This post is divided in 5 secions:
- High Level Idea
- Problem
- Questions
- Setup: What I did to run the project
- Logs: Useful logs to help debug the Problem
High Level Idea
I'm trying to add support for File Open Events ES_EVENT_TYPE_NOTIFY_OPEN, but before I make any changes I wanted to run the default "git cloned" version of Crescendo, but it isn't loading any events.
Problem
After doing the Setup listed below, I try to run the Crescendo App locally for development. The thing is when I click the "Start" button a spinner shows for a second and then it stops and there's not events loading at all. After debugging and investigating for a while I come across 2 errors related to the TCC Daemon in the Console.app logs.
error 16:34:06.391530-0700 tccd -[TCCDAccessIdentity initWithMessage:]: self.bundle=0x0, bundle:(null); for: com.suprhackersteve.crescendo.CrescendoExtension
error 16:34:06.394319-0700 tccd -[TCCDAccessIdentity initWithMessage:]: self.bundle=0x0, bundle:(null); for: com.suprhackersteve.crescendo.CrescendoExtension
(Complete logs listed below in "Logs" section)
First thing I notice on top of my mind is that bundle is null. Second thing I notice in the Console.app's UI is that the category is of type access. As seen here:
I had no idea what TCC even mean so after a quick investigation:
TCC (Transparency, Consent, and Control) is a mechanism in macOS to limit and control application access to certain features, usually from a privacy perspective. Source
AFAIK it's what MacOS uses to give applications access to certain features "Full Disk Access" being one of those features. I decided to dig further into this and dumped the access table from TCC database.
TCC Access Table Dump
but to my surprise only the weather App is registered there.
So this brings me to my first conclusion:
- For some reason access is not being given to Crescendo System Extension and/or for Crescendo Application and somehow this is causing it to fail.
And my second conclusion is:
By reading the Console.app log I also encountered the following line:
default 16:34:07.413908-0700 Crescendo Failed to register with the provider: Couldn’t communicate with a helper application.
To my understanding this means that the Crescendo Application is unable to communicate with the Crescendo System Extension so it can't communicate via IPC so there's no way in which the Application can get the System Events and in consequence can't show them in the UI.
My second conclusion is that:
2. A signing/account-related error? Since I'm using a Free brand-new Personal Apple Developer Account this might be preventing me from running the System Extension locally and it somehow creates all those errors that I'm seeing.
Question
- Has anyone come across this issue and has any feedback on how I could approach it?
I've tried to find information online about this but it seems to me there's not a lot of information available online yet, so any pointers to docs or resources would be amazing!
Thanks for your time!
Setup
I created an ISO of Catalina 10.15.7. Booted into recovery mode and disabled SIP and AMFI using the following commands:
csrutil disable
nvram boot-args="amfi_get_out_of_my_way=0x1"
after reboot I also turned on developer mode just as the README.md stated:
systemextensionsctl developer on
I enabled the System Extension by clicking "Allow" button in System Preferences -> Security & Privacy.
Full Disk Access for both the System Extension and The Application (I added the Application manually)
I also changed project Build Settings for Crescendo App, Crescendo Extension and libCrescendo to "Sign to Run Locally" so that it could run locally, I was thrown a lot of errors if I didn't do this (I'm new to macOS dev this might be wrong)
Logs
The following is the log after everytime I click the "Start" button:
Console.app Log
default 16:34:04.627684-0700 runningboardd Acquiring assertion targeting executable<Crescendo(501)> from originator [daemon<com.apple.coreservices.launchservicesd>:121] with description <RBSAssertionDescriptor; frontmost:3626; ID: 227-121-547; target: 3626> attributes = {
<RBSDomainAttribute: 0x7f99a2f221c0; domain: com.apple.launchservicesd; name: RoleUserInteractiveFocal; sourceEnvironment: 0x0>;
}
default 16:34:04.627820-0700 runningboardd Assertion 227-121-547 (target:executable<Crescendo(501)>) will be created as active
default 16:34:04.642024-0700 runningboardd [executable<Crescendo(501)>:3626] Ignoring jetsam update because this process is not memory-managed
