To edit TrashIcon.icns using hex editor to get access to the dark icons

Question

In /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources there is a file TrashIcon.icns. Alexander O'Mara, a guy who is a security expert at Mastercard discovered that this file contains not only "bright" icons but also "dark" ones. But to get access to the dark ones, you need to modify the file using a hex editor.

I never worked with hex editors and the instructions he gave are not very clear to me.

Alexander: I don't know of any existing tools, but it's pretty simple. Find the chunk inside TrashIcon.icns named FD D9 2F A8, copy it, and overwrite FD D9 2F A8 with icns. That will make it a valid icns file. From there you can extract the individual icons from the dark icns file using a tool like iconutil.

Me: Many thanks. But I'm not sure I understand the first part. [...]

Alexander: I'd recommend making a copy of the icns file, finding FD D9 2F A8, selecting all the hex on the left that comes before it, deleting it, then on the right side overwrite the first 4 bytes with icns, and save.

https://github.com/Ji4n1ng/OpenInTerminal/issues/211

I still don't understand how to "overwrite the first 4 bytes with icns", despite I'm not computer- or programming-illeterate person. Could you explaint it to me? An animated GIF will probably be the best option.

Answer 1

On Ventura, the indicated marker is at offset 0x12b1e0 in that file. Probably close to the same offset in the Sonoma version of the file.

So use dd to cut the part before the marker off...

$ dd bs=1 skip=0x12b1e0 if=TrashIcon.icns of=tempfile     
939131+0 records in
939131+0 records out
939131 bytes transferred in 3.979716 secs (235979 bytes/sec)

Then use the hex editor of your choice to patch the first four bytes. I used qemacs.

Before:

00000000  fd d9 2f a8 00 0e 54 7b  69 63 31 32 00 00 10 fe   ýÙ/¨..T{ic12...þ 
00000010  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52   .PNG........IHDR 

And after:

00000000  69 63 6e 73 00 0e 54 7b  69 63 31 32 00 00 10 fe   icns..T{ic12...þ 
00000010  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52   .PNG........IHDR   

And now it's an icon file again.

$ file tempfile 
tempfile: Mac OS X icon, 939131 bytes, "ic12" type

Answer 2

The OP's question implies the use of a hex editor. User Marc Wilson has pointed out in a comment that "… macOS does include at least one hex editor, that being xxd, and one binary-safe application that can be used as one, that being vim." Additionally, third party hex editors do also exist, as shown in the answer by Marc Wilson.

This answer demonstrates how to make the necessary changes without relying on any hex editors or third party tools. Since I do not currently have access to Sonoma, I will be using Ventura 13.3.1 (a).

Note: This answer assumes grep version 2.6.0-FreeBSD is being used, which is included with macOS Monterey through at least macOS Sonoma. In this case, the previous grep version 2.5.1-FreeBSD will not work properly, which is included with macOS Big Sur down to at least Mac OS X Snow Leopard.

The commands below copy the TrashIcon.icns file to my Desktop.

cd ~/Desktop
cp /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/TrashIcon.icns .

Next, use the commands below to determine where the first occurrence of the FD D9 2F A8 byte sequence is in the TrashIcon.icns file. In both bash and zsh, the byte sequence can be represented as the $'\xFD\xD9\x2F\xA8' string. Basically, each byte is preceded by \x and the result is preceded by $' and succeeded by '. (For an explanation of the use of the commands, see this answer.)

(export LC_ALL=C BS=$'\xFD\xD9\x2F\xA8'; cat TrashIcon.icns | tr -c "$BS" '\n' | grep -aoFbm1 "$BS" | sed 's/:.*//')

The output from the above commands is shown below. This output shows the byte sequence starts at offset 1225184.

1225184

The next command copies the TrashIcon.icns file starting at offset 1225184 to the tempfile file. (Note: 1225184=0x12b1e0)

dd bs=1 skip=1225184 if=TrashIcon.icns of=tempfile

The output from the above command is shown below.

939131+0 records in
939131+0 records out
939131 bytes transferred in 3.128151 secs (300219 bytes/sec)

The next command replaces the first 4 bytes the tempfile file with the 4 byte ASCII character string icns.

echo -n "icns" | dd bs=1 of=tempfile conv=notrunc

---

The command below shows the hexadecimal and ASCII values for the first 32 bytes of the tempfile file. Note: Non‑printable ASCII and non‑ASCII values are shown as the . character.

hexdump -Cv -n 32 tempfile

The output from the above command is shown below. The hexadecimal values are the same as shown in the answer by Marc Wilson.

00000000  69 63 6e 73 00 0e 54 7b  69 63 31 32 00 00 10 fe  |icns..T{ic12....|
00000010  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
00000020

The command below can be used to show tempfile is an icon file.

file tempfile

The output from the above command is shown below.

tempfile: Mac OS X icon, 939131 bytes, "ic12" type

Answer 3

The value of icns in ascii is 69 63 6e 73, so you would write those values to a copy of the file in place of FD D9 2F A8 after doing the modification suggested to delete the contents to the left of FD D9 2F A8

Answer 4

Mike's answer is probably correct, but I found a quicker way.

1. Download icon_records, by Brielle Harrison, from https://github.com/nyteshade/icon_record_extractor (or read the code and compile it yourself...)

2. chmod +x icon_records to allow Terminal to treat it as an executable

3. ./icon_records TrashIcon.icns dark

that's it