small medium large xlarge

Mac Kung Fu: Breaking the Magician’s Code

Uncovering “Default Write” Commands

by Keir Thomas

Generic image illustrating the article
  Keir breaks the magician’s code and reveals useful secrets that Apple has hidden in its code.  

Authors get asked the same questions time and again. Mine? People ask where I find the hints, tips, tricks, and hacks that fill Mac Kung Fu, the second edition of which was published last month. I’m tempted to steal a joke from Douglas Adams who, when asked where he got the zany ideas for his Hitchhiker’s books, said it was via mail order from a firm in Indianapolis.

I wish finding the tips were that easy. The trick is to develop methodologies for uncovering interesting new things. All involve exploration, trial and error, and a healthy helping of intuitive guesswork. Some methodologies are complicated. Some are simple. As just one example of how simple they can be, it’s genuinely surprising how many hidden features in OS X can be uncovered simply by clicking things on screen while holding down the Option key (a.k.a. the Alt key for international users). Hold down Option while clicking and dragging to resize the Dock and it’ll snap to preset sizes. Hold down Option while clicking the Notification Area icon in Mountain Lion and you’ll turn off notifications until tomorrow.

I click everything with Option held down so—to borrow a phrase—you don’t have to! One thing’s certain: The “Wow!” moment of discovery can be addictive.

Default Choices

An example of a more complicated methodology is uncovering the “default write” commands that form part of the book, and part of Mac power-user culture. These are commands typed into a Terminal window that write secret and/or unofficial settings and thereby unlock hidden features within apps. Default write hacks can transform the user experience by fixing annoyances and introducing new functionality. For some reason, many built-in OS X apps feature such hidden gems.

But perhaps some explanation is necessary.

Whenever a Mac program starts, it reads its settings from one or more property list files. These are similar to config/.ini files, as found on lesser operating systems, although within OS X they’re binary files that can be decoded to and from human-readable XML. Apple prefers things to be neat and tidy.

Any user selections made within an application’s Preferences dialog box are stored in one of these files, which have a .plist extension. They live in the /Library/Preferences, or ~/Library/Preferences folders. However, with most of OS X’s built-in applications—such as Finder or the Dock—there are quite a few secret preference “keys” you can write to the .plist files that activate features or change settings you can’t access via Preferences dialog boxes, or System Preferences.

These secret preference keys might unlock experimental or abandoned features, or features that for better or worse simply didn’t make it into the official Preferences panel for that app. This might be because they were considered too complicated, or perhaps too much choice was being offered to the user (which is a Bad Thing in the world of OS X).

A good example of this is the “suck” minimize windows visual effect, which has been featured in OS X since the very early days, yet isn’t accessible without using defaults write to write a secret preferences key. In System Preferences you’ll find just two visual effect choices: Genie, and Scale. Somebody at Apple clearly thought that offering a third choice would bamboozle the user.

Users can write their own preference keys into a .plist file by dropping down to a Terminal window and using the defaults write command. They must specify the preferences domain for the app in question (usually in form of something like, then the key, followed by a value. This value can be a string (that is, a keyword although in rare examples it’s a complete sentence), a Boolean value (specified as 1/0 or TRUE/FALSE), or a decimal integer (usually 8-bit). You can also specify floating point values, data arrays and calendar dates, but these are much less common in the world of defaults write hacking. Generally speaking, things are turned on or off via a Boolean 1/0.

Behind the Magic

I know what you’re thinking. How do people find the hidden preference keys? Therein lies the magic. Lucky for you, I don’t mind playing Penn and Teller.

Back in the old days finding hidden preferences was easier and involved using the strings command to search the app’s binary file for anything that was (a) human-readable, and (b) looked interesting. It was akin to fumbling around in the dark for the light switch, and it required dedication bordering on obsession to read through the output, but the rewards made it worthwhile.

Sadly, Apple began encrypting OS X binaries as part of OS X security measures, so this route was closed off. Decrypting the binary and then examining it in this way didn’t work.

A solution to this crisis was created by a developer called Arcticmac, who figured out a way of attaching the GNU debugger (gdb) to apps while they’re running in order to examine them for anything that took the format of a preference key. gdb comes as part of the Xcode command-line tools, which in Mountain Lion can be installed via Xcode’s Preferences dialog box.

I modified the technique slightly to attach gdb to already-running app processes rather than starting them from scratch. This seems to uncover a slightly different set of results.

However, even this wonderful technique is under threat: in the most recent release of Mountain Lion, Apple appears not to digitally sign gdb, limiting its access to memory locations. You can sign it yourself using Keychain Access (See these instructions, although skip the part about compiling gdb from source), but one can’t help feeling the walls are closing in once again. It may well be that the move towards sandboxing apps in current and future releases of OS X will rule out even the gdb technique for finding new defaults write strings.

