[Update Discussion] TotalFinder 1.15.1 for Apple Silicon and Intel — macOS 13, 12, 11, and 10.15

[akemin_dayo]

TotalFinder 1.15.1 for Apple Silicon and Intel — macOS 13, 12, 11, and 10.15

※ Please note that TotalFinder is no longer officially supported by BinaryAge, and therefore bug fixes can be made only on a best-effort basis.

Changelog and download location for 1.15.1 (full changelog)

• Fixed a code injection issue where TotalFinder would fail to successfully inject on certain legacy / unsupported systems that were patched using OpenCore Legacy Patcher / OCLP. （※ Please note that this issue has nothing to do with the UEFI bootloader named OpenCore — TotalFinder has never had any known compatibility issues with the OpenCore UEFI bootloader.）
• Fixed an issue where the new Coloured Labels logic would be unable to obtain the label colour of certain items that have coloured label information stored in a slightly different way than what was thought to be possible during testing.
• Fixed an issue where the new Coloured Labels logic would use the oldest label colour found on an item with multiple labels, instead of the newest.
• Fixed a rendering issue where the TotalFinder icon in the Finder preferences on macOS 11 Big Sur and newer would render with aliasing artifacts, especially on non-Retina/HiDPI displays where the issue was very severe.
• Fixed a rendering issue where the TotalFinder icon in the Finder preferences on macOS 11 Big Sur and newer was unable to be tinted by the user’s macOS UI tint colour when selected.
• Major internal refactors were made to the Coloured Labels feature, resulting in better optimisation of label colour lookup operations.
• Certain behaviour flags that were used during the testing of the new Coloured Labels logic are now controllable via TotalFinder’s power-user-oriented “Tweakables” feature, which you can use by creating specific files in your home directory （~, or ${HOME}） using the command-line utility touch. See below for more details.
• The newly-added Tweakable flag ~/.totalfinder-alwaysenablenewlabellookupmethods enables the new Coloured Labels lookup logic on macOS 12 Monterey and below, which normally use a different label colour lookup method that no longer works as of macOS 13 Ventura.
• The newly-added Tweakable flag ~/.totalfinder-disablelabelcolourlookupoptimisation disables all Coloured Labels lookup optimisations, which may be useful as a troubleshooting or debugging step.
• Made many improvements to the TotalFinder diagnostics utility （diagnose-totalfinder.sh） that improve the usefulness of its output.
• Added an experimental feature that allows users to make the Visor show above other apps, but not the Dock whenever the Visor is in a pinned state. This experimental feature is currently only accessible by running defaults write com.binaryage.totalfinder TotalFinderVisorDrawAboveOtherAppsWhenPinned 1 in a Terminal session. （※ Replace the 1 with a 0 to disable the feature.）
• A new Visor-related Tweakable flag was added: ~/.totalfinder-useaggressivevisordrawpriority will set the Visor window to a much higher draw priority when the “Show on top of the Dock” feature is enabled. This can be useful if you encounter an app that is still able to draw above the Visor even with “Show on top of the Dock” enabled.
• Various other internal refactors and improvements were made to TotalFinder as a whole.

Known issues in 1.15.1

• Issue: When the is hovering over the current directory name in Finder to expose the document proxy icon, a slight visual bug occurs.

  • Affects: macOS 13, 12, and 11
  • Reproduced on: macOS 12.3.1 21E258, macOS 11.6.5 20G527
  • Note: The specific behaviour that triggers this is the mousing over, not the document proxy icon being shown. If the document proxy icons are set to always show, the visual bug only occurs when the mouse is actually hovering over the area.
  • Screenshot:
    

• Issue: TotalFinder windows cannot be dragged from the navigation bar / toolbar area. This is a regression from behaviour on macOS 10.15 and below.

  • Workaround: Drag windows from the topmost “title bar” area as you would any other window. (That’s the dark grey part where the tabs are.)
  • Affects: macOS 13, 12, and 11
  • Reproduced on: macOS 12.3.1 21E258

Is there a way to only disable just the parts of SIP that TotalFinder strictly needs? I want my system to be as secure as possible while still using TotalFinder!

Follow the instructions here.

※ I know it’s on the Apple Silicon page, but the same csrutil invocation will work for you on an Intel Mac, too. I will add this information to the general TotalFinder SIP page soon, after I have time to rework them.

I am using OpenCore on Intel/AMD, what SIP flags do I need to disable?

On Intel/AMD, TotalFinder requires the SIP flags CSR_ALLOW_TASK_FOR_PID and CSR_ALLOW_UNRESTRICTED_FS to be disabled.

※ IMPORTANT: Your OpenCore configuration most likely already comes with some SIP features disabled for you — please make sure you do not touch those other options, as they are most likely required for your system to successfully boot.

[Recuerom]

Congratulations on this magnificent effort. I decided to bail out of TF because I am finding that it is becoming more compromising to disable SIP (ie loss of capabilities on M1 systems).

I wanted to let the community know that I found a product called Qspace Pro which is a replacement for Finder with (almost) all the things we love in TF and Xtra Finder. What makes it compelling is that it looks very similar to Apple Finder so the learning curve is minimal and works with SIP enabled etc.

You get a 30 day trial from their website so you can make up your own mind. It is also available on the App Store but with some features disabled due to Apple sandboxing.

[strafer]

Hi,

Thank you for fixing TotalFinder for Apple Silicon.

My primary reason for using TotalFinder is to re-enable custom icons in the Finder sidebar. Sadly, it doesn’t seem to be working with this new version of Total Finder on my M1 Mac mini.

I’m using IconFactory’s Arcade Daze for my various home folder icons. Unfortunately, folders with custom icons (e.g., Desktop, Downloads, Applications) still appear as the boring, generic blue SF Symbol glyphs in the Finder Sidebar. Even folders on external storage appear as generic blue glyph folders in the Sidebar.

Strangely, the Library folders appear as regular blue system default folders. And the Movies, Pictures, and Music folder appear as skeuomorphic folders from the macOS Mavericks era.

Is it possible to fix this issue in TotalFinder on Apple Silicon? I just want the ability to have the Finder Sidebar display folders exactly the way the appear in the Finder windows.

[akemin_dayo]

I have confirmed and reproduced this issue on macOS 12, 11, and even 10.15. (Both Apple Silicon and Intel.)

I’ll look into this.

Thanks for reporting!

[Deezer]

Hi,

I’m on Monterey 12.3.1. On a MBAir (M1, 2020).

After the installation I was really happy to have Totalfinder back. After having restarted the laptop today, I was running into several problems, which I think have been caused by the new setup. 1Password (V 7.9.4) extension no longer working in Google Chrome (V 101.0.4951.41). This can also happen when Chrome is updating, which it was not. Slack no longer showing any window content (just opening to empty windows). Other extensions (Logitec Presentation) and LogiTune being very slow to respond.

I uninstalled Totalfinder and went back to the previous, reduced SIP settings (installs from identified developers allowed) and everything is back at normal.

Again, it can be unrelated to the TF installation, but I highly suspect this to be side effects of it. Wanted to let you know.

I keep fingers crossed, that either TF can work as before M1 at some point again or even better, that Apple would buy TF from you and make it the default finder.

Thanks for all your hard work!

[akemin_dayo]

Hmn, that is… some strange behaviour.

I have been running pretty much the same configuration (even with those same apps!) and I have not run into such issues on either Apple Silicon or Intel. I have even tested your exact same machine (a friend of mine, she has an M1 MacBook Air 2020).

(In other words, I cannot reproduce the issue you are describing.)

1Password works fine with Chrome for me (as long as Chrome is up-to-date, of course), Slack works fine, and the Logicool (Logitech’s name in Japan) software works fine for me, too.

Here’s a troubleshooting step — try disabling SIP, but not installing TotalFinder and using your computer for a while. Do your issues persist?

If not, install TotalFinder and then try using your computer for a while. Do the issues return?

If so, do they persist after a second reboot?

[Deezer]

Thanks for your insights and tipps. I’ll test the suggested steps within the next days and give you feedback after that.

[Peter_Hollo]

This is truly excellent, @akemin_dayo! You’re a total legend.

I can just confirm that Slack works fine for me. I’m using Vivaldi primarily and extensions are working fine for me (I also use LastPass not 1Password but also no issues).

[shh_sg]

Hey! @akemin_dayo Thanks a lot for the TotalFinder update

I have two questions for you?

• TotalFinder Icon.
• Moving items to the left in the toolbar.

So after I change the Icon in the 'Applications/TotalFinder/Contents/Resources/TotalFinder.bundle/Contents/Resources folder and try to restart TotalFinder it won’t restart and says “TotalFinder is corrupted. A code signature check failed. Please reinstall TotalFinder”. When I return original icons everything gets. The names, formats, dimensions, and resolutions of .icns and.png files are the same as the original ones.
Is there any chance to change the icon then?

_ Another thing would be a space in the toolbar. On my last mac, all the toolbar items were starting from the left part of the toolbar, and now they start from the right side after the middle of the toolbar. Is there any chance to move them back to the left and make them look like the previous TotalFinder?

OLD (10.14.6, Intel Hackintosh)

NEW (12.0.1 M1)

Thank you a lot!
Looking forward to hearing back from you

p.s. And actually if you know the easy way of changing the system Icons (e.g. Finder, Folders, Trash can) please let me know. After using those stupid and cute icons that I’ve drawn for 10 years, it’s really hard to move on from them , haha

[akemin_dayo]

On my last mac, all the toolbar items were starting from the left part of the toolbar, and now they start from the right side after the middle of the toolbar. Is there any chance to move them back to the left and make them look like the previous TotalFinder?

This actually isn’t a change in TotalFinder, but rather in Finder itself.

I’ll note this down as an enhancement/feature-request, but it’s unlikely I’ll really be able to do much about this since it’d probably involve rewriting/re-implementing a lot of Apple UI code.

---

So after I change the Icon in the 'Applications/TotalFinder/Contents/Resources/TotalFinder.bundle/Contents/Resources folder and try to restart TotalFinder it won’t restart and says “TotalFinder is corrupted. A code signature check failed. Please reinstall TotalFinder”.

※ EDIT: Feel free to just scroll down straight to the solution if you don’t care about the explanation. ;​P

So the reason why this is happening is because you actually are invalidating TotalFinder’s code signature by replacing that icon, despite the fact that you haven’t actually touched any executable binaries.

There’s a rather common misconception that I’ve seen some people have regarding how Apple’s code signing system works on both macOS and iOS.

I’m fairly sure this is because of people being used to how codesigning works on Windows, where you can pretty much freely modify the resource files of a Windows app without breaking the code signature as long as you don’t modify any executable code. (That, and also code signatures are also not really treated all that importantly by Windows, as opposed to macOS/iOS. Breaking the code signature there doesn’t really matter as much.)

macOS/iOS code signing applies to pretty much the entire app bundle, not just the executable binaries. This is called resource file sealing (see Apple Developer documentation TN2206) — long story short, the individual hashes of all resource files found in the app bundle are taken into account when validating a given app bundle’s code signature.

What this means is that even the slightest modification to something like an Info.plist file, or in your case, an icon icns file will cause the code signature for the entire bundle to become invalidated.

For non-system apps, some people choose to get around this by manually re-signing their modified copy of the app themselves so that the bundle code signature will become valid again.

(This can cause issues especially if you do not correctly replicate/re-sign with all codesigning entitlements, and is generally so much of a hassle that it’s not really worth doing except in certain circumstances, like an Info.plist modification or something to an unmaintained/abandoned app)

However, in the specific case of TotalFinder, even manually re-signing the app will actually not fix this error.

The reason why is because there is actually an additional validation step built into TotalFinder that makes absolutely sure that the certificate used to code-sign the TotalFinder binary you are running is from an official source. This is done for security purposes, as TotalFinder injects into a system process (Finder).

---

That being said, I do have a solution for you…

Is there any chance to change the icon then?

p.s. And actually if you know the easy way of changing the system Icons (e.g. Finder, Folders, Trash can) please let me know. After using those stupid and cute icons that I’ve drawn for 10 years, it’s really hard to move on from them , haha

Use IconChamp for all your icon-replacing needs — it’s probably the easiest way to do this for both system apps and regular apps on macOS.

It even persists your custom icons across app updates!

