Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/azenla/MacHack

Hidden Tools in macOS
https://github.com/azenla/MacHack

cli-tools macos

Last synced: about 2 months ago
JSON representation

Hidden Tools in macOS

Host: GitHub
URL: https://github.com/azenla/MacHack
Owner: azenla
License: other
Created: 2019-10-13T14:48:56.000Z (almost 5 years ago)
Default Branch: main
Last Pushed: 2021-11-15T17:20:45.000Z (almost 3 years ago)
Last Synced: 2024-05-05T15:36:22.449Z (5 months ago)
Topics: cli-tools, macos
Size: 58.6 KB
Stars: 630
Watchers: 32
Forks: 60
Open Issues: 0
Metadata Files:
- Readme: README.md
- License: LICENSE.md

Awesome Lists containing this project

README

# MacHack

A list of built-in tools in macOS that you probably didn't know about.

## Table of Contents

- [MacHack](#machack)
- [Table of Contents](#table-of-contents)
- [Commands](#commands)
- [java_home](#java_home)
- [dot_clean](#dot_clean)
- [SafeEjectGPU](#safeejectgpu)
- [sharing](#sharing)
- [remotectl](#remotectl)
- [brctl](#brctl)
- [sysadminctl](#sysadminctl)
- [ckksctl](#ckksctl)
- [otctl](#otctl)
- [spctl](#spctl)
- [networksetup](#networksetup)
- [systemsetup](#systemsetup)
- [airport](#airport)
- [AssetCacheLocatorUtil](#assetcachelocatorutil)
- [AssetCacheManagerUtil](#assetcachemanagerutil)
- [seedutil](#seedutil)
- [kmutil](#kmutil)
- [profiles](#profiles)
- [bputil](#bputil)
- [nscurl](#nscurl)
- [taskinfo](#taskinfo)
- [taskpolicy](#taskpolicy)
- [asr](#asr)
- [shortcuts](#shortcuts)
- [networkQuality](#networkquality)

## Commands

### java_home

This tool queries the available Java Virtual Machines from `/Library/Java/JavaVirtualMachines`.

```text
$ /usr/libexec/java_home --help
Usage: java_home [options...]
Returns the path to a Java home directory from the current user's settings.

Options:
[-v/--version ] Filter versions (as if JAVA_VERSION had been set in the environment).
[-a/--arch ] Filter architecture (as if JAVA_ARCH had been set in the environment).
[-F/--failfast] Fail when filters return no JVMs, do not continue with default.
[ --exec ...] Execute the $JAVA_HOME/bin/ with the remaining arguments.
[-X/--xml] Print full JVM list and additional data as XML plist.
[-V/--verbose] Print full JVM list with architectures.
[-h/--help] This usage information.
```

An example usage of this tool:

```text
$ /usr/libexec/java_home -v 11 -a x86_64
/Library/Java/JavaVirtualMachines/adoptopenjdk-11.jdk/Contents/Home
```

### dot_clean

This is an extremely useful built-in utility to delete all useless dot files that macOS creates, such as ._MyFile.

Just point it at a folder, and it wipes it free of the cruft!

```text
$ /usr/sbin/dot_clean
usage: dot_clean [-fmnpsv] [--keep=[mostrecent|dotbar|native]] [directory ...]
```

An example usage of the tool:

```text
$ /usr/sbin/dot_clean /Volumes/Shared/MyFiles
```

### SafeEjectGPU

This is a utility for managing GPUs, especially eGPUs. This is what is behind
the safe eject functionality of the eGPU in the System UI.

It is useful for:

