jessepeterson

/*.status.json

niw

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>IsCute</key>
      <true/>
      <key>IsDog</key>

pudquick

Sometimes you're trying to find the value of a constant - but you don't know what it is. And maybe it's in a framework. Maybe you've run ripgrep (rg) or the silversearcher (ag) and found hits on those framework binaries when looking for that variable name.

I've done lookups before via ctypes: https://gist.github.com/pudquick/8f65bb9b306f91eafdcc

And via pyobjc: https://gist.github.com/pudquick/ac8f22326f095ed2690e

And now I have another way that's somewhere inbetween:

pudquick

#!/usr/bin/python
# (Note that we must use system Python on a Mac.)

####
# Quick script to get the computer's serial number.
#
# Written for @john.e.lamb on the MacAdmins Slack team.

import objc
import CoreFoundation

erikng

#!/usr/bin/python

# For mojave only
# In order for this to work, you will need to go to System Preferences in Mojave -> Security & Privacy -> Privacy -> Full Disk Access and grant Terminal.app permissions

import sqlite3
conn = sqlite3.connect('/var/db/SystemPolicyConfiguration/KextPolicy')
c = conn.cursor()
query = 'SELECT * FROM kext_policy'
c.execute(query)

gregneagle

#!/usr/bin/python

import os
import sys

from CoreFoundation import (CFPreferencesAppValueIsForced,
                            CFPreferencesCopyAppValue,
                            CFPreferencesCopyValue,
                            kCFPreferencesAnyUser,
                            kCFPreferencesAnyHost,

timsutton

➜  ~ sw_vers
ProductName:	Mac OS X
ProductVersion:	10.12.1
BuildVersion:	16B2333a


➜  ~ ls -l /System/Library/Filesystems/apfs.fs/Contents/Resources
total 2088
-rwxr-xr-x  1 root  wheel  349760 22 Sep 03:48 apfs.util
-rwxr-xr-x  1 root  wheel  352880 22 Sep 03:48 apfs_invert

pudquick

# Tested on 10.11
# Assumes your network is in a state to actually do the discovery and that you have
# automatic timezone discovery enabled in Date & Time and Location services enabled
# (Generally this means wifi enabled on your device and network stack is up)

# For enabling location services and auto, check Allister's work here:
# https://gist.github.com/arubdesu/b72585771a9f606ad800

from Foundation import NSBundle
TZPP = NSBundle.bundleWithPath_("/System/Library/PreferencePanes/DateAndTime.prefPane/Contents/Resources/TimeZone.prefPane")

pudquick

# This code must run as root

# We're mixing ObjC and C-style dylibs, so this is really fun
# The only reason we're doing this is that the OS is _really really_ picky about trying to do
# ANYTHING with the CoreStorage Family Properties CFDictionary that's in-memory EXCEPT for
# making a mutable copy of it.

# Once we've done that, we can bring it into pyObjC to play nicely with the data.

import objc

pudquick

import objc
from Foundation import NSBundle

IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')

functions = [("IOServiceGetMatchingService", b"II@"),
             ("IOServiceMatching", b"@*"),
             ("IORegistryEntryCreateCFProperty", b"@I@@I"),
            ]