MIA: SecTranslocate

August 16, 2016

I guess I'm the App Translocation Dude. So be it. That makes me a "C" celebrity, and gets me into all the cool hackathons.

In my last post I talked about how to check for App Translocation without using the 10.12 SDK. This subject was more timely than I was aware at the time. An unnamed source — because I'm too lazy to ask for permission to name the source — has informed me that <Security/SecTranslocate.h> is missing in the latest Xcode 8 beta. Another unnamed source — ok, Google — subsequently informed me that the header was apparently removed back in Xcode 8b2: https://github.com/xamarin/xamarin-macios/wiki/Security-macOS-Beta2.

Nonetheless, App Translocation continues to occur in the latest macOS Sierra beta 6. Therefore, we're faced with the odd situation where App Translocation affects our apps, but there's no supported way to detect it, not even with the latest SDK. It's unclear how this situation can be tenable. As we've seen, though, Apple works in mysterious ways. Thankfully, the SecTranslocate symbols still exist in the Security.framework binary, so the technique explained in my last blog post continues to work. The Dude abides.