Worth mentioning that if you want a free way to do this that does not require running additional software.
All you have to do is have a video you want to use, download one of apple's through settings, go to the location of the downloaded background (I don't remember where that is right now but a quick google search would take care of this), rename your file to the name of apple's file and then replace it.
Mac will act as if this video is the right video and use it without complaints. Until apple starts doing any checksum checks on these files I doubt this method will break anytime soon.
This has been working flawlessly for me for a while now.
This may take some finagling to make sure that your video file is not so large that your Mac can't handle it and that you are using the right format. But it is not hard to do.
I think you will find that if you try to do that, it will actually not work properly. Visiting the lock screen repeatedly will eventually crash the wallpaper extension, producing a black screen. And updating macOS will reset all your wallpapers.
Backdrop uses a more advanced approach that ensures that it works seamlessly across reboots and macOS updates.
.scr files are untrusted because they're plain PE executables. You don't need to exploit anything to get code execution because all they do is execute code.
If they were just video files, they wouldn't be such a vector for malware.
Hi Oskar! In case you want ideas for future apps for later.
https://replacicon.app/ replaces Dock icons...but somehow it doesn't work with the warp.dev icon. I wrote the support and I'm paid customers but they never answered.
I really dislike all these AI icons are in black and white! They are very hard to tell apart from each other.
To me it's a bit too expensive for what it provides, so I'll probably not buy it. However I must agree that the hacks on the internet with renaming videos doesn't work very well, and I like the product, so I still wanted to say congratulations, well done.
> The core technical challenge, as you can imagine, came from trying to do something that Apple otherwise does not allow
I think the main question most would ask is what affordances can you give or details you can share to prove that this will continue working in future versions of the os since the foundations seem brittle.
I use Wallpaper Engine on windows for one purpose mostly to avoid burn in since my monitors are always on but I've grown to like it over the years and would like to try something on mac but would hate to purchase software that stops working or future update comes with a readme of how to "re-enable" it.
That’s totally valid. In the end, all apps on Apple platforms exist at the liberty of Apple. I have several friends who’ve seen their app stop working on Tahoe or previous macOS due to subtle changes in the SDK or the OS.
I think Backdrop fills a specific need that Apple does not want to cover, much like other utility apps like Bartender etc. It will likely require continuous updates, but I’m not new to that, having supported my Trim Enabler utility all the way from OS X Leopard to current macOS.
I really like the wallpaper that plays on the top of your website. Can't seem to find it on the app. Could you point me in the right direction? https://cindori.com/backdrop
What's reverse engineering like on a Mac? Have you ever written about it? I had a lot of experience reverse engineering things on windows (win32 + x86, before 64bit was a thing) using OllyDbg and patching binaries and/or (ab)using dlls. If I had to use windows again and wanted to customize something, I'd probably use windhawk nowadays [0].
On Linux, I can just compile software myself if I need to make changes. But usually most software is configurable enough that I don't need too.
On OSX, I feel like I'm helpless. I've found very little people writing about their experiences, the tools they use, their workflows, the reverse engineered data structures etc. Can you share how you approached this?
The fact that title bars on OSX aren't a fixed size drives me crazy every single day. I looked into it briefly and realized somehow everything I know about other platforms is basically useless.
You can run these days macOS as a virtual machine. I have some experience reverse engineering iMessage. Here I only needed to look into the network requests with some SSL pinning removal.
There are some decompiled libraries of Apple's libraries so it helps. Many tried to reverse engineer macOS/iOS before so there is a helpful amount of knowledge out.
I think the best way is just to open up a decompiler program and just start RE. The decompiled source code contains some metadata such as function names so it is readable.
I have not written about it yet. I use Hopper (https://www.hopperapp.com) to disassemble related binaries and frameworks. It's a great way to explore whats actually happening within macOS or Apple apps.
My current workflow is to run Hopper, export assembly files and then throw various agents (Gemini, Claude etc) at them to learn more or validate my theories. It's surprisingly effective! Maybe I'll write about it.
> The fact that title bars on OSX aren't a fixed size drives me crazy every single day.
Are you talking about standalone titlebars or are you including merged/unified titlebars+toolbars? Plain titlebars have a single height and merged unified toolbars have a little bit of variance but not a lot.
Any significant variance beyond those is due to third party developers hiding the standard window chrome and drawing their own. You could probably tweak NSWindow instances to bring back the standard chrome, but it’s going to look strange since it’ll show in addition to the custom chrome.
