10 ms·

http://forums.dropbox.com/topic.php?id=12498 http://forums.dropbox.com/topic.php?id=12498 "more pertinent is the fact that none of the integrations we do with

http://forums.dropbox.com/topic.php?id=12498 http://forums.dropbox.com/topic.php?id=12498 "more pertinent is the fact that none of the integrations we do with the Finder are actually supported by Apple. this means that it takes significant reverse engineering of the Finder to make icon overlays/contextual menu items to work. Apple completely removed support for contextual menu items in SL (it's possible to have right click options, but it's not possible to have a submenu, or a submenu with options that change dynamically based on context). in order to make these integrations work we have to inject code into the finder to make in memory replacements of finder code with our own (many complexities/details of hackery omitted). if it were easy, you'd see more products than just Dropbox able to do it ;-)" also: http://forums.dropbox.com/topic.php?id=938 http://forums.dropbox.com/topic.php?id=938

rkudeshi 15y ago
I had no idea installing Dropbox meant they were modifying the Finder. Why isn't there an option to disable this?
- JonnieCache 15y ago
  Note that they are injecting code into the running Finder process, which is very different from patching the Finder binary. That would be very bad.
  - jcurbo 15y ago
    This would also break the code signing for Finder, I believe. (also bad)
  - simplekoala 15y ago
    They are injecting code into running Finder process? Hmmm, so they figured one of the jump instructions target address in Finder process ( for a function invocation, most likely the code to show the pop-up), and changed that location to jump to a different address where they injected their code? Don't you need root privileges to muck with Finder's process space? I see dropbox process running with non-privileged uid. Wonder, how they managed to change the VMM space of Finder process to inject code. Any thoughts? Please correct me, if I am totally off the mark here.
    - JonnieCache 15y ago
      I think there are some hooks in OSX/Cocoa for doing this, although I don't claim to actually understand it. There is the SIMBL system which people used to write native plugins for Safari, I guess that's probably stopped since it has an actual extension framework now. http://www.culater.net/software/SIMBL/SIMBL.php http://www.culater.net/software/SIMBL/SIMBL.php Then there's TotalFinder, which uses in-memory patching to add tabs and all sorts of other leet stuff into Finder. I highly recommend it. In their docs they say it works similarly to SIMBL. http://totalfinder.binaryage.com/ http://totalfinder.binaryage.com/
      - scott_s 15y ago
        So, hijacking shared libraries. I doubt they're actually changing the Finder process in memory. I bet their changes are localized to the library they hijack.
      - simplekoala 15y ago
        Thanks for the info. On further digging, I found this useful link - http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering which provides some insights into accomplishing what Dropbox did.
    - scott_s 15y ago
      A process can't change the address space of another process, period. Even if one is a root process. Separation of address spaces is a basic security service provided by the operating system. So I'm also puzzled how they are able to modify memory in Finder's address space. The closest thing I can think of is that Finder executes arbitrary processes on behalf of the user. That is, when I double click on something, Finder has to do the fork-exec dance to launch that application. A process fork, however, creates an entirely separate address space for the new process. I would be shocked if Finder did not do that. So, yes, I'm also wondering what it is they do.
      - simplekoala 15y ago
        Thanks for the clarification. I was thinking may be they were mucking with shared libraries. I found this useful link on digging further. Doesn't seem like too much of black art. http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering
  - scott_s 15y ago
    I'm not convinced that patching code into a running process [1] is any better than patching the binary on disk. That's the sort of thing that a fully secured system would not allow. [1] Of course excluding programs that have an actual plugin interface, and the "patching" just constitutes using that interface.
Hitchhiker 15y ago
This is the most interesting comment for me personally. Thanks.

rkudeshi 15y ago

I had no idea installing Dropbox meant they were modifying the Finder. Why isn't there an option to disable this?

JonnieCache 15y ago
Note that they are injecting code into the running Finder process, which is very different from patching the Finder binary. That would be very bad.
- jcurbo 15y ago
  This would also break the code signing for Finder, I believe. (also bad)
- simplekoala 15y ago
  They are injecting code into running Finder process? Hmmm, so they figured one of the jump instructions target address in Finder process ( for a function invocation, most likely the code to show the pop-up), and changed that location to jump to a different address where they injected their code? Don't you need root privileges to muck with Finder's process space? I see dropbox process running with non-privileged uid. Wonder, how they managed to change the VMM space of Finder process to inject code. Any thoughts? Please correct me, if I am totally off the mark here.
  - JonnieCache 15y ago
    I think there are some hooks in OSX/Cocoa for doing this, although I don't claim to actually understand it. There is the SIMBL system which people used to write native plugins for Safari, I guess that's probably stopped since it has an actual extension framework now. http://www.culater.net/software/SIMBL/SIMBL.php http://www.culater.net/software/SIMBL/SIMBL.php Then there's TotalFinder, which uses in-memory patching to add tabs and all sorts of other leet stuff into Finder. I highly recommend it. In their docs they say it works similarly to SIMBL. http://totalfinder.binaryage.com/ http://totalfinder.binaryage.com/
    - scott_s 15y ago
      So, hijacking shared libraries. I doubt they're actually changing the Finder process in memory. I bet their changes are localized to the library they hijack.
    - simplekoala 15y ago
      Thanks for the info. On further digging, I found this useful link - http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering which provides some insights into accomplishing what Dropbox did.
  - scott_s 15y ago
    A process can't change the address space of another process, period. Even if one is a root process. Separation of address spaces is a basic security service provided by the operating system. So I'm also puzzled how they are able to modify memory in Finder's address space. The closest thing I can think of is that Finder executes arbitrary processes on behalf of the user. That is, when I double click on something, Finder has to do the fork-exec dance to launch that application. A process fork, however, creates an entirely separate address space for the new process. I would be shocked if Finder did not do that. So, yes, I'm also wondering what it is they do.
    - simplekoala 15y ago
      Thanks for the clarification. I was thinking may be they were mucking with shared libraries. I found this useful link on digging further. Doesn't seem like too much of black art. http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering http://www.culater.net/wiki/moin.cgi/CocoaReverseEngineering
- scott_s 15y ago
  I'm not convinced that patching code into a running process [1] is any better than patching the binary on disk. That's the sort of thing that a fully secured system would not allow. [1] Of course excluding programs that have an actual plugin interface, and the "patching" just constitutes using that interface.

Hitchhiker 15y ago

This is the most interesting comment for me personally. Thanks.