default 16:34:04.643547-0700 runningboardd [executable<Crescendo(501)>:3626] Set darwin role to: UserInteractiveFocal
default 16:34:04.646393-0700 runningboardd [executable<Crescendo(501)>:3626] Ignoring GPU update because this process is not GPU managed
default 16:34:04.647804-0700 runningboardd Finished acquiring assertion 227-121-547 (target:executable<Crescendo(501)>)
default 16:34:06.314364-0700 sysextd attempting to realize extension with identifier com.suprhackersteve.crescendo.CrescendoExtension
default 16:34:06.319736-0700 Crescendo Replacing extension com.suprhackersteve.crescendo.CrescendoExtension version 1.0.4 with version 1.0.4
default 16:34:06.319951-0700 sysextd attempting to realize properties with identifier com.suprhackersteve.crescendo.CrescendoExtension
default 16:34:06.326344-0700 sysextd staging extension with identifier com.suprhackersteve.crescendo.CrescendoExtension
default 16:34:06.336467-0700 sysextd Making activation decision for extension with teamID none, identifier com.suprhackersteve.crescendo.CrescendoExtension
default 16:34:06.336572-0700 sysextd validating extension with identifier com.suprhackersteve.crescendo.CrescendoExtension
default 16:34:06.367588-0700 sysextd waiting for external validation of extension with identifier com.suprhackersteve.crescendo.CrescendoExtension
error 16:34:06.391530-0700 tccd -[TCCDAccessIdentity initWithMessage:]: self.bundle=0x0, bundle:(null); for: com.suprhackersteve.crescendo.CrescendoExtension
error 16:34:06.394319-0700 tccd -[TCCDAccessIdentity initWithMessage:]: self.bundle=0x0, bundle:(null); for: com.suprhackersteve.crescendo.CrescendoExtension
default 16:34:06.397275-0700 sysextd Upgrading extension com.suprhackersteve.crescendo.CrescendoExtension/none version 35 (activated_enabled) to version 35
default 16:34:06.398542-0700 sysextd Starting upgrade of com.suprhackersteve.crescendo.CrescendoExtension/none version 35
default 16:34:06.398593-0700 sysextd Notifying delegates about replacement of com.suprhackersteve.crescendo.CrescendoExtension
default 16:34:06.399451-0700 sysextd Starting disable of com.suprhackersteve.crescendo.CrescendoExtension/none version 35 for upgrade, state: activated_enabled
default 16:34:06.400932-0700 sysextd notifying categories that extension com.suprhackersteve.crescendo.CrescendoExtension will terminate
default 16:34:06.401247-0700 sysextd terminating extension com.suprhackersteve.crescendo.CrescendoExtension via owning category
default 16:34:07.404159-0700 sysextd marked extension for uninstall on next reboot: com.suprhackersteve.crescendo.CrescendoExtension
default 16:34:07.406008-0700 sysextd Extension com.suprhackersteve.crescendo.CrescendoExtension/none version 35 uninstalled
default 16:34:07.406047-0700 sysextd Starting enablement of com.suprhackersteve.crescendo.CrescendoExtension/none version 35
default 16:34:07.407946-0700 sysextd notifying categories that extension com.suprhackersteve.crescendo.CrescendoExtension will start
default 16:34:07.408274-0700 sysextd starting extension com.suprhackersteve.crescendo.CrescendoExtension via owning category
default 16:34:07.411782-0700 sysextd Extension point confirmed that extension com.suprhackersteve.crescendo.CrescendoExtension is runnable.
default 16:34:07.411823-0700 sysextd changing state of extension com.suprhackersteve.crescendo.CrescendoExtension to activated_enabled.
default 16:34:07.413510-0700 Crescendo Trying to connect to service: AD94776VX5.com.suprhackersteve.crescendo.CrescendoExtension.xpc
default 16:34:07.413908-0700 Crescendo Failed to register with the provider: Couldn’t communicate with a helper application.
default 16:34:07.425595-0700 com.suprhackersteve.crescendo.CrescendoExtension Init Crescendo system extension
default 16:34:07.429502-0700 com.suprhackersteve.crescendo.CrescendoExtension Enabled Crescendo subsystem.
default 16:34:07.434137-0700 com.suprhackersteve.crescendo.CrescendoExtension Starting XPC listener for mach service.
default 16:34:07.909442-0700 runningboardd Invalidating assertion 227-121-547 (target:executable<Crescendo(501)>) from originator 121
default 16:34:08.018090-0700 runningboardd [executable<Crescendo(501)>:3626] Ignoring jetsam update because this process is not memory-managed
default 16:34:08.018141-0700 runningboardd [executable<Crescendo(501)>:3626] Set darwin role to: UserInteractiveNonFocal
default 16:34:08.018161-0700 runningboardd [executable<Crescendo(501)>:3626] Ignoring GPU update because this process is not GPU managed
Running systemextensionsctl list
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent