Skip to content

Instantly share code, notes, and snippets.

gregneagle /
Created February 23, 2023 23:13
Using Apple's quarantine API from PyObjC
'''Demo only. Needs more robust error checking and handling'''
import os
from Foundation import NSURL, NSURLQuarantinePropertiesKey
def getQuarantineAttribute(pathname):
'''Returns a dict contaning quarantine info for pathname or None'''
$ ./ --python-version 3.8.5
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 28.8M 100 28.8M 0 0 6860k 0 0:00:04 0:00:04 --:--:-- 6860k
Expanding /var/folders/tc/sd4_mtvj14jdy7cg21m2gmcw000495/T/tmpdhiqv6m3...
Extracting /var/folders/tc/sd4_mtvj14jdy7cg21m2gmcw000495/T/tmpdhiqv6m3__expanded__/Python_Framework.pkg/Payload to ./Python.framework...
Ensuring correct modes for files in /Users/Shared/relocatable-python/Python.framework...
Analyzing /Users/Shared/relocatable-python/Python.framework...
gregneagle /
Created March 9, 2020 18:57
Guess what this can be used for? (Hint: read the comments)
# This script is designed to be run as root, perhaps by a management tool
# It takes one argument, a path to an app to be launched (or a name of an app,
# if you don't mind LaunchServices deciding which if any app to launch)
# If the current console user is not a member of the admin group, the user will
# be added to to the group. The app will then be launched in the console user's
# context.
# When the app exits (or this script is killed via SIGINT), if we had promoted
gregneagle / Makefile
Created March 5, 2020 18:35
Make your own PPPC/TCC avoidance wrapper!
SIGNINGIDENTITY="insert signing identity here"
fudo: main.c
$(CC) -o fudo main.c
codesign -s $(SIGNINGIDENTITY) -i $(IDENTIFIER) fudo
gregneagle / startosinstall_10.12.6_normalboot.txt
Last active February 6, 2024 07:28
Comparison of startosinstall's available options depending on boot OS environment
bash-3.2$ /Applications/Install\ macOS\ --usage
Usage: startosinstall --applicationpath <install path>
--applicationpath, a path to copy of the OS installer application to start the install with.
--license, prints the user license agreement only.
--agreetolicense, agree to license the license you printed with --license.
--rebootdelay, how long to delay the reboot at the end of preparing. This delay is in seconds and has a maximum of 300 (5 minutes).
--pidtosignal, Specify a PID to which to send SIGUSR1 upon completion of the prepare phase. To bypass "rebootdelay" send SIGUSR1 back to startosinstall.
--usage, prints this message.
gregneagle /
Created August 1, 2017 18:20
Getting notified when a preference changes (using PyObjC)
from Foundation import NSObject, NSUserDefaults, NSKeyValueObservingOptionNew
from Foundation import NSRunLoop, NSDate
class PrefsObserver(NSObject):
def observe(self, domain, key):
self.domain = domain
self.key = key
if self:
self.defaults = NSUserDefaults.alloc().initWithSuiteName_(
gregneagle /
Last active February 6, 2024 15:14 Reads a preference, prints its value, type, and where it is defined.
import os
import sys
from CoreFoundation import (CFPreferencesAppValueIsForced,
import os
import pwd
from Foundation import CFPreferencesAppSynchronize
from Foundation import CFPreferencesSetValue
from Foundation import kCFPreferencesCurrentUser
from Foundation import kCFPreferencesCurrentHost
gregneagle /
Last active April 16, 2021 12:09
Based on sysctl function by Michael Lynn aka frogor aka pudquick aka ????
# Based on sysctl function by Michael Lynn
from ctypes import CDLL, c_uint, byref, create_string_buffer
from ctypes import cast, POINTER, c_int32, c_int64
from ctypes.util import find_library
import struct
libc = CDLL(find_library('c'))
import time
from Quartz import CGGetActiveDisplayList, CGGetOnlineDisplayList
from CoreFoundation import CFPreferencesCopyAppValue
def displayMirroringActive():
'''Returns True if any two displays are mirroring, False otherwise'''