I use it on my system pretty much solely just to replace the Messages and FaceTime app icons with the old ones from macOS 10.14 Mojave (which in my opinion look vastly better than their post-macOS 11 designs), and of course, the Music app icon with iTunes. ;​P

※ I haven’t tested this, but you may have to enable TotalFinder’s “Keep original Dock icon” option for your IconChamp custom Finder icon to work. Not sure about this. I’ll update this post later if I test it and find out.

tl;dr: Never replace files in app bundles like that, it will break the code signature of any app, not just TotalFinder. Use IconChamp instead.

[shh_sg]

Hey! @akemin_dayo Thank you for your quick reply! That is sweet
I previously saw IconChamp, and I found it suspicious and didn’t want to permit it to my system, haha. But since I trust your choice, I just bought it too, and yay it works, haha, apart from some icons like ‘Trash/Bin’

As for the Finder icon. IconChamp does change it successfully. But once I click ‘Keep original Dock icon’ in TotalFinder preferences, the icon gets back to the original one (not the *TotalFinder one).
Is there any chance to change that ‘original icon’ in TotalFinder, without actually breaking the TotalFinder?

Sorry for bothering you with such a small issue
Many thanks.

p.s. Just look at this little hippo face, how can I leave it in my past? Haha

EDIT:
And just one more thing. When trying to drag TotalFinder window clicking on the left side of the window it doesn’t work like it did in a past or in original Finder. Pics below, hope it helps you understand what I mean.

TotalFinder

Original (I don’t know, just in case, haha)

[akemin_dayo]

But once I click ‘Keep original Dock icon’ in TotalFinder preferences, the icon gets back to the original one (not the *TotalFinder one).

I’ve reproduced and confirmed this issue.

This appears to be a result of IconChamp not hooking the specific Objective-C method+class that TotalFinder is using to retrieve the Finder icon.

Basically, TotalFinder asks macOS for “the Finder icon”, but IconChamp isn’t aware of this, so TotalFinder receives the original Finder icon instead of the custom IconChamp one.

I’ll see if I can figure out how to fix this. (… Or maybe just implement some feature that lets you specify your own custom icon entirely. ┐(￣ー￣)┌)

---

When trying to drag TotalFinder window clicking on the left side of the window it doesn’t work like it did in a past or in original Finder.

Reproduced and confirmed. For the time being, just try to remember to drag it from the “title bar” area on the top (the dark grey area).

(Honestly, I didn’t even know that you could drag the entire window from the navigation bar area. I just tested this with TotalFinder on macOS 10.14.6 and was surprised. I just always drag windows from the topmost “title bar” area out of habit since I used to main Windows before I switched over my daily driver OS to macOS in the 10.7.5 Lion era.)

Thank you for reporting! (and enjoy your custom icons ;P)

[shh_sg]

Hey! @akemin_dayo Thank you again

Those things are not a big deal anyway.
So thank you a lot for the TotalFinder update

Also, just a newbie question, does that all SIP and protection disabling make my mac really vulnerable? And if yes, where should I be more careful? (Torrents, online, something else?)

Thanks

[akemin_dayo]

Realistically speaking, as a normal user, you will probably be fine.

In my opinion, the most important things you need to be careful about are actually the same things you would have to be careful about even with SIP fully enabled.

(※ Also, if you want SIP to still remain partially-enabled, you can always follow the instructions for leaving SIP partially enabled — I have been running such a configuration since macOS 10.11 El Capitan. Despite Apple saying it is “unsupported”, nothing has broken for me yet in all this time.)

Consider this from the perspective of a malware author — a malware author ideally wants their theoretical malware to reach as many users as possible.

The amount of users that have SIP disabled or weakened is very low compared to those that have it fully enabled (which is probably 99% of macOS users).

It does not make sense to write malware that is only effective against such a low number of people.

A lot of attacks these days rely heavily on social engineering — that is, exploiting “vulnerabilities” in people.

Examples of this include:

• Dialog popups that mimic system UI to try and mislead you into entering in your passwords (credential phishing attacks)
  • There are also web-based versions of these that pretend to look very convincingly like login prompts from, for example, Google.
• Regular applications that run as a regular, non-root user and do not use any security exploits whatsoever, but do malicious things like stealing login tokens, SSH private keys, your Terminal history, or other sensitive data.
  • An example of this would be the recent “I made a game, can you test this out for me” attacks seen on Discord, which spread by compromising a point of trust (your Discord friend).
• Modifying copies of software with malicious payloads and convincing users to download and use them.
  • An old example that comes to mind would be XcodeGhost, but I am sure there are far more recent examples out there.