I am so uneducated that I cannot even answer your question properly. But for example, the default terminal in OSX has a really nice thin bar. VSCode/Cursor have a _slightly_ thicker one. Google Chrome and Firefox are huge. The red/yellow/green buttons also don't have a consistent position between those applications.
Do you happen to know which are custom chrome and which are "unified"? It didn't occur to me that other programs could be drawing their own chrome, since they look _mostly_ native(at least to me). On windows, if something was using custom stuff it would just look completely different (i.e winamp).
I guess part of the problem is that I've never done native OSX development, so I don't know what the APIs or native toolkits are like.
Safari is one example of a native AppKit “unified” titlebar+toolbar, as is the Finder.
And yep, all those listed (VS Code/Cursor, Chrome, and Firefox) are examples of fully custom third party window chrome, which is why they’re so variable. A lot of cross-platform software does this. It’s worth noting that Firefox at least lets you toggle on the standard titlebar — right click the toolbar, click “Customize Toolbar…”, and toggle the “Title Bar” checkbox in the bottom left corner.
What were some of the technical challenges you experienced while reverse-engineering the wallpaper system? I've been reverse-engineering (for lack of a better term) some of macOS' and Xcode's poorly-documented functionality prototyping a personal developer tool. My investigation isn't sophisticated by any means; it's just been trial-and-error, but I haven't found much online in the way of resources for people going down this route.
Reverse engineering is hard! I use Hopper (https://www.hopperapp.com) to disassemble related binaries and frameworks. It's a great way to explore whats actually happening within macOS or Apple apps.
You can also export assembly files and throw various agents (Gemini, Claude etc) at them to learn more. It's surprisingly effective!
Hi Oskar - I'd love to propose a product idea to you, i'd love to buy something like this or the Mac if it were available. I had this on my linux laptop (https://man.archlinux.org/man/xtrlock.1.en) but it is surprisingly difficult to find for Macs -- something that locks the computer but still allows you to see the screen. This would be ideal for log windows, dashboards, etc.
Separately, if there is something like this already from a reputable MacOS appstore ecosystem i'd appreciate knowing about it from anyone.
Apps break on OS updates all the time. I'll do my best to keep supporting this feature. Who knows, maybe Apple will take note and make it a default feature in next macOS?
The nice thing about an walled garden OS is it functions beautifully, as those in control restrict everything. Only the most trusted programs receive limited control of the OS.
The bad thing about an walled garden OS is you can't change your wallpaper without breaking the rules.
I'm a big fan of TrimEnabler since my Hackintosh days. Sensei looks great but since I already have iStat and thought buying another status menu app would be redundant. But I admire the way it looks.
Does the fact that Backdrop reverse engineers the lockscreen mean that it will never come to the App Store?
Thanks! I don't publish any of my apps on the App Store. Partly because I want the creative freedom that publishing independently provides, but also because I don't want arbitrary decisions from unknown reviewers to risk ruining my business, and prevent my users from accessing their purchases.
I've been trying to make a library/cli to set the wallpaper/screensaver to use in the next version of Aerial (https://github.com/AerialScreensaver/PaperSaver) on individual screens and been toying around a lot with that whole WallpaperAgent subsystem (and obviously everything Aerial like the manifests, etc, before that), so I may have some insights/questions if you have time ?
From what I've seen there are multiple parts to the way that macOS subsystem works :
- Apple fetches the manifest (json file) with their own videos in (only) 240FPS
- It gets ingested in '/Library/Application Support/com.apple.idleassetsd/Aerial.sqlite' for some reason
- Apple pulls the videos in '/Library/Application Support/com.apple.idleassetsd/Customer/4KSDR240FPS' but renames them through a UUID (despite them having individual keys in the JSON)
Adding videos and sections in System Settings, you can do by manipulating that sqlite and killing WallpaperAgent (or maybe something else) before doing it, but as far as I remember (I only toyed with that part last year during Sequoia beta, so probably misremembering), macOS will periodically pull the manifest again and (fairly often) erase all your changes.
As far as I know, what you select then gets saved per screen/space in `~/Library/Application\ Support/com.apple.wallpaper/Store/Index.plist` (with a lovely Base-64 coding thrown in for fun).
The last part to this is a SystemWallpaperURL key stored in `~/Library/Preferences/com.apple.wallpaper.plist` which I believe (not 100% sure), contains the "special" video that gets played on a cold boot login (as far as I know it's a separate state from the "classic" Lock Screen).
So if I may :
- Do your videos show up on a cold boot too (that separate state I mentionned?) or just the "classic" Lock Screen? My rough guess is the cold boot lock screen can only display videos that are on the System Volume that's mounted before the user volume, so that one is probably fully out of reach.
