Hello, Could you please help me with the below, How to display a toast message to the user in CarPlay after a successful operation? I am performing a booking operation where in I need to show a message to the user once it is successful. How to show a spinner or an activity indicator just before performing some operation? On tap of the book button as described above, is there a way to show a loader? For this screen, I have used CPInformationTemplate that with a button(CPButton). I have referred to the CarPlay pdf design guidelines in which I couldn't find support for the above two. But I could see a loader within a button in one of the default apps in CarPlay simulator. Kindly help me with these queries

I've noticed several crashes that look like they're caused by an index out of bound in internal methods of NSFetchedResultsController. This happens while changes are merged from the persistent store container into the view context. Here's an example of the last exception backtrace. Exactly which internal methods that are called in - [NSFetchedResultsController(PrivateMethods) _core_managedObjectContextDidChange:] vary between crash reports but they all end up crashing from _NSArrayRaiseBoundException. The Core Data stack consists of one persistent store, one persistent store coordinator that the view context is set up to automatically merge changes from, and data is saved to disk from background context. persistentContainer.loadPersistentStores(...) viewContext = persistentContainer.viewContext viewContext.automaticallyMergesChangesFromParent = true backgroundContext = persistentContainer.newBackgroundContext() backgroundContext.mergePolicy = NSMergeByPropertyObjectTrumpMergePolicy backgroundClientContext = persistentContainer.newBackgroundContext() backgroundClientContext.mergePolicy = NSMergeByPropertyObjectTrumpMergePolicy Does anyone have any ideas what could be causing this? Thankful for any ideas or advice on how to investigate further.

Dear Apple Developer Forum, I have a question regarding the AVCaptureDevice on iOS. We're trying to capture photos in the best quality possible along with depth data with the highest accuracy possible. We were delighted when we saw AVCaptureDevice could be initialized with the AVMediaType=.depthData which works as expected (depthData is a part of the AVCapturePhoto). When setting to AVMediaType=.video, we still receive depth data (of same quality according to our own internal tests). That confused us. Mind you, we set the device format and depth format as well: private func getDeviceFormat() throws -> AVCaptureDevice.Format { // Ensures high video format and an appropriate color profile. let format = camera?.formats.first(where: { $0.isHighPhotoQualitySupported && $0.supportedDepthDataFormats.count > 0 && $0.formatDescription.mediaSubType.rawValue == kCVPixelFormatType_420YpCbCr8BiPlanarFullRange }) // Check and see if it's available. guard format != nil else { throw CaptureDeviceError.necessaryFormatNotAvailable } return format! } private func getDepthDataFormat(for format: AVCaptureDevice.Format) throws -> AVCaptureDevice.Format { // Access the depth format. let depthDataFormat = format.supportedDepthDataFormats.first(where: { $0.formatDescription.mediaSubType.rawValue == kCVPixelFormatType_DepthFloat32 }) // Check if it exists guard depthDataFormat != nil else { throw CaptureDeviceError.necessaryFormatNotAvailable } // Returns it. return depthDataFormat! } We're wondering, what steps we can take to ensure the best quality photo, along with the most accurate depth data? What properties are the most important, which have an effect, which don't? Are there any ways we can optimize our current configuration? We find it difficult as there's very limited guides and explanations on the media subtypes, for example kCVPixelFormatType_420YpCbCr8BiPlanarFullRange. Is it the best? Is it the best for our use case of high quality photo + most accurate depth data? Important comment: Our App only runs on iPhone 14 Pro, iPhone 15 Pro, iPhone 16 Pro on the latest iOS versions. We hope someone with greater knowledge at Apple can help us and guide us on how we can have the photos of best quality and depth data with most accuracy. Thank you very much! Kind regards.

It seems apps will never truly be suspended when debugging. Is this true? Is there ANY way to accurately test apps that need to go through full suspended + wakeup states while connected to XCode debugger?

