Hacker News Reader

Hacker News

Comment by AceJohnny2 | Hacker News Reader

Full thread

AceJohnny2

How do people discover the `defaults` keys?

I occasionally stumble upon such secret troves of knowledge, but I'd love to find out how these are discovered.

Is there, like, a way to intercept all `defaults`/settings reads to discover what keys are checked?

View on HN

Yes! It doesn't work 100% of the time, but what I've been doing for my setup script is:

`defaults read > old` -> change setting in GUI -> `defaults read > new` -> `diff old new`

If nothing is there, you're out of luck, most likely. (I think I've had luck using -currentHost or maybe sudo sometimes though...) If there is something, `less new` and search for the string, then find the path to the key. Do a test read with `defaults read <domain> <item>` to see if you got the path right.

You can also copy plist files (cp -r /Library/Preferences, or wherever) and then diff those. A useful alias to convert to xml:

alias plist='plutil -convert xml1 -o /dev/stdout'

For mapping UI preferences to corresponding plist keys, https://github.com/catilac/plistwatch will monitor and output real-time changes. May be easier than diffing snapshots of `defaults read`.

This doesn't help with "secret" settings that aren't exposed through the UI, but can be handy for creating setup scripts.

AIUI some of them are communicated informally by Apple engineers to individuals, some of them are found by using `strings` on the binary and looking at reasonable-seeming keys, any key that actually has a UI to set it is typically found just by setting it in the UI and seeing what changed, some of this stuff may have had UI's in the past that were removed while still leaving the defaults key, some of this stuff may just write the keys into the preferences files automatically and so you can find them just by looking at what's already there, etc.

Skimming this list right now a lot of the stuff I'm seeing definitely has UI settings, so a lot of these are just useful for e.g. automating the setup of a new user.

Theoretically you could attach to a process with LLDB, and use objc swizzling to intercept calls to NSUserDefaults. However to do this, I think you would need to disable SIP. Even then i'm not sure this would work.

In practice, people probably just read user defaults and try to reverse engineer what they do.

defaults logs what it is doing if you turn on debug logs for that subsystem.

Same question. I also want to read a value, but can't seem to get it right. For example, I'd like to know what the current value of

   CGFontRenderingFontSmoothingDisabled

is. I tried

   defaults read CGFontRenderingFontSmoothingDisabled

but got:

   Domain CGFontRenderingFontSmoothingDisabled does not exist

thankfully defaults read spits out all of the vars, so you can do

    defaults read | grep CGFontRenderingFontSmoothingDisabled

Thank you

Defaults is a tool which can read and write system and other application settings. By default it works on the system settings. One can either pass a bundle id or a path to a plist file to read and write other settings.

You can see a huge list of settings by typing „defaults read“

I think what you’re looking for is “defaults read”

I suspect that they are asking about finding settings which get used, but aren't documented. Like, how to find hidden settings that programs will use.

In my experience with plist settings is that they are rarely sparse. But sure finding hidden settings is a tricky issue.

Unfortunately, that only seems to print those defaults that are set, not all defaults that are possible.

For example, the NSToolbarTitleViewRolloverDelay setting, while valid per the article, isn't listed in the output of `defaults read`

Per sibling comments, you run strings on binaries, find out informally from Apple engineers, or dig through settings in the System Preferences and then use `defaults` to look for changes in output.

Reply on news.ycombinator.com