Skip to content

Instantly share code, notes, and snippets.

View brunerd's full-sized avatar

Joel Bruner brunerd

View GitHub Profile
@brunerd
brunerd / dumpMDMProfilesAsJSON
Created October 5, 2026 21:45
Dumps MDM profile contents as JSON
#all MDM profiles output as JSON, date and data are coerced to string types
sudo /usr/bin/profiles -P -o stdout-xml | sed '$d' | sed -e $'s/^[ \t]*//g;s/[ \t]*$//g' -e "s/date>/string>/g; s/data>/string>/g" | tr -d $'\n' | plutil -convert json -r -o - -
@brunerd
brunerd / key names.sh
Created September 30, 2024 18:48
Get key names (top level or all) from a plist
file="example.plist"
#ensures plist data is ASCII not binary
PLISTDATA=$(defaults export "${file}" -)
## get TOP LEVEL key names from a plist
#xmllint method .007s
#variable
xmllint --xpath "/plist/dict/key/text()" - <<< "${PLISTDATA}"
@brunerd
brunerd / PrivateMACAddressMode
Last active September 28, 2024 19:41
Get the per-network Private MAC Address Mode new for Sequoia
#get network SSID (can take hella long time ~6s but Sequoia broke networksetup -getairportnetwork method)
#https://snelson.us/2024/09/determining-a-macs-ssid-like-an-animal/
SSID=$(system_profiler -detailLevel basic SPAirPortDataType | awk '/Current Network Information:/ { getline; print substr($0, 13, (length($0) - 13)); exit }')
#find the pref in com.apple.wifi.known-networks, possible values are: off, static, rotating
PrivateMACAddressMode=$(/usr/libexec/PlistBuddy -c "print :wifi.network.ssid.'${SSID}':PrivateMACAddressModeUserSetting" /Library/Preferences/com.apple.wifi.known-networks.plist)
@brunerd
brunerd / jamflog.function
Last active September 26, 2024 18:00
a way to log to stdout and /var/log/jamf.log (or elsewhere) and have it match Jamf's log style
# jamflog - Copyright (c) 2021 Joel Bruner, Licensed under the MIT License
# a way to log to stdout and /var/log/jamf.log (or elsewhere) and have it match Jamf's log style
##NOW MULTI-LINE an MULTI-MODE (parameter or PIPED)
function jamflog(){
#unset xtrace if enabled to quiet this function
[ -n "${-//[^x]/}" ] && { local xTrace=1; set +x; } &>/dev/null
#take input either as a parameter or piped in
if [ -n "${1}" ]; then local input="${1}"; elif [ ! -t '0' ]; then local input=$(cat); else return; fi
#default destination is override-able
@brunerd
brunerd / inZoomMeeting.sh
Created February 15, 2022 04:14
Simple shell script function to determine if a Zoom meeting is in progress
#!/bin/sh
#inZoomMeeting (20220214) Copyright (c) 2021 Joel Bruner (https://github.com/brunerd)
#Licensed under the MIT License
function inZoomMeeting {
#if this process exists, there is a meeting, return 0 (sucess), otherwise 1 (fail)
pgrep "CptHost" &>/dev/null && return 0 || return 1
}
if inZoomMeeting; then
@brunerd
brunerd / kcpasswordDecode.sh
Last active August 24, 2026 21:03
De-obfuscates macOS /etc/kcpassword file used for automatic login
#!/bin/bash
#kcpasswordDecode (20260824) Copyright (c) 2021 Joel Bruner (https://github.com/brunerd)
#Licensed under the MIT License
#specify a file as input, will default to standard location
#kcpasswordDecode.sh /etc/kcpassword
#given a filepath XOR to the it back and truncate padding
function kcpasswordDecode() (
filepath="${1:-/etc/kcpassword}"
@brunerd
brunerd / kcpasswordEncode.sh
Last active November 10, 2025 15:43
Encode a string for use in macOS /etc/kcpassword using shell, printf, sed, awk and xxd
#!/bin/bash
#kcpasswordEncode (20220610) Copyright (c) 2021 Joel Bruner (https://github.com/brunerd)
#Licensed under the MIT License
#given a string creates data for /etc/kcpassword
function kcpasswordEncode () (
#ascii string
thisString="${1}"
@brunerd
brunerd / kcpasswordEncode_perl.sh
Created August 24, 2021 04:32
Encode password for macOS /etc/kcpassword (does not handle blank passwords)
#!/bin/bash
function kcpasswordEncode_perl {
local PASSWORD="${1}";
#one-liner variation of Gavin Brock's kcpassword.pl
perl -ne 'sub kcpassword_xor { my ($pass)=@_; my @key=qw( 125 137 82 35 210 188 221 234 163 185 31 ); my $key=pack "C*", @key; my $key_len=length $key; for (my $n=0; $n<length($pass); $n+=$key_len) { substr($pass,$n,$key_len) ^= $key; }; return $pass; }; $userinput = $_; chomp ($userinput); print(kcpassword_xor($userinput));' <<< "${PASSWORD}"
}
kcpasswordEncode_perl "${1}"
@brunerd
brunerd / CFAbsoluteTime_Unix_Epoch.sh
Created August 2, 2021 23:44
Working with CFAbsoluteTime and epoch time in shell
#work with CFAbsoluteTime in shell
#https://developer.apple.com/documentation/corefoundation/cfabsolutetime
#https://developer.apple.com/documentation/corefoundation/1543542-cfabsolutetimegetcurrent
#get epoch time for CFAbsoluteTime 0 (978307200)
#same as the constant kCFAbsoluteTimeIntervalSince1970 in https://github.com/opensource-apple/CF/blob/master/CFDate.c
/bin/date -j -f "%b %d %T %Z %Y" "Jan 1 00:00:00 GMT 2001" "+%s"
#Now in CFAbsoluteTime
echo $(( $(date +"%s") - 978307200 ))
@brunerd
brunerd / macOSScreenLockDetection.sh
Created March 20, 2021 16:46
Detect the macOS CoreGraphics Screen Lock status of the console user via ioreg
#!/bin/sh
#Joel Bruner (https://github.com/brunerd)
function screenIsLocked { [ "$(/usr/libexec/PlistBuddy -c "print :IOConsoleUsers:0:CGSSessionScreenIsLocked" /dev/stdin 2>/dev/null <<< "$(ioreg -n Root -d1 -a)")" = "true" ] && return 0 || return 1; }
function screenIsUnlocked { [ "$(/usr/libexec/PlistBuddy -c "print :IOConsoleUsers:0:CGSSessionScreenIsLocked" /dev/stdin 2>/dev/null <<< "$(ioreg -n Root -d1 -a)")" != "true" ] && return 0 || return 1; }
if screenIsLocked; then
echo "Screen locked"
fi