Hi, I'm developing a multi-platform project in Windows, Mac and Linux. I am trying to create a wrapper class in Go that will query system information and history. I see that the Unified Logging System is a sophisticated way to get all sorts of kernel information (and even a long history including rotated logs). However, I am struggling to see how I can use the APIs in other languages aside from Swift itself (or C). I do not want to use the log or last commands to query information in separate child processes in my project. I would like to simply query the database itself, similar to using OSLog in Swift. If this is something that is entirely proprietary or not possible, let me know :)

I'm trying to persist a bookmark to an external device (mass storage controller connected via camera adapter) across disconnection / reconnection, but it is failing at startAccessingSecurityScopedResource. The URL is initially retrieved using UIDocumentPickerViewController *documentProvider; documentProvider = [[UIDocumentPickerViewController alloc] initForOpeningContentTypes:[NSArray arrayWithObjects:UTTypeFolder, nil]]; documentProvider.delegate = self; documentProvider.modalPresentationStyle = UIModalPresentationOverFullScreen; [self presentViewController:documentProvider animated:YES completion:nil]; and then persisted to a bookmark using DeviceBookmark = [url bookmarkDataWithOptions:NSURLBookmarkCreationMinimalBookmark includingResourceValuesForKeys:nil relativeToURL:nil error:nil] When accessing the resource I use NSURL *url = [NSURL URLByResolvingBookmarkData:DeviceBookmark options:NSURLBookmarkResolutionWithoutUI relativeToURL:nil bookmarkDataIsStale:&isStale error:&error] to retrieve the new URL. If I don't remove the MSC then the retrieved URL remains the same and functions as expected. If I remove and reconnect the MSC then the URL changes, I get true for isStale and nil for error but startAccessingSecurityScopedResource fails. I've been banging my head against this for about a day now, but can't see what the issue can be. I've tried adding some related permissions to the entitlements, but this seems to be macOS related as far as I can tell. What am I missing?!

I am trying to use the NFCTagReaderSession to SELECT the master file of a ISO 7816 smartcard by sending a corresponding NFCISO7816APDU after connecting to the card, but I am running into errors: Error Domain=NFCError Code=2 "Missing required entitlement" UserInfo={NSLocalizedDescription=Missing required entitlement} Error Domain=NFCError Code=103 "Session invalidated" UserInfo={NSLocalizedDescription=Session invalidated} I know that in order to communicate with a NFCISO7816Tag I need to declare the supported AIDs in the Info.plist, but what am I supposed to declare here?

Hello, I need to monitor the device for an activity that is not supported by ES framework. I can reliably monitor it using correct filters with log stream, for example sudo log stream --info --style compact --predicate 'category = "X"' But I need to provide that functionality through my application. Because of that, I made an instance of a log store, hoping I will be able to retrieve the necessary informations that way. The problem is that the messages are sometimes appearing and sometimes not. The log level I am interested in is info, which according to the docs The system stores info-level messages in memory buffers and, without a configuration change, purges the oldest messages as those buffers fill up. If I understand that correctly, the info messages are being written to the buffer and not the store, only sometimes reaching it. But also that should be modifiable with a configuration change? How could I make such change to always save info logs to the store and retrieve them?

