SHARE
TWEET

Enumerate All User Login Items

applehelpwriter Jun 17th, 2019 (edited) 161 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #######################
  2. -->> ABOUT
  3. #######################
  4. (*
  5.  
  6. Phil Stokes  
  7. https://www.sentinelone.com/blog/how-malware-persists-on-macos
  8. 2019
  9.  
  10.  
  11.  
  12.  
  13. *)
  14. #######################
  15. -->> DESCRIPTION
  16. #######################
  17. (*
  18.  
  19. Run this script in an AppleScript editor to
  20. enumerate all Login Items currently set for the user.
  21. For macOS 10.13 or higher.
  22.  
  23.  
  24. *)
  25.  
  26. use AppleScript version "2.4"
  27. use scripting additions
  28. use framework "Foundation"
  29.  
  30. #  classes, constants, and enums used
  31. property NSPropertyListMutableContainersAndLeaves : a reference to 2
  32. property NSData : a reference to current application's NSData
  33. property NSPropertyListSerialization : a reference to current application's NSPropertyListSerialization
  34. property NSArray : a reference to current application's NSArray
  35. property NSURL : a reference to current application's NSURL
  36. property NSString : a reference to current application's NSString
  37.  
  38. -- check we're on 10.13 or higher
  39. set v to AppleScript's version as number
  40. if v is greater than 2.6 then
  41.    
  42.     set logins to {}
  43.     -- get user name and home path
  44.     set whoami to current application's NSUserName()
  45.     set whereami to current application's NSHomeDirectoryForUser(whoami) as text
  46.     -- look for the .btm file or throw an error
  47.     set posixPath to whereami & "/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm"
  48.     set {theData, theError} to NSData's dataWithContentsOfFile:posixPath options:0 |error|:(reference)
  49.     if theData = missing value then error theError's localizedDescription() as text
  50.    
  51.     -- deserialize the property list or throw an error
  52.     set {newValue, theError} to NSPropertyListSerialization's propertyListWithData:theData options:NSPropertyListMutableContainersAndLeaves format:(missing value) |error|:(reference)
  53.     if newValue = missing value then error theError's localizedDescription() as text
  54.    
  55.     -- parse the list
  56.     set smg to newValue's objectForKey:"$objects"
  57.     set NSURLEnumList to NSArray's arrayWithObject:(NSString's stringWithString:"NSURLBookmarkAllPropertiesKey")
  58.     repeat with s in smg
  59.         try
  60.             if (s's isKindOfClass:(NSData's class)) then
  61.                 set thgs to s
  62.             else
  63.                 set thgs to (s's objectForKey:"NS.data")
  64.                 if thgs is not missing value then
  65.                     set prps to (NSURL's resourceValuesForKeys:NSURLEnumList fromBookmarkData:thgs)
  66.                     if prps is not missing value then
  67.                         set li to (prps's valueForKey:(NSURLEnumList's item 1)) as record
  68.                         set end of logins to {name:li's NSURLNameKey, location:li's _NSURLPathKey}
  69.                     end if
  70.                 end if
  71.             end if
  72.         end try
  73.     end repeat
  74.    
  75.     -- return the results, hopefully a list of login item names and paths
  76.     logins
  77. else
  78.     error "This script requires 10.13 or higher"
  79. end if
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top