How can I spoof Apple's "SIP enabled" checker?

[Moorgan]

I've been using TotalFinder for ages because of its visor and all of the convenience and aesthetic features that are superior to Apple's Finder, and I have no interest in going back to Apple's ghetto Finder. Unfortunately with Apple being a totalitarian corporation it has been increasing the tightness of its noose on the neck of its users steadily over the years, and I'm now at an impasse. An alternative to Finder like TotalFinder is "illegal" in Appleland, but in OS X I could slip the noose and run it anyway along with less douchey 3rd party security software in order to run it safely without loss.

Now my only option is to choke (lose TotalFinder + my freedom) or cut the noose. If I rescind the laws on SIP that are barring its function (csrutil enable --without debug --without fs --without nvram) I lose access to every AppStore app and any other that uses Apple's Big Brother program that diktects if the OS setup is unmodified and can't run if it has been. Hence I'm looking for something that will lie to Big Brother, or another solution if that's even possible.

 

[russell_314]

Wait, I’m confused here. Are you saying if you disabled that you lose access to the App Store? I haven’t done this recently but when I did this on my 2018 Mac mini nothing like that happened.

Also, it doesn’t seem like you’re a fan of big brother Apple, so why bother with the App Store? To be honest the Apple App Store on macOS kind of sucks in my opinion.

 

[Fishrrman]

Ever since SIP was introduced into the Mac OS, I've ALWAYS turned it off and LEFT IT off.

This has had no impact on my ability to download and use apps from The App Store.
(although I don't have many of them)

 

[Moorgan]

This is only an issue on the Silicon Mac's. The older Mac's don't even have the NVRAM feature of SIP. I just recently upgraded from a '08 Mac Pro that had my own custom version of El Capitan on it (no SIP) to the '22 Mac Studio w/ M1 Ultra (now macOS 14 Sonoma).

It's not so much that I want the App Store for computer software, but rather iOS software. These computers can run any iOS app from the App Store too, and some games (e.g. Minecraft Bedrock Edition), and for apps like Duolingo which I use daily for learning a new language, it would be nice to not have to switch to the tablet. In theory there's probably cracked versions of the iOS software I could find online, but I'm not sure if those would be fully functional…

Some of the other games would probably work fine, but for example Minecraft Java Edition doesn't work on the official servers without a paid account, and Bedrock Edition doesn't have the option for non-official multiplayer. So I imagine a cracked version of Bedrock Edition would just not have multiplayer. Similarly Duolingo's AI relies on their server data, so they could easily make the software break for someone using a modified version of the app. Then again maybe I'm overestimating mainstream developers… I'll look into it…

 

[ondioline]

You can’t spoof CSR states on Apple Silicon from the OS userland. SIP is set by the bootloader on the volume before the kernel is started, which is why it has to be enabled/disabled from recovery.

You’d probably have to compile your own XNU kernel with CSR syscalls modified at a minimum, lol

 

[Moorgan]

You’d probably have to compile your own XNU kernel with CSR syscalls modified at a minimum, lol

…and no one/group has already done this?

 

[ondioline]

I doubt anyones distributing anything like that?

The code is here, have at it lad:

xnu/bsd/kern/kern_csr.c at main · apple-oss-distributions/xnu

Contribute to apple-oss-distributions/xnu development by creating an account on GitHub.

github.com

 

[MacGizmo]

Disabling SIP on Apple Silicon Macs also kills Apple Pay.

I used to use Total Finder back in the day. It just got to be too much hassle, and way too many trade-offs now. I've since moved on to using Forklift to replace the Finder.

 

[Moorgan]

Disabling SIP on Apple Silicon Macs also kills Apple Pay.

I used to use Total Finder back in the day. It just got to be too much hassle, and way too many trade-offs now. I've since moved on to using Forklift to replace the Finder.

Yuuup, that's what it's feeling like (though I don't use Apple Pay). Thanks for the tip, I'll check out Forklift. Although I am considering redisabling SIP to use TotalFinder now that I found that I can emulate Android with Android Studio, since most apps are also available on Android. It's not really the same though… It doesn't look like it'd be too hard to crack the apps on an individual basis to make them work with SIP disabled, but that's more work than what it's worth to do alone, and there doesn't seem to be a community dedicated to cracking dual macOS-iOS apps.