SIGPIPE is an ongoing source of grief on Apple systems [1]. I’ve talked about it numerous times here on the forums. It cropped up again today, so I decided to collect my experiences into one post. If you have questions or comments, please put them in a new thread. Put it in the App & System Services > Core OS topic area so that I see it. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com" [1] Well, on Unix-y systems in general, but my focus is Apple systems (-: Debugging Broken Pipes On Unix-y systems, writing to a pipe whose read side is closed will raise a SIGPIPE signal. The default disposition of that signal is to terminate your process [1]. Broken pipe terminations are tricky to debug on Apple systems because the termination doesn’t generate a crash report. For example, consider this code: let (read, write) = try FileDescriptor.pipe() // This write works. try write.writeAll("Hello Cruel World!".utf8) let msg = try read.read(maxCount: 256) … do something with `msg` … // But if you close the read side… try read.close() // … the write call raises a `SIGPIPE`. try write.writeAll("Goodbye Cruel World!".utf8) Note This code relies on some extensions to FileDescriptor type that make it easier to call the pipe and write system calls. For more information about how I set that up, see Calling BSD Sockets from Swift. If you put this in an iOS app and run it outside of Xcode, the app will terminate without generating a crash report. This logic also applies to BSD Sockets. Writing to a disconnected socket may also trigger a SIGPIPE. This applies to the write system call and all the send variants: send, sendto, and sendmsg). IMPORTANT Broken pipe terminations are even more troubling with sockets because sockets are commonly used for networking, where you have no control over the remote peer. It’s easy to reproduce this signal with Unix domain sockets: let (read, write) = try FileDescriptor.socketPair(AF_UNIX, SOCK_STREAM, 0) // This write works. try write.writeAll("Hello Cruel World!".utf8) let msg = try read.read(maxCount: 256) … do something with `msg` … // But if you close the read side… try read.close() // … the write call raises a `SIGPIPE`. try write.writeAll("Goodbye Cruel World!".utf8) However, this isn’t limited to just Unix domain sockets; TCP sockets are a common source of broken pipe terminations. [1] At first blush this API design might seem bananas, but it kinda makes sense in the context of traditional Unix command-line tools. Confirm the Problem The primary symptom of a broken pipe problem is that your app terminates without generating a crash report. Unfortunately, that’s not definitive. There are other circumstances where your app can terminate without generating a crash report. For example, another common cause of such terminations is the app calling exit. There all two ways you can confirm this problem. The first relies on Xcode. Run your app in the Xcode debugger and, if it suddenly stops with the message Terminated due to signal 13, you know you’ve been terminated because of a broken pipe. IMPORTANT Double check that the signal number is 13, the value of SIGPIPE. If you can’t reproduce the problem in Xcode, look in the system log. When an app terminates the system records information about the reason. The exact log message varies from platform to platform, and from OS version to OS version. However, in the case of a SIGPIPE termination there’s usually a log entry containing PIPE or SIGPIPE, or that references signal 13. For example, on iOS 18.2.1, I see this log entry: type: default time: 11:59:00.321882+0000 process: SpringBoard subsystem: com.apple.runningboard category: process message: Firing exit handlers for 16876 with context <RBSProcessExitContext| specific, status:<RBSProcessExitStatus| domain:signal(2) code:SIGPIPE(13)>> The log message contains both SIGPIPE and the SIGPIPE signal number, 13. For more information about accessing the system log, see Your Friend the System Log. Locate the Problem Once you’ve confirmed that you have a broken pipe problem, you need to locate the source of it. That is, what code within your process is