pudquick

# https://developer.apple.com/documentation/corefoundation/3684868-cfbundleisarchitectureloadable?language=objc
# https://developer.apple.com/documentation/foundation/1495005-mach-o_architecture?language=occ
# https://developer.apple.com/documentation/foundation/1495005-mach-o_architecture/nsbundleexecutablearchitecturearm64?language=occ

from Foundation import NSBundle
import objc
CF = NSBundle.bundleWithPath_('/System/Library/Frameworks/CoreFoundation.framework')
f = [('CFBundleIsArchitectureLoadable', 'BQ')]
objc.loadBundleFunctions(CF, globals(), f)
NSBundleExecutableArchitectureARM64 = 0x0100000c

pudquick

import objc
from Foundation import NSBundle

IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [
             ("IORegistryEntryCreateCFProperties", b"IIo^@II"),
             ("IOServiceMatching", b"@*"),
             ("IOServiceGetMatchingServices", b"II@o^I"),
             ("IOIteratorNext", b"II"),
            ]

pudquick

#!/bin/bash
export JAVA_HOME="/Library/Java/JavaVirtualMachines/adoptopenjdk-8.jdk/Contents/Home"
export PATH="$JAVA_HOME/bin:$PATH"
cd "$( dirname "$0" )"
java -Xmx1024M -jar Geyser.jar

pudquick

<key>NSAppleScriptEnabled</key>
<true/>
<key>OSAScriptingDefinition</key>
<string>ScriptableTasks.sdef</string>

pudquick

Sometimes you're trying to find the value of a constant - but you don't know what it is. And maybe it's in a framework. Maybe you've run ripgrep (rg) or the silversearcher (ag) and found hits on those framework binaries when looking for that variable name.

I've done lookups before via ctypes: https://gist.github.com/pudquick/8f65bb9b306f91eafdcc

And via pyobjc: https://gist.github.com/pudquick/ac8f22326f095ed2690e

And now I have another way that's somewhere inbetween:

pudquick

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Privacy Preferences Policy Control</string>
			<key>PayloadIdentifier</key>

pudquick

Keybase proof

I hereby claim:

• I am pudquick on github.
• I am frogor (https://keybase.io/frogor) on keybase.
• I have a public key ASBTy_VUW9m2orm3VyY994_c5qlvSMMatsoKxQk0l6LhyAo

To claim this, I am signing this object:

pudquick

import objc
from Foundation import NSBundle, NSURL
Security = NSBundle.bundleWithIdentifier_('com.apple.security')

class StaticCodeError(Exception):
    pass

class SigningInfoError(Exception):
    pass

pudquick

#!/usr/bin/python

# So the first thing we need to do is get the mdmclient view of the profiles
import subprocess, objc
from Foundation import NSPropertyListSerialization, NSPropertyListMutableContainers, NSBundle
Security = NSBundle.bundleWithIdentifier_('com.apple.security')

S_functions = [
               ('SecCertificateCreateWithData', '@@@'),
               ('SecCertificateCopyValues', '@@^@o^@'),

pudquick

require 'base64'
require 'plist'

module Chef::Provider::User::DsclMojaveUserExtensions
  # new for 10.14+
  def mac_osx_version_greater_than_10_13?
    Gem::Version.new(node['platform_version']) > Gem::Version.new('10.13.99')
  end

  # updated for 10.14+