- How hard did you have to workaround working with restricted paths ? Apple (for some good reasons) restricts hard access to files in user folders, and at that point the only safe place I can reasonably find (outside of containers, but that's a whole other story with screensavers) is
`/Users/Shared`. Are you using that folder too?
- Are you messing with the sqlite db, or are you injecting via a reversed engineered api?
- Did you try editing `~/Library/Application\ Support/com.apple.wallpaper/Store/Index.plist` to set your video wallpapers or are you just relying on them being integrated in System Settings?
Since Sequoia, right now Apple broke the way we could set a screensaver via terminal. I got that part working (setting per screen/space) in PaperSaver, but the wallpaper part (basically just switching to another user selected image, not even a video, but this has to be done per space for which we don't have a public api for), I can't seem to get quite right yet, so any insight you have on that would be welcome. Take care and again awesome effort on your launch, this is a non trivial system with so many pitfalls, it takes a bunch of dedication to make it work with so many subtle problems in every corner.
If you're going through so much trouble to reverse engineer macOS to customize it in a non-standard way, why even bother staying in the Apple walled prison. Why not just use Linux at that point? You can customize it to your heart's desire.
Because in order to get the Linux desktop I’d want, customization of existing desktops isn’t nearly enough. I’d need to write my own DE, because all of the existing options are just too far diverged from the desired end result.
I’m sure there’s others sticking to macOS on their primary machines for that reason.
Worth mentioning that if you want a free way to do this that does not require running additional software.
All you have to do is have a video you want to use, download one of apple's through settings, go to the location of the downloaded background (I don't remember where that is right now but a quick google search would take care of this), rename your file to the name of apple's file and then replace it.
Mac will act as if this video is the right video and use it without complaints. Until apple starts doing any checksum checks on these files I doubt this method will break anytime soon.
This has been working flawlessly for me for a while now.
This may take some finagling to make sure that your video file is not so large that your Mac can't handle it and that you are using the right format. But it is not hard to do.
I think you will find that if you try to do that, it will actually not work properly. Visiting the lock screen repeatedly will eventually crash the wallpaper extension, producing a black screen. And updating macOS will reset all your wallpapers.
Backdrop uses a more advanced approach that ensures that it works seamlessly across reboots and macOS updates.
> Until apple starts doing any checksum checks on these files I doubt this method will break anytime soon.
Watch as this is used for malware persistence through a code execution exploit. Then Apple will start verifying the file content.
.scr files are untrusted for this very reason.
.scr files are untrusted because they're plain PE executables. You don't need to exploit anything to get code execution because all they do is execute code.
If they were just video files, they wouldn't be such a vector for malware.
Hi Oskar! In case you want ideas for future apps for later. https://replacicon.app/ replaces Dock icons...but somehow it doesn't work with the warp.dev icon. I wrote the support and I'm paid customers but they never answered. I really dislike all these AI icons are in black and white! They are very hard to tell apart from each other.
To me it's a bit too expensive for what it provides, so I'll probably not buy it. However I must agree that the hacks on the internet with renaming videos doesn't work very well, and I like the product, so I still wanted to say congratulations, well done.
This is awesome, nice work!
Next, can you please reverse engineer spaces (multiple desktops) so we can rename them? Desktop 1, Desktop 2 etc is not very useful.
Very cool and nice solution. I personally need to have a grey background though, no photos etc. Elaborate colors are just overstimulation.
> The core technical challenge, as you can imagine, came from trying to do something that Apple otherwise does not allow
I think the main question most would ask is what affordances can you give or details you can share to prove that this will continue working in future versions of the os since the foundations seem brittle.
I use Wallpaper Engine on windows for one purpose mostly to avoid burn in since my monitors are always on but I've grown to like it over the years and would like to try something on mac but would hate to purchase software that stops working or future update comes with a readme of how to "re-enable" it.
That’s totally valid. In the end, all apps on Apple platforms exist at the liberty of Apple. I have several friends who’ve seen their app stop working on Tahoe or previous macOS due to subtle changes in the SDK or the OS.
I think Backdrop fills a specific need that Apple does not want to cover, much like other utility apps like Bartender etc. It will likely require continuous updates, but I’m not new to that, having supported my Trim Enabler utility all the way from OS X Leopard to current macOS.
I really like the wallpaper that plays on the top of your website. Can't seem to find it on the app. Could you point me in the right direction? https://cindori.com/backdrop
It's not available (it's just a promotional video), but I've received to many requests for it so I guess I'll have to make a real wallpaper from it!
