When I run the strings command on the executable file in most OS X apps (•.app/Contents/MacOS/•), I get a list of routine names, possible hidden preferences, etc. When I run the command on the Dock executable, I get garbage. What makes the Dock executable different from most other Mac programs?

  • 1
    Might be encrypted, compressed, stripped, obfuscated. – Max Ried Aug 1 '12 at 15:46
  • The same thing also happens with the executables for a few other applications like Finder, Safari, and Transmit. I don't know why they are different, but based on @Chealion's comment at 10.6: No more easily-found hidden preferences - Mac OS X Hints it's probably not at least because of HFS+ compression. – Lri Aug 1 '12 at 16:04

This is because many OS X binaries are encrypted. They are decrypted in real time by the “Don’t Steal Mac OS X.kext” in your /System/Library/Extensions. I don’t know why Apple does it. The Get Info string of the file:

The purpose of this Apple software is to protect Apple copyrighted materials from unauthorized copying and use. You may not copy, modify, reverse engineer, publicly display, publicly perform, sublicense, transfer or redistribute this file, in whole or in part. If you have obtained a copy of this Apple software and do not have a valid license from Apple to use it, please immediately destroy or delete it from your computer.


It is very common to compress and strip down a program that is an essential part of the system and runs all the time.

Strings are left in for ease of debugging, but take up extra space that the computer does not need when running. It always is a trade off to decide whether to strip debugging information from an executable but in this case (or in the kernel or other core functions) can serve to optimize the execution speed whether or not it makes it slightly harder to debug issues or poke at the innards of a program.

We likely won't know the reason why this was done, but it is common practice to sample apps over time and select the ones that use the most of the CPU time so that you only optimize code that requires it as opposed to optimizing it all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .