> you can write out a new file and change the directory entry to point to a new one, but then you haven't technically modified the other file Yep, this. Meanwh

> you can write out a new file and change the directory entry to point to a new one, but then you haven't technically modified the other file Yep, this. Meanwhile, on MacOS, code signatures (for signed binaries) are cached by inode. If the file contents at that inode change, the signature no longer matches, and Gatekeeper will SIGKILL the binary immediately when you try to run it. The cache is only kept in memory though, and rebooting clears it.