What's reverse engineering like on a Mac? Have you ever written about it? I had a lot of experience reverse engineering things on windows (win32 + x86, before 64bit was a thing) using OllyDbg and patching binaries and/or (ab)using dlls. If I had to use windows again and wanted to customize something, I'd probably use windhawk nowadays [0].
On Linux, I can just compile software myself if I need to make changes. But usually most software is configurable enough that I don't need too.
On OSX, I feel like I'm helpless. I've found very little people writing about their experiences, the tools they use, their workflows, the reverse engineered data structures etc. Can you share how you approached this?
The fact that title bars on OSX aren't a fixed size drives me crazy every single day. I looked into it briefly and realized somehow everything I know about other platforms is basically useless.
[0] https://windhawk.net/
Here is my 2 cents:
You can run these days macOS as a virtual machine. I have some experience reverse engineering iMessage. Here I only needed to look into the network requests with some SSL pinning removal.
There are some decompiled libraries of Apple's libraries so it helps. Many tried to reverse engineer macOS/iOS before so there is a helpful amount of knowledge out.
I think the best way is just to open up a decompiler program and just start RE. The decompiled source code contains some metadata such as function names so it is readable.
I have not written about it yet. I use Hopper (https://www.hopperapp.com) to disassemble related binaries and frameworks. It's a great way to explore whats actually happening within macOS or Apple apps.
My current workflow is to run Hopper, export assembly files and then throw various agents (Gemini, Claude etc) at them to learn more or validate my theories. It's surprisingly effective! Maybe I'll write about it.
> The fact that title bars on OSX aren't a fixed size drives me crazy every single day.
Are you talking about standalone titlebars or are you including merged/unified titlebars+toolbars? Plain titlebars have a single height and merged unified toolbars have a little bit of variance but not a lot.
Any significant variance beyond those is due to third party developers hiding the standard window chrome and drawing their own. You could probably tweak NSWindow instances to bring back the standard chrome, but it’s going to look strange since it’ll show in addition to the custom chrome.
I am so uneducated that I cannot even answer your question properly. But for example, the default terminal in OSX has a really nice thin bar. VSCode/Cursor have a _slightly_ thicker one. Google Chrome and Firefox are huge. The red/yellow/green buttons also don't have a consistent position between those applications.
Do you happen to know which are custom chrome and which are "unified"? It didn't occur to me that other programs could be drawing their own chrome, since they look _mostly_ native(at least to me). On windows, if something was using custom stuff it would just look completely different (i.e winamp).
I guess part of the problem is that I've never done native OSX development, so I don't know what the APIs or native toolkits are like.
Safari is one example of a native AppKit “unified” titlebar+toolbar, as is the Finder.
And yep, all those listed (VS Code/Cursor, Chrome, and Firefox) are examples of fully custom third party window chrome, which is why they’re so variable. A lot of cross-platform software does this. It’s worth noting that Firefox at least lets you toggle on the standard titlebar — right click the toolbar, click “Customize Toolbar…”, and toggle the “Title Bar” checkbox in the bottom left corner.
Heh, so really I just need to go with the Linux approach and recompile everything with "fixed" titlebars.
For some reason it didn't occur to me that it's non native since they do such a good job at matching the native stuff.
On a side note, I'm glad I don't use finder or safari, because those titlebars are even larger than Chrome and Firefox! Absolute insanity.
Hi cindori, I couldn't figure these out without purchasing:
1. Does Backdrop plan to support 5K/6K wallpapers? Those resolutions are pretty standard for Mac workstations.
2. Is functionality similar to TopNotch supported where the notch is hidden? If this was supported I'd likely buy a lifetime license today.
What were some of the technical challenges you experienced while reverse-engineering the wallpaper system? I've been reverse-engineering (for lack of a better term) some of macOS' and Xcode's poorly-documented functionality prototyping a personal developer tool. My investigation isn't sophisticated by any means; it's just been trial-and-error, but I haven't found much online in the way of resources for people going down this route.
Reverse engineering is hard! I use Hopper (https://www.hopperapp.com) to disassemble related binaries and frameworks. It's a great way to explore whats actually happening within macOS or Apple apps.
You can also export assembly files and throw various agents (Gemini, Claude etc) at them to learn more. It's surprisingly effective!
I'm no pro rev. engineer or anything, but did you try alternatives to Hopper at all? I've never had much luck with Hopper compared to Radare2 and IDA.
Hi Oskar - I'd love to propose a product idea to you, i'd love to buy something like this or the Mac if it were available. I had this on my linux laptop (https://man.archlinux.org/man/xtrlock.1.en) but it is surprisingly difficult to find for Macs -- something that locks the computer but still allows you to see the screen. This would be ideal for log windows, dashboards, etc.
