Anand Pandit's Blog

As per my old post ( http://anandmpandit.blogspot.in/2016/11/how-to-extract-signing-certificates.html ) , we can extract the binary signing certificates on mac using codesign tool. If you needed to get fingerprint details of the certificate in MD5, SHA1 or SHA256 format then you have run below steps on the extracted certificate file on macOS. SHA256: SHA256 Fingerprint=D3:0A:32:6C:77:77:93:B5:45:20:AC:C0:D4:7E:3A:84:34:50:96:54:08:7F:7D:63:4C:3E:06:3B:E8:1F:C1:90 SHA1: SHA1 Fingerprint=BF:2C:93:1F:BD:88:E5:4C:96:D8:86:D5:F1:E6:9B:B7:DE:76:51:62 MD5: MD5 Fingerprint=3C:A3:3B:76:6D:AE:3F:4B:4E:B2:AA:66:97:55:B8:76

macOS SIP supports a set of hidden options to disable few sections of SIP by passing hidden options to csrutil tool.   Each of these can be selectively disabled by running one of the following commands while booted into Recovery mode: csrutil enable --no-internal csrutil enable --without kext csrutil  enable  --without fs csrutil  enable  --without debug csrutil  enable  --without dtrace csrutil  enable  --without nvram You can disable two or more components by structuring the command as follows: csrutil enable --without kext  --without debug How to disable /enable to SIP , refer to  http://anandmpandit.blogspot.in/2015/11/how-to-disable-system-integrity.html .  Note : These options are tested on macOS ElCapitan , on higher version of macOS some or all of them may not work.

A usual problem on mac where the even after upgrading or installing the latest version of Java, when queried in command line for java version it still refers to the old version of java. something like below : $ java -version java version "1.7.0_79" Java(TM) SE Runtime Environment (build 1.7.0_79-b15) Java HotSpot(TM) 64-Bit Server VM (build 24.79-b02, mixed mode) This is because the /usr/bin/java is pointing to   /System/Library/Frameworks/JavaVM.framework/Versions/Current/Commands/java on the system.    $ ls -la `which java` /usr/bin/java -> /System/Library/Frameworks/JavaVM.framework/Versions/Current/Commands/java This is because  Oracle's installer puts java inside the   /Library/Internet Plug-Ins/JavaAppletPlugin.plugin . And it doesn't overwrite  /usr/bin/java. So to fix this we have remove the existing soft link to old java and point it to new java binary. which can be done by performing following steps. ...

           Easy Install is a python module ( easy_install ) bundled with  setuptools  that lets you automatically download, build, install, and manage Python packages. Sometimes due wrong installations easy_install might get corrupted and fail to install any package afterwords. You might see errors like below when you try to install any modules Traceback (most recent call last):   File "/usr/local/bin/easy_install", line 7, in     from setuptools.command.easy_install import main   File "/Library/Python/2.7/site-packages/setuptools/__init__.py", line 12, in     import setuptools.version   File "/Library/Python/2.7/site-packages/setuptools/version.py", line 1, in     import pkg_resources   File "/Library/Python/2.7/site-packages/pkg_resources/__init__.py", line 72, in     import packaging.requirements   File "/Library/Python/2.7/site-packages/packaging/requireme...

It is very annoying to see  the message  "This copy of the Install OS X Mavericks application can't be verified. It may have been corrupted or tampered with during downloading."   when you try to install old releases of Apple OS X operating systems such as Mountain Lion, Mavericks, Yosemite etc. If you are trying to install OS X Mavericks as virtual machine in VMWare fusion or in physical system, then follow below steps to successfully install the operating system. In VMWARE Fusion. Create a OSX Mavericks VM by attaching OSX Mavericks Installer to the virtual machine. Do not Poweron the virtual machine. If powered on automatically after 1st step above then poweroff the VM. Open Virtual Machine Settings, Goto Advanced Section. Un check "Synchronize Time" setting. Start the Virtual Machine to install the OSX Mavericks. In the OSX Installer app , Launch Terminal.app. Set the system date to old date as  date 102613152013 ( Oct/26/2013 13:15). Quit...

When you run kextstat command to see the list of kernel extensions loaded in the system, you might come across kext named com.apple.Dont_Steal_Mac_OS_X (7.0.0) being loaded all the time. You might me wondering what is the role of this kernel extension.  com.apple.Dont_Steal_Mac_OS_X  prevents OS X from being used on non approved Intel hardware – as OS X is licensed only for use of approved Apple Intel hardware. This kext is used to control software piracy of OSX on non Apple supported hardwares. Hence its role is to detect and fail the OSX installation on non apple certified hardwares. 

Python from 2.7.9 and above now verifies the SSL certificate prior establishing the connection to server. This might cause problem in few servers which do not support certificate validation yet. In these circumstances the HTTPS connection requests fails due to new changes in python. For more information on the new changes please read more at :  https://www.python.org/dev/peps/pep-0476/ . This link describes the ways to establish ssl connection without certificate verification. In my case i was not using the httplib modules API directly hence i had to find out a crude approach to disable the SSL certificate  verification. I would not recommend the below change unless it is really required to do it as you might be opening a set of vulnerabilities as specified in this article .  However the below sample code tells you how disable SSL certificate  verification completely on your system.  1. Open Terminal 2. Open with sudo privileges the following file [...

We might wonder how to disable the USB ports on Mac to prevent data copy to external USB mass storage devices. The USB kext on os x is loaded at the time of start of the system, this can be loaded / unloaded using kextload or kextunload command. To disable USB port on Mac , follow below steps: On Macs running  Mountain Lion, Mavericks  and Yosemite : Unmount any connected USB devices to the system by running below command                  $ diskutil unmount /Volumes/USBDISK. Now unload the USB related kernel extensions in the following order using kextunload command.             sudo kextunload -b com.apple.driver.AppleUSBCardReader             sudo kextunload -b com.apple.driver.AppleUSBODD             sudo kextunload -b com.apple.iokit.IOUSBMassStorageClass        This wil...

There might be a time where you want decrypt the FileVault encrypted mac, but you are facing issues in logging into Mac to perform decryption using system preferences. In such cases the following steps will help you in decrypting the disk using Recovery HD. Reboot the Mac, Go to recovery HD partition of the system. ( To start your computer from Recovery, restart your Mac and hold down the Command and R keys at startup.) Open Terminal application from Utilities -> Application.  First will need to identify the Logical Volume UUID of the encrypted drive using the  diskutil corestorage list  command:           diskutil corestorage list         4.   Once you have the UUID of the logical volume as shown in above picture, you can then either             unlock or decrypt the encrypted volume using the following commands.       a) Using ...

plutil - is a very useful tool to decode and encode the plist files on OSX system. The tool can be used decode the plist file to human readable format in Terminal which would help user to edit the plist files in terminal using vim or nano etc. plutil -convert xml1 [path_to_the_plist_file] The above command will decode the plist file to a readable xml format in command line. plutil -convert binary1 [path_to_the_plist_file] The above command can be used encode back the file to original binary format from command line.

To change the user password in Leopard(10.5.x) or SnowLeopard (10.6.x) Hold "Command + S" key on your mac keyboard to boot your mac into single user mode. Execute command "mount -uw /" in shell. Run below command " launchctl load /System/Library/LaunchDaemons/com.apple.DirectoryServices.plist" Execute command :  passwd change the password of root.