Slashdot Mirror


Brief Tutorial on Reverse Engineering Mac OS X

rjw57 writes "There is an article on OSNews I wrote about how the guy behind Desktop Manager goes about reverse engineering APIs from Mac OS X with a brand new example not revealed anywhere else. From the article: 'I am often asked in email how I uncovered the API calls I use in Desktop Manager which are, unfortunately, undocumented. This article aims to give a little insight into the techniques I use to reverse engineer Mac OS X in order to provide extra functionality to users and extra information to third-party developers. In this article all the utilities I use are a standard part of Mac OS X's developer tools which are freely available.'"

14 of 121 comments (clear)

  1. Re:Versus Expose? by avalys · · Score: 5, Interesting

    If you're working with a lot of windows/applications, virtual desktops can act as a nice complement to Expose.

    I'm surprised Apple hasn't made it a built-in feature. They have fast user switching, but that's not the same thing.

    --
    This space intentionally left blank.
  2. Re:Huh? by the+pickle · · Score: 4, Interesting

    Or, more likely, Apple hasn't seen fit to document the calls yet. Not to excuse their laziness, but it seems like Apple gets around to documenting things much less quickly than they used to. Frankly, I suspect that even after nearly five years of OS X, they're still playing a bit of catch-up with the documentation.

    p

  3. truss for MacOS X? by mzs · · Score: 3, Interesting

    On Solaris there is a command truss that is the king of all truss-like commands. Unlike strace, ktrace, and BSD truss this tool can print a trace of all function calls made by an application as it runs (among many other useful things). Does anyone here know of an analogous tool for MacOS X? If not I wonder if an awk/perl script munging the output of nm to generate tracepoints for gdb where each trace point creates a new tracepoint at the instruction where the function call returns, prints out the funtion name and the contents of r2-r10 or so, then continues on or something like this would be something someone has already written.

  4. Re:Huh? by Trillan · · Score: 4, Interesting

    Apple has two methods for putting items in the menu bar: The "right" way to do things, and the way that looks good to users.

    The wrong way to do things -- and the way Apple uses for their menulets -- reserved involves injecting code into SystemUIServer's running space. If one menulet crashes, all menulets crash under this model. It is not surprising they want to discourage this mechanism for end-developer use.

    Personally, I expect that sooner or later Apple will port the features of the "wrong" way to the right way, then upgrade thier menulets to use the documented API instead of the undocumented one. However, I expect there are much higher priorities.

  5. Re:Which way today apple? by mpaque · · Score: 2, Interesting

    Actually, these are undocumented SPIs, Systems Programming Interfaces. SPIs exist in many layered systems, and are intended to provide functionality used to implement higher level mechanisms.

    In Mac OS X, for example, the CGS SPIs provide functionality used by the Carbon, Cocoa, and Java environments. (You didn't really think Carbon and Cocoa somehow each implemented their own window systems, did you?) The SPIs are private because, simply, the functionality they provide is pretty raw, low level stuff. Using the private SPIs behind the back of an application could readily lead ti inconsistent state in an application, leading to exciting events such as the Spontaneous Program Logic Application Termination (SPLAT).

    "Documentation' for some of these really low level SPIs may consist of sophisticated mechanisms along the lines of "Hey! Andrew! How's this supposed to work?" (Yes, everything should be documented, and preferably folded into a CASE system that won't let you compile anything until the documentation is written. After all, that's how the LINUX kernel is managed, right?)

  6. Re:Versus Expose? by steeviant · · Score: 2, Interesting

    The only reason I can think of for using virtual desktops is if you're some kind of Linux zealot.

    I've been trying to take this line of thinking to it's logical conclusion, but I can't figure it out...

    I always ignore the multiple desktop features and disable the pager in X11 window managers, does that make me a Mac zealot or a Windows zealot?

    Conversely, I know people who religiously use multiple desktops in Windows who won't touch Linux with a 10 ft pole. Are they still a Linux zealot?

    I'm so confused.

  7. I'm happy without virtual desktops... by sootman · · Score: 2, Interesting

    ...what I really want is to be able to hit (for example) control-alt-F1 and get a full-screen command line. Every so often I've got a lot of crap open and I just want nothing but a big, empty, command window.

    --
    Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
  8. Re:It depends on how you work by civilizedINTENSITY · · Score: 3, Interesting

    I like to dedicate a virtual desktop to each class I'm taking. That way when I want to work I just move to the desktop for that class, and everything I'm working on is open there. I save often, but never actually close a document until its turned in. I use yet another desktop for email, surfing, IRC, etc...

  9. Re:Versus Expose? by nickos · · Score: 3, Interesting

    "OS X has a near perfect user interface designed by actual HID experts"

    There's no such thing as a perfect user interface. Apple should give users as much flexibility as possible since everyone has different usage styles. There's an interesting article from a frustrated Mac user here (read the section titled "Switcher Stories").

  10. Re:Get a second monitor. :D by Eslyjah · · Score: 2, Interesting

    Can't you map F14-F16 to mouse buttons 4, 5, and 6, and then just set expose to use those mouse buttons?

  11. Re:Versus Expose? by GlassHeart · · Score: 2, Interesting
    Apple have already come up with a perfect way of handling large groups of windows on one screen; it's called expose.

    Apple is composed of some very smart people, but Exposé is not at all the "perfect" way to handle large numbers of Windows. Having a second monitor - which MacOS supports very well - is usually better for users with no space or cost constraints.

  12. A couple more APIs Apple needs to add... by argent · · Score: 3, Interesting

    Why can't I put the shortcuts for Expose onto the three keys that I NEVER use for ANYTHING? :-(

    What I want to know is why Apple hasn't put a general purpose input or hotkey manager in Preferences that would let you map any key combo to any hotkey-using application.

    Plus, every second keyboard these days has half a dozen extra "Multimedia" or "Internet" buttons. Why can't I map those to actions?

  13. Maybe not evil, but at least rude... by argent · · Score: 2, Interesting

    Why would anyone pay for a newsreader when Google Groups exists?

    Um, because Google could arbitrarily change Google Groups at any moment and remove features that you depend on?

    Oh, wait, Doctor Evil, that already happened.

    (yes, it's their code, their hardware, they have a right to do it, the point is they can and do, and that's one good reason to do Usenet yourself instead of depending on the kindness of strangers)

  14. Re:Versus Expose? by for_usenet · · Score: 2, Interesting

    I think the reason why Mail.app looks so different is proably because it is one of the truly cross platform mail apps. I remember reading somewhere that Mail.app is one of the few applications that can compile cleanly and with all functionality intact on both OS X and Linux running GNUStep. If that were the case, it might explain the different GUI, as they may have had to make some comprimises to make the application truly cross platform.