writing to a broken pipe? If you can reproduce the problem in Xcode, configure LLDB to stop on SIGPIPE signals: (lldb) process handle -s true SIGPIPE NAME PASS STOP NOTIFY =========== ===== ===== ====== SIGPIPE true true false When the process writes to a broken pipe, Xcode stops in the debugger. Look at the backtrace in the Debug navigator to find the offending write. If you can’t reproduce the problem in Xcode, one option is to add a signal handler that catches the SIGPIPE and triggers a crash. For example: #include <signal.h> static void sigpipeHandler(int sigNum) { __builtin_trap(); } extern void installSIGPIPEHandler(void) { signal(SIGPIPE, sigpipeHandler); } Here the signal handler, sigpipeHandler, forces a crash by calling the __builtin_trap function. IMPORTANT This code is in C, and uses __builtin_trap rather than abort, because of the very restricted environment in which the signal handler runs [1]. With this signal handler in place, writing to a broken pipe generates a crash report. Within that crash report, the crashing thread backtrace gives you a hint as to the location of the offending write. For example: 0 SIG-PIPETest … sigpipeHandler + 8 1 libsystem_platform.dylib … _sigtramp + 56 2 libswiftSystem.dylib … closure #1 in FileDescriptor._writeAll<A>(_:) + 100 3 libswiftSystem.dylib … partial apply for closure #1 in FileDescriptor._writeAll<A>(_:) + 20 4 libswiftSystem.dylib … partial apply for closure #1 in Sequence._withRawBufferPointer<A>(_:) + 108 5 libswiftCore.dylib … String.UTF8View.withContiguousStorageIfAvailable<A>(_:) + 108 6 libswiftCore.dylib … protocol witness for Sequence.withContiguousStorageIfAvailable<A>(_:) in conform… 7 libswiftCore.dylib … dispatch thunk of Sequence.withContiguousStorageIfAvailable<A>(_:) + 32 8 libswiftSystem.dylib … Sequence._withRawBufferPointer<A>(_:) + 472 9 libswiftSystem.dylib … FileDescriptor._writeAll<A>(_:) + 104 10 SIG-PIPETest … FileDescriptor.writeAll<A>(_:) + 28 … Note The write system call is not shown in the backtrace. That’s because the crash reporter is not backtracing correctly across the signal handler stack frame that was inserted by the kernel between frames 1 and 2 [1]. Fortunately that doesn’t matter here, because we primarily care about our code, which is visible in frame 10. I can’t see any problem with putting this code in your development build, or even deploying it to your beta testers. Think carefully before putting it in a production build that you deploy to all your users. Signal handlers are tricky [1]. [1] For all the gory details on that topic, see Implementing Your Own Crash Reporter for more information about that issue. [2] This is one of the gory details covered by Implementing Your Own Crash Reporter. Resolve the Problem The best way to resolve this problem depends on whether it’s being caused by a pipe or a socket. The socket case is easy: Use the SO_NOSIGPIPE socket option to disable SIGPIPE on the socket. Once you do that, writing to the socket when it’s disconnected will return an EPIPE error rather than raising the SIGPIPE signal. For example, you might tweak the code above like so: let (read, write) = try FileDescriptor.socketPair(AF_UNIX, SOCK_STREAM, 0) try read.setSocketOption(SOL_SOCKET, SO_NOSIGPIPE, 1 as CInt) try write.setSocketOption(SOL_SOCKET, SO_NOSIGPIPE, 1 as CInt) Note Again, this is using helpers from Calling BSD Sockets from Swift. The situation with pipes is tricky. Apple systems have no way to disable SIGPIPE on a pipe, leaving you with two less-than-ideal options: Disable SIGPIPE globally. To do this, call signal with SIG_IGN: signal(SIGPIPE, SIG_IGN) The downside to this approach is that affects the entire process. You can’t, for example, use this technique in library code. Switch to Unix domain sockets. Rather than use a pipe for your IPC, use Unix domain sockets instead. As they’re both file descriptors, it’s usually quite straightforward to make this change. The downside here is obvious: You need to modify your IPC code. That might be problematic, for example, if this IPC code is embedded in a framework that you don’t build from source.

