Skip to content

Instantly share code, notes, and snippets.

@pudquick
pudquick / sip_config.py
Created December 22, 2016 22:31
Querying active SIP status directly from the kernel, bypassing nvram and csrutil, via python on macOS
# An overly complicated SIP config checker
# This is a technically interesting implementation because it does not rely on csrutil
# Instead it queries the kernel directly for the current configuration status
# This means, for example, in environments where SIP has been disabled and csrutil has
# been removed or modified (say, with DYLD_LIBRARY_PATH), as long as python can run you
# can still check status
# Additionally, checking the nvram csr-active-config setting isn't accurate now with
# 10.12.2+, since running "sudo csrutil clear" deletes the variable until reboot,
@pudquick
pudquick / nvram.py
Created November 3, 2016 16:29
Get nvram values via python and pyobjc on macOS
import objc
from Foundation import NSBundle
IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [
("IORegistryEntryFromPath", b"II*"),
("IORegistryEntryCreateCFProperty", b"@I@@I"),
]
@homebysix
homebysix / https_spotter.py
Last active June 16, 2024 02:22
HTTPS Spotter
#!/usr/local/autopkg/python
# encoding: utf-8
# HTTPS Spotter
# Copyright 2016-2024 Elliot Jordan
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
@pudquick
pudquick / remove_bt.py
Created October 7, 2016 19:53
Remove all Bluetooth devices from OS X / macOS in the style of the Bluetooth debug menu "Remove all devices" with python and pyobjc
#!/usr/bin/python
from Foundation import NSBundle
IOBluetooth = NSBundle.bundleWithIdentifier_('com.apple.Bluetooth')
IOBluetoothDevice = IOBluetooth.classNamed_('IOBluetoothDevice')
# remove configured devices
try:
devices = list(IOBluetoothDevice.configuredDevices())
except:
'''Routines for manipulating the Dock'''
import os
import subprocess
from Foundation import NSURL
from Foundation import CFPreferencesAppSynchronize
from Foundation import CFPreferencesCopyAppValue
from Foundation import CFPreferencesSetAppValue
@pudquick
pudquick / pyobjc_ctypes_bridging.py
Created September 10, 2016 19:19
An example of conversion of ctypes pointers to pyobjc objects that's compatible with pyobjc versions earlier than 2.5
# Using: https://developer.apple.com/library/mac/documentation/Cocoa/Reference/ObjCRuntimeRef
# Thank you to this for inspiration: https://github.com/MacLeek/trackmac/blob/master/trackmac/cocoa.py
import objc
from ctypes import CDLL, c_void_p, byref, c_char_p
from ctypes.util import find_library
from Foundation import NSMutableArray
Security = CDLL(find_library("Security"))
AuthorizationRightGet = Security.AuthorizationRightGet
@pudquick
pudquick / autotimezone.py
Last active February 11, 2020 15:55
Forcing automatic timezone discovery with pyobjc on OS X
# Tested on 10.11
# Assumes your network is in a state to actually do the discovery and that you have
# automatic timezone discovery enabled in Date & Time and Location services enabled
# (Generally this means wifi enabled on your device and network stack is up)
# For enabling location services and auto, check Allister's work here:
# https://gist.github.com/arubdesu/b72585771a9f606ad800
from Foundation import NSBundle
TZPP = NSBundle.bundleWithPath_("/System/Library/PreferencePanes/DateAndTime.prefPane/Contents/Resources/TimeZone.prefPane")
@pudquick
pudquick / receipts.py
Created August 18, 2016 17:14
Programmatically access package receipt information using the OS X PrivateFramework PackageKit (same one pkgutil uses) with python and pyobjc
import objc
packagekit_bundle = objc.loadBundle('PackageKit', module_globals=globals(), bundle_path='/System/Library/PrivateFrameworks/PackageKit.framework', scan_classes=False)
PKReceipt = objc.lookUpClass('PKReceipt')
receipts = PKReceipt.receiptsOnVolumeAtPath_('/')
first_receipt = receipts[0]
# Things you can look up:
# installPrefixPath
@pudquick
pudquick / macvm_detect.py
Created August 4, 2016 21:44
Programmatically determine if an OS X device is a VM in python by available CPU features
from ctypes import CDLL, c_uint, byref, create_string_buffer
libc = CDLL('/usr/lib/libc.dylib')
def sysctl(name):
size = c_uint(0)
libc.sysctlbyname(name, None, byref(size), None, 0)
buf = create_string_buffer(size.value)
libc.sysctlbyname(name, buf, byref(size), None, 0)
return buf.value
@pudquick
pudquick / diskman.py
Last active December 14, 2022 17:03
Light pyobjc wrapper around the PrivateFramework DiskManagement.framework for direct access to disk devices and information about them
import objc
from Foundation import NSBundle
# Predefine some opaque types
DASessionRef = objc.createOpaquePointerType('DASessionRef', b'^{__DASession=}', None)
DADiskRef = objc.createOpaquePointerType('DADiskRef', b'^{__DADisk=}', None)
# Load DiskManagement framework classes
DiskManagment = objc.loadBundle('DiskManagment', globals(), bundle_path='/System/Library/PrivateFrameworks/DiskManagement.framework')