Resetting the 'Location' service fails; unknown cause
2018-08-16: Confirmed the 'All' service does not really reset _all_
services, so individual calls to each service is necessary.
@pudquick
pudquick / cms_detached_verify.py
Last active November 29, 2022 21:06
Verifying a CMS detached signature in pyobjc on macOS
import objc
from ctypes import create_string_buffer, c_void_p, cast
from Foundation import NSBundle
Security = NSBundle.bundleWithIdentifier_('com.apple.security')
# CMSDecoder.h
kCMSSignerUnsigned = 0
kCMSSignerValid = 1
kCMSSignerNeedsDetachedContent = 2
from AppKit import NSRunningApplication
print NSRunningApplication.runningApplicationsWithBundleIdentifier_("com.google.Chrome").count()
@MagerValp
MagerValp / Kernel Extension Policy.mobileconfig
Last active May 2, 2020 15:27
Sample kernel extension whitelist for 10.13.4+
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>AllowUserOverrides</key>
<true/>
<key>AllowedTeamIdentifiers</key>
### Updated to reflect changes introduced with 10.13.4. Update to 10.13.4 if needed before attempting to make
SecureToken-related changes. ###
sysadminctl is a tool Apple introduced in 10.10 for working with system user accounts. In 10.13, sysadminctl is Apple's
recommended tool for working with user accounts in the CLI, replacing functionality that has long been provided by dscl
and adds new features available only in 10.13. sysadminctl can be used to change user passwords, create new users or
check the status of a new-to-10.13 security feature named SecureToken.
SecureToken is a non-visible APFS file system attribute, unlike the SIP protected flag or file creation date, that triggers
the creation of a new AuthenticationAuthority entry in a user's local account record
@opragel
opragel / forcefully_remove_mdm_1015.sh
Last active August 2, 2022 19:39
forcefully_remove_mdm_1015.sh
#!/bin/bash
# Seriously there still apparently aren't enough warning labels
# If you don't understand the consequences don't do it
REMOVE_PATHS=( # "/var/db/ConfigurationProfiles/.passcodePolicesAreInstalled"
# "/var/db/ConfigurationProfiles/.cloudConfigHasActivationRecord"
# "/var/db/ConfigurationProfiles/.cloudConfigNoActivationRecord"
# "/var/db/ConfigurationProfiles/.cloudConfigProfileObtained"
# "/var/db/ConfigurationProfiles/.cloudConfigRecordFound"
# "/var/db/ConfigurationProfiles/.profilesAreInstalled"