I'm working on a cross-platform application that needs to access file attributes, specifically for files and directories in sync drives like OneDrive. On Windows, I use the GetFileInformationByHandle API to retrieve attributes such as FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS and FILE_ATTRIBUTE_RECALL_ON_OPEN to identify files that are stored remotely or in the cloud. Is there an equivalent API or mechanism on macOS to achieve the same? Specifically, I’m looking for a way to: Identify attributes similar to cloud/offline storage status for files in synced drives (e.g., OneDrive, DropBox etc). Retrieve metadata to distinguish files/folders stored locally versus those stored remotely and downloaded on access. If there’s a preferred macOS framework (like Core Services or FileManager in Swift) for such operations, examples would be greatly appreciated!

I'm working on a cross-platform application that needs to access file attributes, specifically for files and directories in sync drives like OneDrive. On Windows, I use the GetFileInformationByHandle API to retrieve attributes such as FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS and FILE_ATTRIBUTE_RECALL_ON_OPEN to identify files that are stored remotely or in the cloud. Is there an equivalent API or mechanism on macOS to achieve the same? Specifically, I’m looking for a way to: Identify attributes similar to cloud/offline storage status for files in synced drives (e.g., OneDrive, iCloud Drive). Retrieve metadata to distinguish files/folders stored locally versus those stored remotely and downloaded on access. If there’s a preferred macOS framework (like Core Services or FileManager in Swift) for such operations, examples would be greatly appreciated!

