{"id":47626,"date":"2025-05-06T16:50:45","date_gmt":"2025-05-06T20:50:45","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=47626"},"modified":"2025-05-06T16:50:45","modified_gmt":"2025-05-06T20:50:45","slug":"retrospective-on-reverse-engineering-a-tiger-bug","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2025\/05\/06\/retrospective-on-reverse-engineering-a-tiger-bug\/","title":{"rendered":"Retrospective on Reverse-Engineering a Tiger Bug"},"content":{"rendered":"<p><a href=\"https:\/\/paradisefacade.com\/blog\/2025\/5\/5\/a-20-year-retrospective-on-reverse-engineering-an-apple-bug-and-a-very-desperate-plea-for-help-n7984\">Rosyna Keller<\/a> (<a href=\"https:\/\/mastodon.social\/@rosyna\/114456299097353448\">Mastodon<\/a>, <a href=\"https:\/\/x.com\/rosyna\/status\/1919437927731614075\">tweet<\/a>):<\/p>\n<blockquote cite=\"https:\/\/paradisefacade.com\/blog\/2025\/5\/5\/a-20-year-retrospective-on-reverse-engineering-an-apple-bug-and-a-very-desperate-plea-for-help-n7984\"><p>At the time, Apple only allowlisted specific menu extras by class name (checked in <code>-[SUISStartupObject _canLoadClass:])<\/code>. Any attempt to load a menu extra that advertised a different class name in its Info.plist&rsquo;s <a href=\"https:\/\/developer.apple.com\/documentation\/bundleresources\/information-property-list\/nsprincipalclass?language=objc\">NSPrincipalClass<\/a> entry would fail. Menu extras were first-class citizens. You could hold the Command (&#x2318;) key down to move or quit them. They loaded automatically and needed no backing application. This sent lots of developers looking for workarounds to Apple&rsquo;s allowlist, as they wanted these features for their own menus.<\/p><p>Some developers would steal one of the allowlisted class names for their menu extra plugin. This was unwise. The Objective-C runtime only allowed one class instance with a specific name to be loaded at a time. When it found duplicates, the one it chose was an implementation detail that could cause unexpected crashes. Favorite choices of class names to hijack included <code>AppleVerizonExtra<\/code> or <code>IrDAExtra<\/code>, i.e., something a user isn&rsquo;t likely to have enabled. In the rare case someone <em>did<\/em> enable these, or if more than one developer chose to steal the same class name, all hell could break loose.<\/p><p>This was the impetus for <a href=\"https:\/\/web.archive.org\/web\/20111212002355\/http:\/\/unsanity.com\/haxies\/mee\">Menu Extra Enabler<\/a>. It was an old-style InputManager plugin that automatically loaded into SystemUIServer when installed and overrode the <code>-[SUISStartupObject _canLoadClass:]<\/code> instance method to return <code>YES<\/code> unregardless of what class name was used for the menu extra&rsquo;s principal class.<\/p>\n<p>[&#8230;]<\/p>\n<p>I&rsquo;m desperately looking for any assistance that can be provided. Specifically, I need some temporary help to afford the health insurance and rent. [&#8230;] My ultimate goal is to find some contracting work for macOS\/iOS where I can use my reverse engineering and bug fixing\/finding\/working around skills. I miss figuring out how things work, something I could do in spades while working on macOS Notarization at Apple.<\/p><\/blockquote>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2021\/07\/07\/ios-closing-of-the-frontier\/\">iOS: Closing of the Frontier<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2019\/06\/14\/is-the-macs-future-bright\/\">Is the Mac&rsquo;s Future Bright?<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2016\/02\/28\/apple-blacklists-own-ethernet-driver\/\">Apple Blacklists Its Own Ethernet Driver<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2015\/09\/24\/rosyna-needs-help\/\">Rosyna Needs Help<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2011\/03\/22\/disabling-dropboxs-haxie\/\">Disabling Dropbox&rsquo;s Haxie<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2005\/11\/21\/siegel-on-haxies\/\">Siegel on Haxies<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2004\/02\/08\/nstextview_i_search\/\">NSTextView I-Search<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2003\/04\/09\/menu_master_10\/\">Menu Master 1.0<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Rosyna Keller (Mastodon, tweet): At the time, Apple only allowlisted specific menu extras by class name (checked in -[SUISStartupObject _canLoadClass:]). Any attempt to load a menu extra that advertised a different class name in its Info.plist&rsquo;s NSPrincipalClass entry would fail. Menu extras were first-class citizens. You could hold the Command (&#x2318;) key down to move [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2025-05-06T20:50:48Z","apple_news_api_id":"1408ea02-4e01-4faf-a32b-36a6fd6d98c4","apple_news_api_modified_at":"2025-05-06T20:50:48Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/AFAjqAk4BT6-jKzam_W2YxA","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[770,422,131,1244,295,30,926,54,760,402],"class_list":["post-47626","post","type-post","status-publish","format-standard","hentry","category-technology","tag-assembly-language","tag-bluetooth","tag-bug","tag-haxie","tag-history","tag-mac","tag-mac-os-x-10-4-tiger","tag-objective-c","tag-objective-c-runtime","tag-powerpc"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/47626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=47626"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/47626\/revisions"}],"predecessor-version":[{"id":47627,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/47626\/revisions\/47627"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=47626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=47626"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=47626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}