SIP cannot really protect you from any of these things.

Of course, this is not to say that SIP is useless. Apple introducing SIP is a direct result of their apparent focus on following the defence-in-depth philosophy. That is, introducing layers upon layers of security features to make it more and more difficult to compromise a system.

For normal users that have no desire to modify system processes like us, SIP is, from a security perspective, a very good security measure.

That is not to say that SIP is the only major security feature in modern Apple software and hardware, though! There are many other Apple security features that follow the same philosophy, like:

• CTRR or “Configurable Text Read-only Region” — a hardware feature for Apple to selectively mark the entire kernel memory region as read-only
• 1TR or “One True Recovery” — a special recoveryOS environment state on Apple Silicon machines that is guaranteed to only be reachable by a real person with physical access to the hardware (since you have to hold down the power button to get there), therefore locking out any potential purely software-based attackers
• SSV or “Signed System Volume” — a cryptographically signed and sealed APFS snapshot containing the macOS system RootFS, thereby cryptographically guaranteeing that the currently-booted macOS system files have not been tampered with.
• arm64e (ARMv8.3) PAC or “Pointer Authentication Code” — essentially a cryptographic signature attached to each pointer in memory that prevents helps defend against attackers modifying pointers in memory.
  • This technically is just an ARMv8.3 feature in general and is not specific to Apple, but Apple Silicon SoCs are… actually the only ARM SoCs that I’m aware of that actually implement ARMv8.3 and use this feature to begin with, at least as of this writing.
• … and more. I could really go on for a long time about all of them, there’s that many.

However, to me personally, I view the tradeoff of some security features (allowing third-party code to inject into and modify system processes like Finder) to be an acceptable risk for me personally, in exchange for being able to augment and enhance my experience using macOS.

Aside from that, all the other Apple platform security features are still there and left intact. An Apple Silicon machine with SIP partially disabled as seen above is still a very secure machine. (I’d say it’s more secure than most Windows machines!)

This is the same reason why I choose to jailbreak my iOS device (and why I develop tweaks for jailbroken iOS — my knowledge there actually is what got me here working on TotalFinder! ;P)

That being said, please keep in mind that this is just my own personal view and philosophy regarding weakening SIP — your views and values may differ from mine, and that is okay.

The core question to ask yourself is — what do you want out of your device? And what are you willing to do to get it?

[strafer]

If you’re concerned about reduced security, you can mitigate against it by using a firewall such as Little Snitch (paid) or Lulu (free) which will alert you to any possible malware trying to phone home.

Head over to https://objective-see.com/ and have a look at their free security tools from security researcher, Patrick Wardle. In particular, BlockBlock and RansomWhere will do a lot to protect your system should it become compromised. And KextViewr, KnockKnock, and TaskExplorer are useful to run every couple of weeks to check on your background processes and kexts.

And of course, use a good adblocker: uBlock Origin for any browsers other than Safari. As for Safari, you can use Adguard or Wipr, to name a couple.

[shh_sg]

Hey @akemin_dayo @strafer , Thank you guys a lot!
Really appreciate your answers.

And @akemin_dayo thank you for so many details on it.
Something new for me to know.
And I agree with you, workflow worse this little addition of a risk, that’s how I feel as well

@strafer As for the connection blockers. I’m currently using basic Radio Silence for tuning of all the application’s connection. I guess i’ts not that clever as LULU or Little snitch. However, thanks for the advice, I just checked out little snitch, and I guess I might purchase it soon or get my hands on LULU. Thank you for the advice

[Joe_Bloggs]

Works a wonder. Great work. Much appreciated.

[Leo_B]

Same here - my main reason for using TotalFinder is custom icons in the sidebar. So I hope this will be possible to fix.

Anyway, it’s great news that TotalFinder is updated for Silicon. Thank you for all your efforts!

[alexbotev]

now, I can buy a new mac thank you