I am trying to diagnose a very strange application crash that occurs intermittently under the following conditions App built in release and installed on iPhone App is in the background (e.g. close the app and open a different app without fully force quitting it) When these conditions are present, and I re-open the application by clicking on it's icon on the home screen, the app shows briefly on the screen and then immediately quits. This happens maybe 50% of the time when these conditions are present, but it does not create a crash report and there are no jetsam reports from the time of the crash either. I was able to capture a sysdiagnose immediately after the crash (within 3 seconds), and I have reviewed the logs to help me determine a possible cause, but none of the logs seem to be causing it. I am putting some potentially relevant log lines below, and I am attaching the logarchive. Additionally, the entire application is open source here on github, and the crashing :( version of the app is available here on the app store. Note this crash does not happen in the macOS version. Finally, I saw a previous thread that recommended adding atexit {abort()} to an app that doesn't produce a crash report, so I added that here before collecting these logs and I still don't get a crash report. Here are some log lines may be relevant, but none of them provide a reason for app termination. >>> MY APP IS OPENED default 2025-01-25 13:16:11.060118 -0500 runningboardd com.apple.runningboard monitor Calculated state for app<com.msdrigg.roam(95D1E2E9-9609-44D9-A30A-0C4AEA990A0D)>: running-active (role: UserInteractiveFocal) (endowments: <private>) default 2025-01-25 13:16:11.060132 -0500 runningboardd com.apple.runningboard process [app<com.msdrigg.roam(95D1E2E9-9609-44D9-A30A-0C4AEA990A0D)>:1758] Set jetsam priority to 100 [0] flag[1] default 2025-01-25 13:16:11.060132 -0500 runningboardd com.apple.runningboard ttl [app<com.msdrigg.roam(95D1E2E9-9609-44D9-A30A-0C4AEA990A0D)>:1758] Resuming task. default 2025-01-25 13:16:11.060185 -0500 runningboardd com.apple.runningboard ttl [app<com.msdrigg.roam(95D1E2E9-9609-44D9-A30A-0C4AEA990A0D)>:1758] Set darwin role to: UserInteractiveFocal info 2025-01-25 13:16:11.062002 -0500 CommCenter com.apple.CommCenter ul BundleID: com.msdrigg.roam is a foreground app >>> XPC says something about XPC_ERROR_CONNECTION_INTERRUPTED com.apple.mDNSResponder Default [R9386->Q40264] Question assigned DNS service 125 default 2025-01-25 13:16:11.067097 -0500 Roam com.apple.xpc connection [0x300b94900] Re-initialization successful; calling out to event handler with XPC_ERROR_CONNECTION_INTERRUPTED default 2025-01-25 13:16:11.067152 -0500 Roam com.apple.runningboard monitor Received state update for 1758 (app<com.msdrigg.roam(95D1E2E9-9609-44D9-A30A-0C4AEA990A0D)>, unknown-NotVisible info 2025-01-25 13:16:11.068357 -0500 Roam com.apple.coreaudio >>>MY APP RUNS AND STARTS LOGGING ON ITS OWN default 2025-01-25 13:16:11.109376 -0500 Roam com.msdrigg.roam ECPWebsocketClient Clearing handlers default 2025-01-25 13:16:11.109378 -0500 Roam com.msdrigg.roam ECPWebsocketClient No longer in error b/c restarting default 2025-01-25 13:16:11.109419 -0500 Roam com.msdrigg.roam ECPWebsocketClient Ignoring state change because it is the same connecting at 2025-01-25 18:16:11 +0000 >>> XPC Connection invalidated default 2025-01-25 13:16:11.146441 -0500 runningboardd com.apple.runningboard process XPC connection invalidated: [app<com.msdrigg.roam(95D1E2E9-9609-44D9-A30A-0C4AEA990A0D)>:1758] >>> Launchd reports app exit default 2025-01-25 13:16:11.150861 -0500 launchd user/501/UIKitApplication:com.msdrigg.roam[6159][rb-legacy] [1758] exited due to SIGPIPE | sent by Roam[1758], ran for 4930203ms default 2025-01-25 13:16:11.150876 -0500 launchd user/501/UIKitApplication:com.msdrigg.roam[6159][rb-legacy] [1758] service state: exited Logs split due to size being too big :( roam-crash.1.log roam-crash.2.log roam-crash.3.log roam-crash.4.log roam-crash.5.log roam-crash.6.log