Separately, if there is something like this already from a reputable MacOS appstore ecosystem i'd appreciate knowing about it from anyone.
What you're asking for is called "kiosk" mode.
Here's a random app I found: https://www.mackiosk.com/
What happens to purchasers if/when apple update MacOS and this no longer works?
Apps break on OS updates all the time. I'll do my best to keep supporting this feature. Who knows, maybe Apple will take note and make it a default feature in next macOS?
The nice thing about an walled garden OS is it functions beautifully, as those in control restrict everything. Only the most trusted programs receive limited control of the OS.
The bad thing about an walled garden OS is you can't change your wallpaper without breaking the rules.
Hi Oskar,
I'm a big fan of TrimEnabler since my Hackintosh days. Sensei looks great but since I already have iStat and thought buying another status menu app would be redundant. But I admire the way it looks.
Does the fact that Backdrop reverse engineers the lockscreen mean that it will never come to the App Store?
And where can you pull
Thanks! I don't publish any of my apps on the App Store. Partly because I want the creative freedom that publishing independently provides, but also because I don't want arbitrary decisions from unknown reviewers to risk ruining my business, and prevent my users from accessing their purchases.
Awesome stuff !
I've been trying to make a library/cli to set the wallpaper/screensaver to use in the next version of Aerial (https://github.com/AerialScreensaver/PaperSaver) on individual screens and been toying around a lot with that whole WallpaperAgent subsystem (and obviously everything Aerial like the manifests, etc, before that), so I may have some insights/questions if you have time ?
From what I've seen there are multiple parts to the way that macOS subsystem works :
- Apple fetches the manifest (json file) with their own videos in (only) 240FPS
- It gets ingested in '/Library/Application Support/com.apple.idleassetsd/Aerial.sqlite' for some reason
- Apple pulls the videos in '/Library/Application Support/com.apple.idleassetsd/Customer/4KSDR240FPS' but renames them through a UUID (despite them having individual keys in the JSON)
Adding videos and sections in System Settings, you can do by manipulating that sqlite and killing WallpaperAgent (or maybe something else) before doing it, but as far as I remember (I only toyed with that part last year during Sequoia beta, so probably misremembering), macOS will periodically pull the manifest again and (fairly often) erase all your changes.
As far as I know, what you select then gets saved per screen/space in `~/Library/Application\ Support/com.apple.wallpaper/Store/Index.plist` (with a lovely Base-64 coding thrown in for fun).
The last part to this is a SystemWallpaperURL key stored in `~/Library/Preferences/com.apple.wallpaper.plist` which I believe (not 100% sure), contains the "special" video that gets played on a cold boot login (as far as I know it's a separate state from the "classic" Lock Screen).
So if I may :
- Do your videos show up on a cold boot too (that separate state I mentionned?) or just the "classic" Lock Screen? My rough guess is the cold boot lock screen can only display videos that are on the System Volume that's mounted before the user volume, so that one is probably fully out of reach.
- How hard did you have to workaround working with restricted paths ? Apple (for some good reasons) restricts hard access to files in user folders, and at that point the only safe place I can reasonably find (outside of containers, but that's a whole other story with screensavers) is `/Users/Shared`. Are you using that folder too?
- Are you messing with the sqlite db, or are you injecting via a reversed engineered api?
- Did you try editing `~/Library/Application\ Support/com.apple.wallpaper/Store/Index.plist` to set your video wallpapers or are you just relying on them being integrated in System Settings?
Since Sequoia, right now Apple broke the way we could set a screensaver via terminal. I got that part working (setting per screen/space) in PaperSaver, but the wallpaper part (basically just switching to another user selected image, not even a video, but this has to be done per space for which we don't have a public api for), I can't seem to get quite right yet, so any insight you have on that would be welcome. Take care and again awesome effort on your launch, this is a non trivial system with so many pitfalls, it takes a bunch of dedication to make it work with so many subtle problems in every corner.
If you're going through so much trouble to reverse engineer macOS to customize it in a non-standard way, why even bother staying in the Apple walled prison. Why not just use Linux at that point? You can customize it to your heart's desire.
Because in order to get the Linux desktop I’d want, customization of existing desktops isn’t nearly enough. I’d need to write my own DE, because all of the existing options are just too far diverged from the desired end result.
I’m sure there’s others sticking to macOS on their primary machines for that reason.
Because there is nobody who makes linux devices of equal battery life and performance to macbooks, nor does linux wake up from sleep as reliably.