0

In /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources there is a file TrashIcon.icns. Alexander O'Mara, a guy who is a security expert at Mastercard discovered that this file contains not only "bright" icons but also "dark" ones. But to get access to the dark ones, you need to modify the file using a hex editor.

I never worked with hex editors and the instructions he gave are not very clear to me.

Alexander: I don't know of any existing tools, but it's pretty simple. Find the chunk inside TrashIcon.icns named FD D9 2F A8, copy it, and overwrite FD D9 2F A8 with icns. That will make it a valid icns file. From there you can extract the individual icons from the dark icns file using a tool like iconutil.

Me: Many thanks. But I'm not sure I understand the first part. [...]

Alexander: I'd recommend making a copy of the icns file, finding FD D9 2F A8, selecting all the hex on the left that comes before it, deleting it, then on the right side overwrite the first 4 bytes with icns, and save.

https://github.com/Ji4n1ng/OpenInTerminal/issues/211

I still don't understand how to "overwrite the first 4 bytes with icns", despite I'm not computer- or programming-illeterate person. Could you explaint it to me? An animated GIF will probably be the best option.

Improve this question
3
  • 3
    What’s your end goal with the bin, finder and icon related questions? If it’s to copy that file to your desktop and then edit it, there are easy paths forward. If you want the system to let you edit this and skin your system, that file is on a sealed system volume for most new macOS. We would need to know your exact build / version of macOS to begin to look at how feasible editing the system would be… Commented Apr 13, 2024 at 21:36
  • Sonoma 14.4.1. My aim here is to extract the dark Trash icon as PNG file, in its highest quality, that is, 1024x1024 px, 144 ppi, that's it. And yes, I know how to open binary files using vim and how to use vim (hjkl, :q, etc.), but I don't understand how does it related to my question. Commented Apr 13, 2024 at 23:53
  • Awesome - so you can copy the file to your desktop and vi will let you do the operation you mention you’re not sure how to execute. If you already know the tool, you’ll just need to :help binary in the editor to get going with the instructions. Commented Apr 14, 2024 at 0:29

4 Answers 4

Reset to default
2

On Ventura, the indicated marker is at offset 0x12b1e0 in that file. Probably close to the same offset in the Sonoma version of the file.

So use dd to cut the part before the marker off...

$ dd bs=1 skip=0x12b1e0 if=TrashIcon.icns of=tempfile 939131+0 records in 939131+0 records out 939131 bytes transferred in 3.979716 secs (235979 bytes/sec)

Then use the hex editor of your choice to patch the first four bytes. I used qemacs.

Before:

00000000 fd d9 2f a8 00 0e 54 7b 69 63 31 32 00 00 10 fe ýÙ/¨..T{ic12...þ 00000010 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 .PNG........IHDR

And after:

00000000 69 63 6e 73 00 0e 54 7b 69 63 31 32 00 00 10 fe icns..T{ic12...þ 00000010 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 .PNG........IHDR

And now it's an icon file again.

$ file tempfile tempfile: Mac OS X icon, 939131 bytes, "ic12" type
Improve this answer
1
  • Well done - much respect for the dd usage Commented Apr 14, 2024 at 2:26
1

The OP's question implies the use of a hex editor. User Marc Wilson has pointed out in a comment that "… macOS does include at least one hex editor, that being xxd, and one binary-safe application that can be used as one, that being vim." Additionally, third party hex editors do also exist, as shown in the answer by Marc Wilson.

This answer demonstrates how to make the necessary changes without relying on any hex editors or third party tools. Since I do not currently have access to Sonoma, I will be using Ventura 13.3.1 (a).

Note: This answer assumes grep version 2.6.0-FreeBSD is being used, which is included with macOS Monterey through at least macOS Sonoma. In this case, the previous grep version 2.5.1-FreeBSD will not work properly, which is included with macOS Big Sur down to at least Mac OS X Snow Leopard.

The commands below copy the TrashIcon.icns file to my Desktop.

cd ~/Desktop cp /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/TrashIcon.icns .

Next, use the commands below to determine where the first occurrence of the FD D9 2F A8 byte sequence is in the TrashIcon.icns file. In both bash and zsh, the byte sequence can be represented as the $'\xFD\xD9\x2F\xA8' string. Basically, each byte is preceded by \x and the result is preceded by $' and succeeded by '. (For an explanation of the use of the commands, see this answer.)

(export LC_ALL=C BS=$'\xFD\xD9\x2F\xA8'; cat TrashIcon.icns | tr -c "$BS" '\n' | grep -aoFbm1 "$BS" | sed 's/:.*//')

The output from the above commands is shown below. This output shows the byte sequence starts at offset 1225184.

1225184

The next command copies the TrashIcon.icns file starting at offset 1225184 to the tempfile file. (Note: 1225184=0x12b1e0)

dd bs=1 skip=1225184 if=TrashIcon.icns of=tempfile

The output from the above command is shown below.

939131+0 records in 939131+0 records out 939131 bytes transferred in 3.128151 secs (300219 bytes/sec)

The next command replaces the first 4 bytes the tempfile file with the 4 byte ASCII character string icns.

echo -n "icns" | dd bs=1 of=tempfile conv=notrunc

The command below shows the hexadecimal and ASCII values for the first 32 bytes of the tempfile file. Note: Non‑printable ASCII and non‑ASCII values are shown as the . character.

hexdump -Cv -n 32 tempfile

The output from the above command is shown below. The hexadecimal values are the same as shown in the answer by Marc Wilson.

00000000 69 63 6e 73 00 0e 54 7b 69 63 31 32 00 00 10 fe |icns..T{ic12....| 00000010 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 |.PNG........IHDR| 00000020

The command below can be used to show tempfile is an icon file.

file tempfile

The output from the above command is shown below.

tempfile: Mac OS X icon, 939131 bytes, "ic12" type
Improve this answer
2
  • I noodled about how to find the offset with grep, and finally punted and wrote a quickie python to determine it. BIG kudos for describing how to do the byte replacement with dd! BTW, macOS does include at least one hex editor, that being xxd, and one binary-safe application that can be used as one, that being vim. Commented Apr 14, 2024 at 22:46
  • @MarcWilson: I see your point about macOS hex editors. I adjusted my answer accordingly. Commented Apr 15, 2024 at 0:23
0

The value of icns in ascii is 69 63 6e 73, so you would write those values to a copy of the file in place of FD D9 2F A8 after doing the modification suggested to delete the contents to the left of FD D9 2F A8

Improve this answer
0

Mike's answer is probably correct, but I found a quicker way.

  1. Download icon_records, by Brielle Harrison, from https://github.com/nyteshade/icon_record_extractor (or read the code and compile it yourself...)

  2. chmod +x icon_records to allow Terminal to treat it as an executable

  3. ./icon_records TrashIcon.icns dark

that's it

Improve this answer

You must log in to answer this question.