On my Apple Silicon MacMini, hidutil list does not list the connected Atmel-ICE (a hardware debugger from Microchip). On my Intel Mac, it does. And both run Sonoma. It is also enumerated as a HID device on the Linux and the Windows virtual machine running on the MacMini. So, this looks like a bug to me.

Hello, I am working on a Flutter application where I need to use Bluetooth Low Energy (BLE) in Peripheral mode to advertise data even when the app is in the background (or when the screen is turned off) on iOS devices. I am using the package flutter_ble_peripheral to handle BLE advertising and peripherals. My goal is to make sure that the BLE advertising continues running when the app is minimized or in the background. Here is what I have already done: Added the required Bluetooth permissions in Info.plist. Enabled Background Modes in Xcode (with Bluetooth LE Accessories enabled). Used the FlutterBlePeripheral.start() method to start advertising. However, when I minimize the app or turn off the screen, the BLE advertising seems to stop. I have ensured that the app is not terminated but still the advertising is not persistent. I would like to confirm whether flutter_ble_peripheral works reliably in the background on iOS, or if there are any additional configurations or limitations I need to consider to ensure that advertising continues in the background. Any insights or experiences would be greatly appreciated. Thanks!

Description: The issue with USB FAT32 is seen in Sequoia OS. Most of the times issue is seen when FAT32 USB is mounted along with other USBs like XFAT. The scenario is where USB mounting is monitored using Endpoint Security framework event ES_EVENT_TYPE_AUTH_MOUNT and when event is received, it will be denied for mounting is it is in read-write mode. And, program tries to mount the USB in read-only mode. Steps to Reproduce: Use the xcode program (which will be sent) for testing. Run the executable on macos having Sequoia OS. start executing the binary after successful compilation. Make sure it's running. Take 2 USB drives one with FAT32 and another one with XFAT. Try to mount the USBs and watch the logs on the terminal where the binary is running. We can see, the USB mounting in read-only mode fails for FAT32 where as it passes for other USB. The issue with mounting is not seen always, but, seen when more than 1 USB mounted and FAT32 we see most of the times. Once the mounting fails for the USB, we keep seeing this issue if we try to mount the USB using command line or any other way, until we remove the device and reconnect it. #include <EndpointSecurity/EndpointSecurity.h> #include <bsm/libbsm.h> #include <iostream> #include <os/log.h> #define MAX_THREADS_LIMIT 64 es_client_t *g_client = nullptr; dispatch_queue_t dispatchQueue; static std::atomic<int> m_numThreads; bool mountVolumeCommandLine(const std::string diskPath, const bool &isReadOnly) { std::string command(""); const std::string quote = "\""; if(isReadOnly) { command = "diskutil mount readOnly "+ quote + diskPath + quote; } else { command = "diskutil mount "+ quote + diskPath + quote; } FILE *mount = popen(command.c_str(), "r"); if (mount == NULL) { os_log_error(OS_LOG_DEFAULT, "Failure!! mounting of %{public}s failed using command = %{public}s", diskPath.c_str(),command.c_str()); return false; } else { std::string result = ""; os_log(OS_LOG_DEFAULT, "successful!! executed mount for %{public}s using command = %{public}s ",diskPath.c_str(), command.c_str()); } pclose(mount); return true; } void handleEvents(const es_message_t *msg) { m_numThreads++; switch(msg->event_type) { case ES_EVENT_TYPE_AUTH_MOUNT: { std::string diskPath = msg->event.mount.statfs->f_mntfromname; std::string volumePath = msg->event.mount.statfs->f_mntonname; mountVolumeCommandLine(diskPath, true); break; } default: break; } m_numThreads--; } bool sendAuthResponse(const es_message_t *msg, const es_auth_result_t &result) { es_respond_result_t res = es_respond_auth_result(g_client, msg, result, false); if (res != ES_RESPOND_RESULT_SUCCESS) { os_log_error(OS_LOG_DEFAULT, "SampleEndpointSecurity Failed to respond to auth event error"); return false; } return true; } int createESClient(const es_handler_block_t &handler) { dispatchQueue = dispatch_queue_create("com.test.es_notify", DISPATCH_QUEUE_SERIAL); dispatch_set_target_queue(dispatchQueue, dispatch_get_global_queue(QOS_CLASS_BACKGROUND, 0)); while(1) { es_new_client_result_t res = es_new_client(&g_client, handler); if(ES_NEW_CLIENT_RESULT_SUCCESS != res) { g_client = nullptr; std::cout<<"client creation failed"<<std::endl; if(ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED == res) { os_log_error(OS_LOG_DEFAULT, "SampleEndpointSecurity ESClient creation Error: Program requires proper entitlement"); sleep(300); } else if(ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED == res) { os_log_error(OS_LOG_DEFAULT,"SampleEndpointSecurity ESClient creation Error: Program needs proper permission for using ESClient"); } else { os_log_error(OS_LOG_DEFAULT,"SampleEndpointSecurity ESClient creation Error: %d", res); } return 1; } else { break; } } es_clear_cache_result_t resCache = es_clear_cache(g_client); if(ES_CLEAR_CACHE_RESULT_SUCCESS != resCache) { os_log_error(OS_LOG_DEFAULT, "\n SampleEndpointSecurity es_clear_cache: %d\n", resCache); return 1; } return 0; } int main() { es_handler_block_t handler = ^void(es_client_t * _Nonnull, const es_message_t * _Nonnull msg){ bool processEvent = false; if(!msg->process->is_es_client) { switch(msg->event_type) { case ES_EVENT_TYPE_AUTH_MOUNT: { std::string diskPath = msg->event.mount.statfs->f_mntfromname; std::string volumePath = msg->event.mount.statfs->f_mntonname; long flags = msg->event.mount.statfs->f_flags; if(flags & MNT_RDONLY) { os_log(OS_LOG_DEFAULT, "ALLOW readOnly mount event for volumePath= %{public}s and diskPath=%{public}s", volumePath.c_str(), diskPath.c_str()); sendAuthResponse(msg, ES_AUTH_RESULT_ALLOW); } else { os_log(OS_LOG_DEFAULT, "DENY the mount event for volumePath=%{public}s and diskPath=%{public}s", volumePath.c_str(), diskPath.c_str()); sendAuthResponse(msg, ES_AUTH_RESULT_DENY); processEvent = true; } break; } default: { os_log(OS_LOG_DEFAULT,"SampleEndpointSecurity default case event_type: (%d)", msg->event_type); break; // Not interested } } if(processEvent && m_numThreads.load() < MAX_THREADS_LIMIT) { es_retain_message(msg); dispatch_async(dispatchQueue, ^{ handleEvents(msg); es_release_message(msg); }); } } }; if(createESClient(handler) == 1) { return 1; } es_event_type_t events[] = {ES_EVENT_TYPE_AUTH_MOUNT }; es_return_t subscribed = es_subscribe(g_client, events, // Count of es_event_type_t entries stored in events[] sizeof(events) / sizeof(es_event_type_t) ); if(ES_RETURN_ERROR == subscribed) { os_log_error(OS_LOG_DEFAULT, "SampleEndpointSecurity es_subscribe: ES_RETURN_ERROR\n"); return 1; } dispatch_main(); return 0; }

