2

If you didn't know macOS has a well hidden directory called "/AppleInternal" that is pretty secretive. It's not possible to ls or rm it and I've never seen it referenced before with anything other than fs_usage, where it was being listed frequently as /AppleInternal or /AppleInternal>>>>>>>>>>>>>> with usually between 5 and 20 >.

Thought it was some reference to something other than a directory but the / before AppleInternal made me wonder and google has an article about how to enable it, which apparently added some hidden features to Xcode.

I booted into recovery and used mkdir (you aren't allowed to do it outside of recovery mode) and there is now a folder with that name but its empty. fs_usage no longer makes any reference to /AppleInternal and ls shows the created date as when I used mkdir. Seems like a questionable use if it could just be done away with once discovered as well as be hidden so well and referenced so frequently prior to adding my own.

Seems like a fairly good place to hide malware really.

I found a single, vague reference to AppleInternal in all of the man pages. It's in ani (Apple Net Install) which says AppleInternal and AppleInternalAssistant are both dmg image types.

So does anyone have any idea how it is able to hide so well or have any additional information on its true purpose?

closed as too broad by fsb, Allan, IconDaemon, David Anderson, Ɱark Ƭ Mar 1 '18 at 0:26

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • When having it, the iOS simulator launches with a hidden “internal” menu which allows you to change some internal settings... – Harcker Feb 27 '18 at 18:03
  • Yeah, thanks. I mentioned that in my question. That'd be after one makes one themselves. I get that. I'm asking how is it that ls or rm can't see it but fs_usage can (before I ever made one or heard of it)? – David Smith Feb 27 '18 at 21:56
2

It is not really a "hidden" directory or "secretive" in any way.

It is simply that some Apple employees have use a folder with this specific name when testing/using prototype or in-development software on iOS and macOS. The idea is to store testing tools and other files that are not meant to be in the software meant for customers.

The technical concept here is that the contents of that folder is combined with the "ordinary" file system (sort of like an overlay). So if you want to add something to /System/Library/ for testing, but don't want to do it in the "real" software - you could add it to /AppleInternal/System/Library/ instead - and get the same effect.

The folder does not exist unless it is actively created. Therefore the folder is not hidden - it is simply not there on an ordinary installation of macOS.

When you run Xcode, which is meant for developers, it will check if this folder exists - and then for example the iOS simulator will have a few extra options, that are primarily meant for Apple employees. This could be for example features that haven't been tested well enough to be exposed to customers.

The AppleInternal folder has been well-known by non-Apple employees for years - so it is not a new discovery.

  • If it doesn't exist unless it is actively created, then how do you explain fs_usage referring to is so much before I made a directory with the same name then never referring to it again after? – David Smith Feb 27 '18 at 21:51
  • 1
    Quite easy. fs_usage outputs any system calls related to file usage - no matter if the file or folder exists at all! Therefore when for example Xcode checks for the existence of the AppleInternal folder, you'll see that in fs_usage. When a program has detected that a specific folder exists, it doesn't have to query the file system anymore but can just remember (i.e. by storing in memory or in a configuration file or similar) that your system is "AppleInternal". Thus ending the system calls referring to the folder. – jksoegaard Feb 27 '18 at 23:39
  • Interesting. Thanks. Do you have any idea what the >>>>>>>>>>>> of various lengths following it might mean? – David Smith Feb 28 '18 at 3:23
  • Nope, but it does happen for various other things than AppleInternal as well - so it is a generic thing. The man page for fs_usage at first glance doesn't seem to indicate what it means. You could look at the fs_usage or Darwin source to find out what it is. – jksoegaard Feb 28 '18 at 10:16

Not the answer you're looking for? Browse other questions tagged .