- Listing GPUs on the system.
- Determining what applications are using a particular GPU.
- Ejecting an eGPU safely.
- Launching an application on a specific GPU.
- Switching an application from one GPU to another.

```text
$ /usr/bin/SafeEjectGPU
usage: SafeEjectGPU [Commands...]
Commands:
gpuid # specify gpuid of following commands
gpuids ,,... # specify list of gpuids for RelaunchPIDOnGPU command
gpus # show all GPUs and their applicable properties
apps # show all Apps on specified gpuid
status # show status of all specified gpuid
Eject # Eject (full eject sequence) on specified gpuid
Initiate # Initiate eject sequence on specified gpuid
Relaunch # Relaunch lingering AppKit apps on specified gpuid
Finalize # Finalize eject sequence on specified gpuid
Cancel # Cancel eject sequence on specified gpuid
RelaunchPID # RelaunchPID can be used in app testing to send Relaunch stimulus in isolation
RelaunchPIDOnGPU # Send Relaunch stimulus to an app with set of limited GPUs to select from, use gpuids
LaunchOnGPU # Launch an app from given bundle path with set of limited GPUs, use gpuids
zombies # show all zombies (apps holding reference to unplugged eGPU)
zcount # show count of (unhidden) zombies
Zkill # kill zombies
Zrelaunch # relaunch zombies
+fallbackGPUEjectPolicy # allow builtin fallbacks to take effect (default)
-fallbackGPUEjectPolicy # deny builtin fallbacks

Notes:
Unspecified gpuid (==0) indicates all "removable" GPUs
Capitalized commands may have system-wide effects
Non-capitalized commands are informative only
See description of Info.plist "SafeEjectGPUPolicy" key. Use values:
"ignore", "wait", "relaunch", or "kill" for per-app policy
+/-fallbackGPUEjectPolicy can appear multiple times on the commandline and applies to following commands
```

Example of the `gpus` command:

```text
$ /usr/bin/SafeEjectGPU gpus
gpus
2020-12-27 15:30:35.949 SafeEjectGPU[55941:9041424] Device PreExisted [00000001000008b2] AMD Radeon RX 570
2020-12-27 15:30:35.949 SafeEjectGPU[55941:9041424] Device PreExisted [00000001000008b5] AMD Radeon Pro 560X
2020-12-27 15:30:35.949 SafeEjectGPU[55941:9041424] Device PreExisted [0000000100000876] Intel(R) UHD Graphics 630
gpuid 0x56ce - Intel® UHD Graphics 630
registryID=0x0000000100000876 integrated
location - BuiltIn
locationNumber - 0
maxTransferRate - 0
gpuid 0x9f05 - AMD Radeon Pro 560X
registryID=0x00000001000008b5 discrete
location - BuiltIn
locationNumber - 1
maxTransferRate - 0
gpuid 0x5d0e - AMD Radeon RX 570
registryID=0x00000001000008b2 removable
Razer Core X - enclosureRegistryID=0x0000000100000472
location - External
locationNumber - 1
maxTransferRate - 5000000000
```

### sharing

This command gives information about File Sharing. It should look similar to the File Sharing section in the Sharing preference pane.

```bash
$ /usr/sbin/sharing
Usage:
sharing -a [options] : create a sharepoint for directory specified by path
sharing -e [options] : edit sharepoint named
sharing -r : remove sharepoint with name
sharing -l [-f json] : list existing sharepoints

options:
-A :use share point name for afp. Obsolete but left in for backwards compatibility.
-F :use share point name for ftp. Obsolete but left in for backwards compatibility.
-S :use share point name for smb.
-s [] :enable sharing, restricted by flags if specified;
flags = 000,001,010 ...111; 1 = share, 0 = do not share;
with digits indicating afp (no longer supported), ftp (no longer supported) and smb in that order;
default is 001 if -s is specified with no flags.
-g [] :enable guest access, restricted by flags if specified;
flags = 000,001,010 ...111; 1 = enabled, 0 = disabled;
with digits indicating afp (no longer supported), ftp (no longer supported) and smb in that order;
default 001 if -g is specified with no flags.
-i [] :enable inherit privileges from parent (afp only). Obsolete but left in for backwards compatibility.
-n :set record name to use (by default this is the directory name of the shared directory)
-R <0/1> :make share read only for smb. 1 is enable, 0 is disable.
-E <0/1> :make share encrypted for smb v3 and later. 1 is enable, 0 is disable.
-f :when listing shares, outputs in specified format. Formats supported: json
```