Hi, I’m currently working on a project to sanitize data (Remove customer data) on MacBook storage devices (Refurbish). The NVMe SSD is embedded on the motherboard. I’ve created a simple proof-of-concept code (Running in terminal) with the following steps: Check and Match the NVMe Device: Verify that the physical drive (disk0) exists on the system. Open the Connection: Establish a connection to the device (disk0). Send NVMe Admin Commands: For testing, I sent the IDENTIFY (0x06) command to confirm that the connection to the device works. Close the Service and Connection: Terminate the connection after the test. However, during runtime, I encountered an error when sending the command: Error: Failed to send NVMe Admin Command with error: -536870206 ((iokit/common) invalid argument) I’m unsure why this results in an "Invalid argument" error. Is the method I’m using to send the Admin Command incorrect? If so, what is the proper function call to use in the IOKit framework? Alternatively, are there any other recommended methods to achieve this? In the future, I also need to send commands like ‘Sanitize (84h)’ and ‘Format NVM (80h).’ Since I’m new to macOS development, I’d greatly appreciate any advice or guidance from experts in this area. I have attached the source code and related ioreg file for 'IOMedia' and 'IONVMeController' for you guy reference. IOMedia IONVMeController sendAdminCommands.cpp Thank you so much for your help! Regards, Winson

Is this always possible using systemextensionsctl by root? Is there a way to prevent root from removing an Endpoint Security Extension? The use case is for a Mac managed by AirWatch.

[ERROR:flutter/runtime/dart_vm_initializer.cc(41)] Unhandled Exception: PlatformException(reactive_ble_mobile.Central.(unknown context at $1013cc3b4).Failure:1, The operation couldn’t be completed. (reactive_ble_mobile.Central.(unknown context at $1013cc3b4).Failure error 1.), {}, null) #0 StandardMethodCodec.decodeEnvelope (package:flutter/src/services/message_codecs.dart:648:7) #1 MethodChannel._invokeMethod (package:flutter/src/services/platform_channel.dart:334:18) #2 ReactiveBleMobilePlatform.discoverServices. (package:reactive_ble_mobile/src/reactive_ble_mobile_platform.dart:290:15) #3 BleDeviceInteractor.discoverServices (package:ssss/pages/src/ble/ble_device_interactor.dart:47:22) #4 _DeviceInteractionTabState.discoverServices (package:ssss/pages/machines/satellite/device_interaction_tab.dart:283:20)

I'm trying to diagnose an issue with a Message Filtering Extension not working. The associated domain for the server is not currently publicly hosted, so the associated domains specified for the app are postpended with ?mode=developer On application installation I filtered OS logging by the swcd process and saw this logged: debug 08:40:01.125071-0800 swcd Skipping domain vz….qa….cl….ce….com?mode=developer because developer mode is disabled But developer mode IS enabled on the phone (Settings/Privacy &amp; Security/Developer Mode is set to On). Therefore why is swcd saying developer mode is disabled? Is the developer mode mentioned in the documentation not actually the Developer Mode in the iPhone's setting but something else? That wouldn't appear to be the case because the documentation explicitly states "Specifies that only devices in developer mode can access the domain." Full Documentation: https://developer.apple.com/documentation/BundleResources/Entitlements/com.apple.developer.associated-domains If you use a private web server, which is unreachable from the public internet, while developing your app, enable the alternate mode feature to bypass the CDN and connect directly to your server. To do this, add a query string to your associated domains entitlement, as shown in the following example: :?mode= developer Specifies that only devices in developer mode can access the domain. So I've: turned developer mode on for the device have added ?mode=developer to the domain am building/running using a developer certificate. But why does swcd log that developer mode is disabled?

Hi, I’m able to view the activity log using the macOS application integrated with Endpoint Security Entitlement in Xcode by setting Debug Process As: root. However, after archiving the application into a .app using a Developer ID Application certificate and sending it to my friend, they encountered the error ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED during client initialization when running the application. Could you please guide me on how to resolve this issue? Specifically, what is the correct technical approach to make the application run as root? Thanks