tinyapps.org / blog

Breathing new life into a 2006 MacBook #

/mac | Sep 17, 2017

Menu bar firewall status indicator #

BitBar (open source) can be used to display an emoji of choice in the menubar depending on the built-in Application Firewall's state: off (0), on for specific services (1), or on for essential services (aka stealth mode) (2):

Firewall status in menubar via BitBar

  1. Install and launch BitBar
  2. Create a new directory (e.g., ~/bitbar/) to store plugins when prompted
  3. Save the following Bash script as ~/bitbar/firewall_status_indicator.10s.sh and make it executable (chmod +x firewall_status_indicator.10s.sh):
    state=$(defaults read "/Library/Preferences/com.apple.alf" globalstate);
    if [ "$state" -eq 2 ]; then
      echo "🔒"
    elif [ "$state" -eq 1 ]; then
      echo "❗️"
      echo "‼️"
    echo "---"
    echo "Open Firewall preference pane| href='x-apple.systempreferences:com.apple.preference.security?Firewall'"

GeekTool (free) can display a tiny red or green status LED on the desktop or in the menubar to indicate the firewall status:

Firewall status in menubar via GeekTool

TextBar ($2.99) can be used to display a shield icon and the firewall state (0, 1, or 2 as explained above) in the menu bar:

Firewall status in menubar via TextBar

  1. Install and launch TextBar
  2. Disable the default items
  3. Click the plus symbol to add a new item
  4. Replace echo 'Hello' with defaults read /Library/Preferences/com.apple.alf globalstate
  5. Check the far left box to enable and select the shield image

/mac | Sep 10, 2017

Particulars: BgInfo for OS X / macOS #

Sysinternals' BgInfo has been around for ages, displaying key system info on the Windows Desktop for convenience (especially handy for admins supporting remote users).

Glencode's Particulars offers similar functionality for Mac users, including a lab mode to help ease mass deployment.

/mac | Sep 10, 2017

Recovering saved macOS user passwords #

Users who have (inadvisedly) enabled automatic login often forget the password. It is merely encoded with an XOR cipher and stored in /etc/kcpassword.

A number of sites suggest this Ruby one-liner to recover it:

sudo ruby -e'key=[125,137,82,35,210,188,221,234,163,185,31];IO.read("/etc/kcpassword").bytes.each_with_index{|b,i|break if key.include?(b);print [b^key[i%key.size]].pack("U*")}'

However, only the first four characters were returned in my limited testing.

Joaquin Moreno Garijo's Python script, kcpass.py, did the trick:

  1. Copy /etc/kcpassword via target disk mode, single-user mode, etc.
  2. curl -O https://raw.githubusercontent.com/jjarava/mac-osx-forensics/master/kcpass.py
  3. chmod +x kcpass.py
  4. ./kcpass.py $(xxd -p /path/to/kcpassword)
        Kcpasswd: 0x09e03c5ab3ccad998dd66d1a89b165ae7e8912b851f8f0ff.
        Magic Xor: 0x7d895223d2bcddeaa3b91f.
        Used Magic Xor: 0x7d895223d2bcddeaa3b91f7d895223d2bcddeaa3b91f7d895223d2bcddeaa3b91f.
        The password is: "tinyapps.org".

See also:

/mac | Sep 07, 2017

OS X: Undelete iMessage messages #

/mac | Jul 17, 2017

Renaming files in OS X for Windows or Unix compatibility #


While the above approaches should cover most use case scenarios, none of them address all of the possible naming issues in Windows.


/mac | May 16, 2017

Apple Keyboard (A1243) - Function Keys Not Working #

The Apple Keyboard (A1243) was introduced in 2007 and rechristened Apple Keyboard with Numeric Keypad in 2009. Almost a decade later, it is still sold under the same name and model number.

However, there have been two different order numbers for this keyboard with separate system requirements:

The only cosmetic difference between the MB110LL/A and MB110LL/B is the icons on the F3 and F4 keys:

MB110LL/A F3 & F4 keys MB110LL/B F3 & F4 keys

/mac | Apr 29, 2017

OS X: Rich text editor with regex #

Bean has been under constant development for years; it's been listed on the OS X page since version 0.94 (current version is 3.2.9). In addition to supporting a host of file formats (rtf, rtfd, plain text, webarchive, doc, docx, and odt), Bean is the only rich text editor I have found for OS X which also supports regex find/replace.