### remotectl

The Apple T2 security chip (a built-in ARM chip in newer Intel Mac models) communicates with your system with a modified HTTP/2 protocol. There is also a command-line interface for various functions of the chip.
Note that this chip is merged with the Apple Silicon chips, and remotectl is no longer used on Apple Silicon Macs.

```text
$ /usr/libexec/remotectl
usage: remotectl list
usage: remotectl show (name|uuid)
usage: remotectl get-property (name|uuid) [service] property
usage: remotectl dumpstate
usage: remotectl browse
usage: remotectl echo [-v service_version] [-d (name|uuid)]
usage: remotectl echo-file (name|uuid) path
usage: remotectl eos-echo
usage: remotectl netcat (name|uuid) service
usage: remotectl relay (name|uuid) service
usage: remotectl loopback (attach|connect|detach|suspend|resume)
usage: remotectl bonjour ((enable|enable-loopback interface_name)|(disable))
usage: remotectl convert-bridge-version plist-in-path bin-out-path
usage: remotectl heartbeat (name|uuid)
usage: remotectl trampoline [-2 fd] service_name command args ... [ -- [-2 fd] service_name command args ... ]
```

Example of the `list` command:

```text
$ /usr/libexec/remotectl list
MY_UUID localbridge iBridge2,3 J680AP 5.1 (18P3030/18.16.13030.0.0,0) -
```

Example of the `show` command:

```text
$ /usr/libexec/remotectl show MY_UUID
Found localbridge (bridge)
State: connected (connectable)
UUID: MY_UUID
Product Type: iBridge2,3
OS Build: 5.1 (18P3030)
Messaging Protocol Version: 2
Heartbeat:
Last successful heartbeat sent 8.825s ago, received 8.822s ago (took 0.003s)
64402 heartbeats sent, 0 received
Properties: {
AppleInternal => false
CPUArchitecture => arm64
ChipID => 32786
EffectiveProductionStatusSEP => true
HWModel => J680AP
HasSEP => true
LocationID => MY_LOCATION_ID
IsUIBuild => true
RegionInfo => LL/A
DeviceSupportsLockdown => false
EffectiveSecurityModeAp => true
SigningFuse => true
BuildVersion => 18P3030
OSVersion => 5.1
BridgeVersion => 18.16.13030.0.0,0
SensitivePropertiesVisible => true
BoardRevision => 1
Image4CryptoHashMethod => sha2-384
ProductType => iBridge2,3
SerialNumber => MY_SERIAL_NUMBER
BootSessionUUID => MY_BOOT_SESSION_ID
BoardId => 11
DeviceColor => black
EffectiveProductionStatusAp => true
EffectiveSecurityModeSEP => true
UniqueChipID => MY_UNIQUE_CHIP_ID
UniqueDeviceID => MY_UNIQUE_DEVICE_ID
RemoteXPCVersionFlags => MY_XPC_VERSION_FLAGS
CertificateProductionStatus => true
CertificateSecurityMode => true
DeviceEnclosureColor => black
ModelNumber => Z0V16LL/A
RegionCode => LL
SecurityDomain => 1
OSInstallEnvironment => false
InterfaceIndex => 4
HardwarePlatform => t8012
Image4Supported => true
}
Services:
com.apple.nfcd.relay.uart
com.apple.bridgeOSUpdated
com.apple.videoprocessingd.encode.remote
com.apple.corespeech.xpc.remote.record
com.apple.bootpolicyd.remote.internal
com.apple.icloud.findmydeviced.bridge
com.apple.xpc.remote.mobile_obliteration
com.apple.bootpolicyd.remote
com.apple.eos.BiometricKit
com.apple.osanalytics.logTransfer
com.apple.internal.xpc.remote.kext_audit
com.apple.xpc.remote.multiboot
com.apple.powerchime.remote
com.apple.aveservice
com.apple.recoverylogd.bridge
com.apple.sysdiagnose.stackshot.remote
com.apple.corespeech.xpc.remote.control
com.apple.RestoreRemoteServices.restoreserviced
com.apple.corecaptured.remoteservice
com.apple.nfcd.relay.control
com.apple.mobileactivationd.bridge
com.apple.sysdiagnose.remote
com.apple.CoreKDL.remoteXPC
com.apple.eos.LASecureIO
com.apple.multiverse.remote.bridgetime
com.apple.lskdd
com.apple.private.avvc.xpc.remote
```

