Description

This tool (hack) does not work on systems with M1 processors.

Attempting to launch the application results in...nothing.

Attempting to call the launch script directly results in a Killed: 9 error. Example (custom wrapped for legibility):

/Applications/Firefox-CustomRed.app/Contents/MacOS/firefox-customred: line 5: 63742 Killed: 9
    /Applications/Firefox-CustomRed.app/Contents/MacOS/firefox \
        -no-remote \
        --profile '/Users/username/Library/Application Support/Firefox/Profiles/firefox-customred'

Troubleshooting

UPX compressed binary contains an invalid Mach-O header

Many search results for "killed: 9" point to UPX being the issue:

• terminal - How to fix "Killed: 9" error in mac os? - Ask Different
• applications - "This UPX compressed binary contains an invalid Mach-O header and cannot be loaded." - Ask Different

However, the source application's (Firefox.app) firefox binary works without issue so we know this is not the cause.

Codesigning Required

The following gives a hint (Big Sur on ARM M1 processor requires all code to be validly signed):

• Trev comment - macos - Mac M1 cping binary over another results in crash - Stack Overflow:

  Whenever you update a signed file, you need to create a new file.

  Specifically, the code signing information (code directory hash) is hung off the vnode within the kernel, and modifying the file behind that cache will cause problems. You need a new vnode, which means a new file, that is, a new inode. Documented in WWDC 2019 Session 703 All About Notarization - see slide 65.

  This is because Big Sur on ARM M1 processor requires all code to be validly signed (if only ad hoc) or the operating system will not execute it, instead killing it on launch.

  answered May 4, 2021 at 11:20
  Trev

  • All About Notarization - WWDC19 - Videos - Apple Developer
  • All About Notarization | WWDC NOTES

Valid Signature Example

For Firefox 107.0.1

Command:

codesign -dvvvv /Applications/Firefox.app

Output:

Executable=/Applications/Firefox.app/Contents/MacOS/firefox
Identifier=org.mozilla.firefox
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=863 flags=0x10000(runtime) hashes=18+5 location=embedded
VersionPlatform=1
VersionMin=720896
VersionSDK=721664
Hash type=sha256 size=32
CandidateCDHash sha256=9ab66d2a015d58dbbb0f73aec37e6bd5f1e9d338
CandidateCDHashFull sha256=9ab66d2a015d58dbbb0f73aec37e6bd5f1e9d338ed2c393ddae01bd4716fedbd
Hash choices=sha256
CMSDigest=9ab66d2a015d58dbbb0f73aec37e6bd5f1e9d338ed2c393ddae01bd4716fedbd
CMSDigestType=2
Page size=4096
Launch Constraints:
	None
CDHash=9ab66d2a015d58dbbb0f73aec37e6bd5f1e9d338
Signature size=8988
Authority=Developer ID Application: Mozilla Corporation (43AQ936H96)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Nov 28, 2022 at 08:31:23
Info.plist entries=25
TeamIdentifier=43AQ936H96
Runtime Version=11.3.0
Sealed Resources version=2 rules=13 files=80
Internal requirements count=1 size=188

Potential Solutions / Workarounds

Pseudo-Signing

Code Signing · Cydia:

Option #2: Pseudo-Signing

For me, the previous option just doesn't work. I do not use Macs to do my development and the entire codesign path requires not only a Mac but console access because codesign is, at some level, a graphical utility (the way it uses Keychain to get the signatures may prompt, with dialogs, for passwords). To get around this, I wrote a tool called ldid that, among other things, can generate the SHA1 hashes that are checked by Apple's iPhoneOS kernel. This tool is easily installed on the iPhone using Cydia or APT.

The tool can also be easily installed on macOS via brew install ldid.

1. brew install ldid
2. Run motleyfox.sh with desired options. Example:

   ./motleyfox.sh CustomRed:red CustomBlue:blue

3. Update signature on firefox binary in generated application bundles. Example:

   ldid -S /Applications/Firefox-CustomRed.app/Contents/MacOS/firefox
   ldid -S /Applications/Firefox-CustomBlue.app/Contents/MacOS/firefox

Additional Information

• ldid
  • ldid - iPhone Development Wiki
• Quarantine
  • macos - Disable the use of the "com.apple.quarantine" extended attribute on Mojave - Ask Different
  • Deploying Firefox Customizations on macOS | Firefox for Enterprise Help: Step 2: Remove quarantine set by macOS
• spctl – SecAssessment system policy security
  • macos - Forcing open command to open unsigned app? - Ask Different
  • Cannot verify app with spctl after successfully codesigning | Apple Developer Forums

Consider using PlistBuddy instead of sed

• What is PlistBuddy?. PlistBuddy is mac build-in program… | by Mark | Medium