/mac | Apr 27, 2017

Preparing a Mac for resale or donation (Sierra edition) #

  1. Deauthorize Mac in iTunes, turn off Find My Mac, sign out of iCloud, and sign out of iMessage.
  2. Securely erase internal storage, install macOS, create temporary admin account (e.g., tempuser), install apps and updates, etc.
  3. Log in normally as tempuser and run:
    $ sudo dscl . -delete /Groups/admin GroupMembership tempuser
    $ sudo dscl . -delete /Users/tempuser
  4. Restart in Single User Mode and run:
    # fsck -fy
    # mount -uw /
    # rm -R /Users/tempuser
    # rm /var/db/.AppleSetupDone
    # shutdown -h now


Regarding iLife and iWork apps

/mac | Feb 18, 2017

Reset Safari 10 in OS X 10.11 El Capitan #

Turn this:

Safari junk

into this:

Safari clean


# Reset Safari 10 for current user. Developed and tested under OS X 10.11.6 El Capitan.

# Backup bookmarks to Desktop, exiting if unsuccessful
cp -v ~/Library/Safari/Bookmarks.plist ~/Desktop/Bookmarks-`date +%Y%m%d%H%M%S`.plist
if [[ $? -ne 0 ]]; then exit 1; fi

# Delete main Safari data directory
rm -rfv ~/Library/Safari

# Delete caches
rm -rfv ~/Library/Caches/com.apple.Safari
rm -rfv ~/Library/Caches/com.apple.Safari.SearchHelper
rm -rfv ~/Library/Caches/com.apple.safaridavclient
rm -rfv ~/Library/Caches/com.apple.WebKit.PluginProcess
rm -rfv ~/Library/Caches/Metadata/Safari
rm -rfv ~/Library/Caches/SafariNotificationAgent
rm -rfv ~/Library/Caches/com.apple.commerce.safari/SafariLibrary

# Delete cookies
rm -rfv ~/Library/Cookies/Cookies.binarycookies
rm -rfv ~/Library/Cookies/com.apple.safari.cookies
rm -rfv ~/Library/Cookies/com.apple.CaptiveNetworkAssistant.binarycookies
rm -rfv ~/Library/Cookies/com.apple.Safari.SafeBrowsing.binarycookies
rm -rfv ~/Library/Cookies/com.apple.Safari.SearchHelper.binarycookies

# Delete preferences
rm -rfv ~/Library/Preferences/com.apple.Safari.LSSharedFileList.plist
rm -rfv ~/Library/Preferences/com.apple.Safari.RSS.plist
rm -rfv ~/Library/Preferences/com.apple.Safari.plist
rm -rfv ~/Library/Preferences/com.apple.Safari.Extensions.plist
rm -rfv ~/Library/Preferences/com.apple.WebFoundation.plist
rm -rfv ~/Library/Preferences/com.apple.WebKit.PluginHost.plist
rm -rfv ~/Library/Preferences/com.apple.WebKit.PluginProcess.plist
rm -rfv ~/Library/Preferences/com.apple.commerce.safari.plist

# Delete saved state
rm -rfv ~/Library/Saved\ Application\ State/com.apple.Safari.savedState

# Delete RSS feeds subscribed in Safari or Mail
# More info on PubSub database and command:
# http://krypted.com/mac-os-x/managing-mail-and-safari-rss-subscriptions-from-the-command-line/
rm -rfv ~/Library/PubSub/Database

# Delete yet more Safari data (cannot find any definitive documentation on this directory)
rm -rfv ~/Library/WebKit/com.apple.Safari

# Delete SharedFileList
rm -rfv ~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.apple.safari.sfl

# Delete LSOs / Flash cookies
rm -rfv ~/Library/Caches/Adobe/Flash\ Player

# Clear file quarantine database (i.e., list of downloaded files)
# More info: http://osxdaily.com/2012/07/12/list-download-history-mac-os-x/
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'delete from LSQuarantineEvent'

# Delete QuickTime cache
rm -rfv ~/Library/Caches/QuickTime

printf "\n\n\033[1;32mSafari cleanup complete.\n\n\033[1;31mThe contens of /Library/Internet Plug-Ins and ~/Library/Internet Plug-Ins\nwill appear below after pressing Enter. Check output for unwated plugins.\nPreserve Quartz Composer.webplugin & Default Browser.plugin at a minimum.\033[0m\n\n"

read -p "Press Enter to continue."

# List contents of /Library/Internet Plug-Ins and ~/Library/Internet Plug-Ins
ls -A /Library/Internet\ Plug-Ins ~/Library/Internet\ Plug-Ins


  1. Testing with fs_usage and File Buddy in a clean VM.
  2. completely reset Safari 9
  3. How to reset safari 9.0.3
  4. Reset Safari from command line
  5. Reset Safari doesn't really clean all the cookies of Safari web browser
  6. History in Safari
  7. Aborting a shell script if any command returns a non-zero value?
  8. In a bash script, how can I exit the entire script if a certain condition occurs?
  9. guapolo's answer to How to get osx shell script to show colors in echo

/mac | Feb 11, 2017

Subscribe or visit the archives