Just Getting Started

The work has only just begun once the gdb script dumps a list of what it thinks are preference keys. Every one of them—and there will be hundreds—must be examined for anything that looks interesting. Suddenly you’re not just feeling around in the dark for the light switch. Now you’re wearing boxing gloves too.

Finding interesting stuff takes lots of time, plus pure intuition and common sense. It can help to know Apple’s codenames for certain features: MeetingRoom appears to refer to AirDrop, for example (and is a better name if you ask me). Ubiquity refers to iCloud. Springboard refers to Launchpad. For what it’s worth I figured out these by guesswork, plus trial and error. Once you identify a key that looks interesting, you then have to work out whether it takes a string value, an integer, or (most likely of all) a Boolean value. This can be done by testing it out on a working system using the defaults write command. At this point you’ll also see what effect—if anything—applying the new key actually has. Does it do anything at all? Perhaps its effect is so subtle that it’s nearly impossible to spot, or maybe it relates to the smallest functionality of an already very minor function. The only way to find out is to play with the app in question—click this, then that, and set this function working, and stop that other function.

Did I mention that this can be mind-bendingly difficult work? But on the other hand, finding something awesome makes it all worthwhile. Keys can be removed from the preferences plist file using the defaults delete command.

Hack Categories

Experience has shown me that keys uncovered by gdb fall into one of a few categories. Firstly, they might be keys that you can already set via the Preferences dialog. gdb finds these too, and this can catch out the unwary hacker who might believe he’s stumbled upon a gem when, in fact, that same gem is just a few clicks away for every single user.

Secondly, the preference key might simply be a dud. It doesn’t do anything. This might be because either gdb has returned something that isn’t actually a preference key, or the key is an orphan—it was connected to something once upon a time, but not any longer. There do seem to be many preference keys from very early versions of OS X that simply haven’t been removed when the functionality moved on. Some might even date from the NeXTSTEP days, from where OS X inherited its preferences system.

Thirdly, the preference key does something but it’s not very interesting or useful. A lot of keys relate to diagnostics and testing of the app in question, or are simply related to the internal plumbing of OS X (configuring the app to work with a particular API, for example). Recently I discovered a key that displayed within Finder the frame rate of Cover Flow animations within Finder (which I wrote up for the OS X Hints site). It’s hard to imagine how this could ever be useful to anybody other than somebody working at Apple, but it was pretty cool nonetheless.

Fourthly, and lastly, there are the gems—the hidden features that are both useful and cool. Perhaps my greatest find was a preferences key that turned on notification pop-outs in the Dock showing what track or movie was currently being played in iTunes. This astonishingly useful feature was included in OS X, yet was entirely hidden. Sadly, it’s been removed from Mountain Lion. However, for the second edition of Mac Kung Fu I’ve discovered gems that include preference keys that let you resize icons in Launchpad, turn off the Dock’s new smoked-glass visual effect, and activate a global setting that automatically unhides the scrollbars when the mouse cursor hovers over them (fixing one of the major irritations with OS X Mountain Lion when using trackpads).

There are others, and many of them I genuinely couldn’t manage without during everyday computer use, such as a hidden drag and drop mode in Finder that makes scrolling the window by dragging a file to its edges significantly more intuitive and useful. And I would go insane without the hack that turns off dialog boxes zooming out from the middle of the screen.


Some less-knowledgeable individuals have the impression that there are billions of defaults write options out there—if only somebody could figure them out! I’ve even seen people attempt to guess preference keys based on things that sound likely!

The bare fact is that while hidden defaults write options and their associated secrets come about for various reasons, many of the best from our perspective are the detritus of Apple’s programmers. Metaphorically speaking, we’re rummaging around in the dumpster around the back of Apple HQ. Because Apple is Apple, even the stuff they throw away can be pretty exceptional.

I suspect although can’t prove that Apple’s developers are aware of how useful many of us find these hidden features. Although some get removed with each new release of OS X (such as the iTunes notifications I mentioned earlier), a surprising number of them stick around once they’ve been discovered.

My theory? Folks at Apple find these secret settings useful too. After all, Apple’s corporate offices contain the world’s biggest contiguous group of Mac users.

If you decide to became a defaults write hacker, and uncover something interesting, be sure to share it in the Mac Kung Fu forums. If I use it in a future edition of the book I’ll give you a credit!

Keir Thomas is the author of Ubuntu Kung Fu and two editions Mac Kung Fu for Pragmatic Bookshelf. He recently signed-on to write a fourth book due next year. He describes himself as a 100% unofficial Mac and Linux "genius" who takes pride in writing computing books everyday users need and value — entertaining, readable, and full of useful knowledge. A former computer magazine editor and professional blogger, he switched to full-time authoring in 2005. He lives in the UK, is vegan, and his website is

Send the author your feedback or discuss the article in the magazine forum.