macOS 27 Golden Gate Beta - Scripting Addition Offsets & Patterns
[!NOTE] This is for yabai users who, like me, move to each new Golden Gate beta the moment it drops and want to keep things working without waiting for an official build. The maintainers are welcome to use these values too.
It's filed as an issue rather than a pull request only because PRs are disabled on this repo.
@asmvik, feel free to pin this while Golden Gate is in beta if it'd help people find it; it can come down once the public release ships.
The scripting addition works on the macOS 27 developer beta. Five of the seven Dock signatures carried over from Tahoe unchanged and only needed their offsets bumped to wherever Apple moved them. add_space and set_front_window needed new patterns.
Derived against build 26A5353q, Dock SHA-256 34af810d533a6b9be3d4fa8eeda1bb0bb399c22bb38fc6373581f9fedb9e697c. Only arm64e, as macOS Golden Gate dropped Intel support.
What changed
Check out this commit on my fork. If you keep your own source, diff that and you're done.
In the two that changed, only one byte actually moved: a bl target in add_space, and the cbz displacement before the prologue in set_front_window. Tahoe matched those bytes literally, which is why its patterns broke on Golden Gate; the ones below wildcard them:
| target | offset | pattern |
|---|---|---|
dock.spaces |
0x30000 |
?8 ?? ?? ?? 08 ?? ?? 91 00 01 40 F9 E2 03 13 AA ?? ?? ?? 94 ?? ?? ?? ?? 08 |
dp_desktop_picture_manager |
0x40000 |
?? ?? 00 ?? 08 ?? ?? 91 00 01 40 F9 E2 03 16 AA E3 03 19 AA ?? ?? ?? 94 |
add_space (changed) |
0x210000 |
7F 23 03 D5 E1 03 1E AA ?? ?? ?? 97 FE 03 01 AA ?? ?? ?? A9 FD 43 01 91 F3 03 14 AA F5 03 00 AA 96 8E 43 F8 |
remove_space |
0x170000 |
7F 23 03 D5 FF ?? ?? D1 FC ?? ?? A9 FA ?? ?? A9 F8 ?? ?? A9 F6 ?? ?? A9 F4 ?? ?? A9 FD ?? ?? A9 FD ?? ?? 91 ?? 03 03 AA F5 03 02 AA F4 03 01 AA |
move_space |
0x170000 |
7F 23 03 D5 E3 03 1E AA ?? ?? ?? 97 FE 03 03 AA FD 7B ?? A9 FD ?? ?? 91 F6 03 14 AA |
set_front_window (changed) |
0x10000 |
?? ?? ?? 34 7F 23 03 D5 FF C3 01 D1 ?? ?? ?? A9 ?? ?? ?? A9 ?? ?? ?? A9 FD 83 01 91 F3 03 01 AA F5 03 00 AA |
animation_time |
0x210000 |
00 10 6A 1E A8 ?? ?? D1 ?? 01 ?? F8 |
Checking the offsets on a later beta
Apple shuffles these every few betas, and most of the time it's only the offsets. You can find the new ones yourself in a minute. The script below reads a Dock binary and tells you, per target, whether the signature is unchanged, moved (and where to), or actually changed:
python3 verify_offsets.py /System/Library/CoreServices/Dock.app/Contents/MacOS/DockHere's the script: Yabai scripting-addition offset checker, verify/find Dock offsets on new macOS (beta) builds.
A moved offset is a one-line edit. A changed pattern is the only case that needs you to open Ghidra.
Just want it working?
Offsets aren't the whole patch. A new macOS major also needs verify_os_version (set macOSSequoia = true for 27, or the scan never runs), an OSAX_VERSION bump in common.h, and an entry in the workspace_is_macos_* table in workspace.h.
My fork has all of these, plus a make install-local target that handles the rest:
[!CAUTION] Do you actually know what's in this fork? You don't, not until you read it yourself. These commands pull code from a stranger on the internet (me), ask for your
sudopassword, write a passwordless rule into/etc/sudoers.d, codesign a binary, and inject a payload into one of the system services.Don't trust me. Always check for yourself. Read the commit.
git clone https://github.com/AhsanFazal/yabai
cd yabai
make install-localWhat install-local does:
- builds yabai
- drops the binary on your
PATH - codesigns it with your
yabai-certso the Accessibility grant survives rebuilds instead of re-prompting every time - sets up the passwordless
--load-sasudoers entry - loads the scripting addition
- starts the service
You'll need a yabai-cert Code Signing certificate in your keychain first (the usual yabai-from-source step).
I'll keep the fork's master on whatever Golden Gate beta I've upgraded to myself, so it'll trail Apple's public release by a bit.
Source: asmvik/yabai