### brctl

This is a utility related to "CloudDocs", also know as iCloud Drive.

```text
$ /usr/bin/brctl
Usage: brctl [command-options and arguments]

-h,--help show this help

COMMANDS

diagnose [options] [--doc|-d ] []
diagnose and collect logs

-M,--collect-mobile-documents[=] (default: all containers)
-s,--sysdiagnose Do not collect what's already part of sysdiagnose
-t,--uitest Collect logs for UI tests
-n,--name= Change the device name
-f,--full Do a full diagnose, including server checks
-d,--doc=
Collect additional information about the document at that path.
Helps when investigating an issue impacting a specific document.
-e,--no-reveal Do not reveal diagnose in the Finder when done
[]
Specifies the output path of the diagnosis; -n becomes useless.

log [options] []

-a,--all Show all system logs
-p,--predicate Additional predicate (see `log help predicates`)
-x,--process Filter events from the specified process
-d,--path= Use instead of default
-S,--start="YYYY-MM-DD HH:MM:SS" Start log dump from a specified date
-E,--end="YYYY-MM-DD HH:MM:SS" Stop log dump after a specified date
-b     Only show CloudDocs logs
-f     Only show FileProvider related logs
-F Only show FruitBasket related logs
-g     Only show Genstore related logs
-i Only show SQL and CloudDocs logs
-z,--local-timezone Display timestamps within local timezone

dump [options] []
dump the CloudDocs database

-o,--output=
redirect output to
-d,--database-path=
Use the database at
-i,--itemless
Don't dump items from the db
-u,--upgrade
Upgrade the db if necessary before dumping

[] the container to be dumped

status []
Prints items which haven't been completely synced up / applied to disk

[] the container to be dumped

quota
Displays the available quota in the account

monitor [options] [ ...]
monitor activity
-g dump global activity of the iCloud Drive
-i dump changes incrementally
-S,--scope=
restrict the NSMetadataQuery scope to docs, data, external or a combination

[ ...] list of containers to monitor, ignored when -g is used
```

A pretty cool command here is a utility to get the quota left on your iCloud Drive:

```text
$ /usr/bin/brctl quota
2098962726220 bytes of quota remaining
```

### sysadminctl

Basically an all around useful tool for managing users, as well as manage full-disk encryption (FileVault).

```text
$ /usr/sbin/sysadminctl
Usage: sysadminctl
-deleteUser [-secure || -keepHome] (interactive || -adminUser -adminPassword )
-newPassword -oldPassword [-passwordHint ]
-resetPasswordFor -newPassword [-passwordHint ] (interactive] || -adminUser -adminPassword )
-addUser [-fullName ] [-UID ] [-GID ] [-shell ] [-password ] [-hint ] [-home ] [-admin] [-roleAccount] [-picture ] (interactive] || -adminUser -adminPassword )
-secureTokenStatus
-secureTokenOn -password (interactive || -adminUser -adminPassword )
-secureTokenOff -password (interactive || -adminUser -adminPassword )
-guestAccount
-afpGuestAccess
-smbGuestAccess
-automaticTime
-filesystem status
-screenLock -password

Pass '-' instead of password in commands above to request prompt.
'-adminPassword' used mostly for scripted operation. Use '-' or 'interactive' to get the authentication string interactively. This preferred for security reasons

*Role accounts require name starting with _ and UID in 200-400 range.
```

A pretty useful command in this tool is to check if FileVault is enabled:

```text
$ sudo sysadminctl -filesystem status
2019-10-13 10:16:41.266 sysadminctl[61797:3404423] Boot volume CS FDE: NO
2019-10-13 10:16:41.298 sysadminctl[61797:3404423] Boot volume APFS FDE: YES
```

### ckksctl

CloudKit controls, probably useful for some advanced users.

```text
$ /usr/sbin/ckksctl
usage: ckksctl [-p] [-j] [-s] [-v arg] [status] [fetch] [push] [resync] [reset] [reset-cloudkit] [ckmetric]

Control and report on CKKS

positional arguments:

optional arguments:
-p, --perfcounters Print CKKS performance counters
-j, --json Output in JSON format
-s, --short Output a short format
-v arg, --view arg Operate on a single view

optional commands:
status Report status on CKKS views
fetch Fetch all new changes in CloudKit and attempt to process them
push Push all pending local changes to CloudKit
resync Resync all data with what's in CloudKit
reset All local data will be wiped, and data refetched from CloudKit
reset-cloudkit All data in CloudKit will be removed and replaced with what's local
ckmetric Push CloudKit metric
```

