Peter A. ink-splatters

macOS Internals

Understand your Mac and iPhone more deeply by tracing the evolution of Mac OS X from prelease to Swift. John Siracusa delivers the details.

Starting Points

How to use this gist

You've got two main options:

Create Root CA (Done once)

Create Root Key

Attention: this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

openssl genrsa -des3 -out rootCA.key 4096

Linux Desktop on Apple Silicon in Practice

I bought M1 MacBook Air. It is the fastest computer I have, and I have been a GNOME/GNU/Linux user for long time. It is obvious conclusion that I need practical Linux desktop environment on Apple Silicon.

Fortunately, Linux already works on Apple Silicon/M1. But how practical is it?

Two native ports exist.

to ask for help with python and/or executing this script, join discord: https://discord.gg/zpu7YUP3Um

Restore deleted Telegram messages, medias and files from groups

There's not telegram API method for this, we need to call MTProto methods to retrieve messages from the "Recent Actions" (Admin Log) since deleted messages (and medias) gets moved there for 48 hours before the permanent deletion.

from telethon import TelegramClient, events, sync
from telethon.tl.types import InputChannel, PeerChannel

	#!/usr/bin/env bash

	set -e
	set -o pipefail

	disk=$(echo "$1" \| sed -E 's/^\/dev\///g')
	if [[ $# != 1 \|\| ! "$disk" =~ disk[0-9]$ ]]; then
	cat <<EOF
	usage: $0 <APFS container node>
	EOF

	#! /bin/bash
	# Simple Utility Script for allowing debug of hardened macOS apps.
	# This is useful mostly for plug-in developer that would like keep developing without turning SIP off.
	# Credit for idea goes to (McMartin): https://forum.juce.com/t/apple-gatekeeper-notarised-distributables/29952/57?u=ttg
	# Update 2022-03-10: Based on Fabian's feedback, add capability to inject DYLD for sanitizers.
	#
	# Please note:
	# - Modern Logic (on M1s) uses `AUHostingService` which resides within the system thus not patchable and REQUIRES to turn-off SIP.
	# - Some hosts uses separate plug-in scanning or sandboxing.
	# if that's the case, it's required to patch those (if needed) and attach debugger to them instead.

	airstation:llama.cpp ic$ git rev-parse HEAD
	952d03dbead16e4dbdd1d3458486340673cc2465
	airstation:llama.cpp ic$ echo ; awk '(NR>=4341 && NR<=4382 ){print NR " " $0}' llama.cpp

	4341 // for now, only BPE models have pre-tokenizers
	4342 if (vocab.type == LLAMA_VOCAB_TYPE_BPE) {
	4343 if (tokenizer_pre.empty()) {
	4344 LLAMA_LOG_WARN("%s: missing pre-tokenizer type, using: 'default'\n", __func__);
	4345 LLAMA_LOG_WARN("%s: \n", __func__);
	4346 LLAMA_LOG_WARN("%s: ************************************ \n", __func__);


	// courtesy of clang
	// https://github.com/applesrc/clang/blob/bb8f644/src/projects/compiler-rt/lib/sanitizer_common/sanitizer_mac_spi.cc

	enum sandbox_filter_type {
	SANDBOX_FILTER_NONE,
	SANDBOX_FILTER_PATH,
	SANDBOX_FILTER_GLOBAL_NAME,
	SANDBOX_FILTER_LOCAL_NAME,
	SANDBOX_FILTER_APPLEEVENT_DESTINATION,

	//
	// airtag-decryptor.swift
	//
	// Decrypt all beacons files from ~/Library/com.apple.icloud.searchpartyd - updated when FindMy is running
	// Results in /tmp/com.apple.icloud.searchpartyd - same file hierarchy
	//
	// Created by Matus on 28/01/2024. - https://gist.github.com/YeapGuy/f473de53c2a4e8978bc63217359ca1e4
	// Modified by Airy
	//
	import Cocoa

	09:02:52: main: MSUEarlyBootTask running..Found data created by previous ramdisk. Assuming first boot after update at time Tue Sep 21 09:02:52 2021

	09:02:52: MSUEarlyBootTask: Successfully set up ACL for folder stashed by ramdisk
	09:02:52: MSUEarlyBootTasks: Cleaning up stale stashed paths
	09:02:52: main: Running fixup var operations
	09:02:52: entering update_var_directory_hierarchy
	09:02:52: Created system mount point at /private/var/MobileSoftwareUpdate/mnt1
	09:02:52: System is currently rooted from a snapshot
	09:02:52: msuearlyboottask_mount_filesystem: Attempting to mount /dev/disk0s1s1 at /private/var/MobileSoftwareUpdate/mnt1
	09:02:52: Reverting to snapshot(com.apple.os.update-9C000777B424EEABA97D3C90BB8E3C6CBD865FF00968F6063E6BFE32DBD630B9891FF8EB307DBFCE4CDD05EF92EE0C7D)