### otctl

This is the Octagon Trust utility. It's a pretty neat view of the underlying trust network being used by your Apple Devices.

```text
$ /usr/sbin/otctl
usage: otctl [-s arg] [-e arg] [-r arg] [-j] [-i arg] [-E] [-P] [--altDSID arg] [--entropy arg] [--appleID arg] [--dsid arg] [--container arg] [--radar arg] [start] [sign-in] [sign-out] [status] [resetoctagon] [resetProtectedData] [user-controllable-views] [allBottles] [recover] [depart] [er-trigger] [er-status] [er-reset] [er-store] [health] [ckks-policy] [taptoradar] [fetchEscrowRecords] [fetchAllEscrowRecords] [recover-record] [recover-record-silent]

Control and report on Octagon Trust

positional arguments:

optional arguments:
-s arg, --secret arg escrow secret
-e arg, --bottleID arg bottle record id
-r arg, --skipRateLimiting arg enter values YES or NO, option defaults to NO, This gives you the opportunity to skip the rate limiting check when performing the cuttlefish health check
-j, --json Output in JSON
-i arg, --recordID arg recordID
-E, --enable Enable something (pair with a modification command)
-P, --pause Pause something (pair with a modification command)
--altDSID arg altDSID (for sign-in/out)
--entropy arg escrowed entropy in JSON
--appleID arg AppleID
--dsid arg DSID
--container arg CloudKit container name
--radar arg Radar number

optional commands:
start Start Octagon state machine
sign-in Inform Cuttlefish container of sign in
sign-out Inform Cuttlefish container of sign out
status Report Octagon status
resetoctagon Reset and establish new Octagon trust
resetProtectedData Reset ProtectedData
user-controllable-views Modify or view user-controllable views status (If one of --enable or --pause is passed, will modify status)
allBottles Fetch all viable bottles
recover Recover using this bottle
depart Depart from Octagon Trust
er-trigger Trigger an Escrow Request request
er-status Report status on any pending Escrow Request requests
er-reset Delete all Escrow Request requests
er-store Store any pending Escrow Request prerecords
health Check Octagon Health status
ckks-policy Trigger a refetch of the CKKS policy
taptoradar Trigger a TapToRadar
fetchEscrowRecords Fetch Escrow Records
fetchAllEscrowRecords Fetch All Escrow Records
recover-record Recover record
recover-record-silent Silent record recovery
```

Run the following command to list your peers:

```text
$ /usr/sbin/otctl status
... Lots of Useful Output ...
```

### spctl

This is the System Policy management utility. You can enable and disable Gatekeeper and other code-signing features this way.

Developer Mode Usage:
spctl developer-mode
enable-terminal
Add Terminal as a developer tool.
Kernel Extension User Consent Usage:
spctl kext-consent ** Modifications only available in Recovery OS **
status
Print whether kernel extension user consent is enabled or disabled.
enable
Enable requiring user consent for kernel extensions.
disable
Disable requiring user consent for kernel extensions.
add
Insert a new Team Identifier into the list allowed to load kernel extensions without user consent.
list
Print the list of Team Identifiers allowed to load without user consent.
remove
Remove a Team Identifier from the list allowed to load kernel extensions without user consent.
```

A useful command is to view the status of the system policy assesments:

```text
$ /usr/sbin/spctl --status
assessments enabled
```

### networksetup

Network setup is pretty much everything network-related minus some wireless stuff.

```text
$ /usr/sbin/networksetup
networksetup Help Information
-------------------------------
Usage: networksetup -listnetworkserviceorder
Display services with corresponding port and device in order they are tried for connecting
to a network. An asterisk (*) denotes that a service is disabled.

Usage: networksetup -listallnetworkservices
Display list of services. An asterisk (*) denotes that a network service is disabled.

Usage: networksetup -listallhardwareports
Display list of hardware ports with corresponding device name and ethernet address.

Usage: networksetup -detectnewhardware
Detect new network hardware and create a default network service on the hardware.

Usage: networksetup -getmacaddress
Display ethernet (or Wi-Fi) address for hardwareport or device specified.

Usage: networksetup -getcomputername
Display the computer name.

Usage: networksetup -setcomputername
Set the computer's name (if valid) to .

Usage: networksetup -getinfo
Display IPv4 address, IPv6 address, subnet mask,
router address, ethernet address for .

Usage: networksetup -setmanual
Set the TCP/IP configuration to manual with IP address set to ip,
Subnet Mask set to subnet, and Router address set to router.

Usage: networksetup -setdhcp [clientid]
Set the TCP/IP configuration to DHCP. You can set the
DHCP client id to the optional [clientid]. Specify "Empty" for [clientid]
to clear the DHCP client id.

Usage: networksetup -setbootp
Set the TCP/IP configuration to BOOTP.

Usage: networksetup -setmanualwithdhcprouter
Set the TCP/IP configuration to manual with DHCP router with IP address set
to ip.

Usage: networksetup -getadditionalroutes
Get additional IPv4 routes associated with
Usage: networksetup -setadditionalroutes [ ]*
Set additional IPv4 routes associated with
by specifying one or more [ ] tuples.
Remove additional routes by specifying no arguments.
If is "", the route is direct to the interface
Usage: networksetup -setv4off
Turn IPv4 off on .

Usage: networksetup -setv6off
Turn IPv6 off on .

Usage: networksetup -setv6automatic
Set the service to get its IPv6 info automatically.

Usage: networksetup -setv6LinkLocal
Set the service to use its IPv6 only for link local.

Usage: networksetup -setv6manual

Set the service to get its IPv6 info manually.
Specify

and .

Usage: networksetup -getv6additionalroutes
Get additional IPv6 routes associated with
Usage: networksetup -setv6additionalroutes [ ]*
Set additional IPv6 routes associated with
by specifying one or more [ ] tuples.
Remove additional routes by specifying no arguments.
If is "", the route is direct to the interface
Usage: networksetup -getdnsservers
Display DNS info for .

Usage: networksetup -setdnsservers [dns2] [...]
Set the DNS servers to [dns2] [...]. Any number of dns servers can be
specified. Specify "Empty" for to clear all DNS entries.

Usage: networksetup -getsearchdomains
Display Domain Name info for .

Usage: networksetup -setsearchdomains [domain2] [...]
Set the Domain Name servers to [domain2] [...]. Any number of Domain Name
servers can be specified. Specify "Empty" for to clear all Domain Name entries.

Usage: networksetup -create6to4service
Create a 6 to 4 service with name .

Usage: networksetup -set6to4automatic
Set the service to get its 6 to 4 info automatically.

Usage: networksetup -set6to4manual
Set the service to get its 6 to 4 info manually.
Specify for the relay address.

Usage: networksetup -getftpproxy
Display FTP proxy (server, port, enabled value) info for .

Usage: networksetup -setftpproxy
Set FTP proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on.

Usage: networksetup -setftpproxystate
Set FTP proxy to either or .

Usage: networksetup -getwebproxy
Display Web proxy (server, port, enabled value) info for .

Usage: networksetup -setwebproxy
Set Web proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on.

Usage: networksetup -setwebproxystate
Set Web proxy to either or .

Usage: networksetup -getsecurewebproxy
Display Secure Web proxy (server, port, enabled value) info for .

Usage: networksetup -setsecurewebproxy
Set Secure Web proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on.

Usage: networksetup -setsecurewebproxystate
Set SecureWeb proxy to either or .

Usage: networksetup -getstreamingproxy
Display Streaming proxy (server, port, enabled value) info for .

Usage: networksetup -setstreamingproxy
Set Streaming proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on.

Usage: networksetup -setstreamingproxystate
Set Streaming proxy to either or .

Usage: networksetup -getgopherproxy
Display Gopher proxy (server, port, enabled value) info for .

Usage: networksetup -setgopherproxy
Set Gopher proxy for with and . Turns proxy on. Optionally, specify or for