Virtual Analogy

Do you need to debug your plugin in a DAW but you can not attach XCode debugger. Well, there is this script. Just run:

chmod a+x add_debug_entitlement.sh 
 ./add_debug_entitlement.sh  /Applications/Ableton\ Live\ 11.3\ Beta.app

The script ( Apple documentation ):

#! /bin/bash
# Simple Utility Script for allowing debug of hardened macOS apps.
# This is useful mostly for plug-in developer that would like keep developing without turning SIP off.
# Credit for idea goes to (McMartin): https://forum.juce.com/t/apple-gatekeeper-notarised-distributables/29952/57?u=ttg
# Update 2022-03-10: Based on Fabian's feedback, add capability to inject DYLD for sanitizers.
#
# Please note:
# - Modern Logic (on M1s) uses `AUHostingService` which resides within the system thus not patchable and REQUIRES to turn-off SIP.
# - Some hosts uses separate plug-in scanning or sandboxing. 
#     if that's the case, it's required to patch those (if needed) and attach debugger to them instead.
#
# If you see `operation not permitted`, make sure the calling process has Full Disk Access.
# For example Terminal.app is showing and has Full Disk Access under System Preferences -> Privacy & Security
#
app_path=$1

if [ -z "$app_path" ];
then
    echo "You need to specify app to re-codesign!"
    exit 0
fi

# This uses local codesign. so it'll be valid ONLY on the machine you've re-signed with.
entitlements_plist=/tmp/debug_entitlements.plist
echo "Grabbing entitlements from app..."
codesign -d --entitlements - "$app_path" --xml >> $entitlements_plist || { exit 1; }
echo "Patch entitlements (if missing)..."
/usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.disable-library-validation bool true" $entitlements_plist
/usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.allow-unsigned-executable-memory bool true" $entitlements_plist
/usr/libexec/PlistBuddy -c "Add :com.apple.security.get-task-allow bool true" $entitlements_plist
# allow custom dyld for sanitizers...
/usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.allow-dyld-environment-variables bool true" $entitlements_plist
echo "Re-applying entitlements (if missing)..."
codesign --force --options runtime --sign - --entitlements $entitlements_plist "$app_path" || { echo "codesign failed!"; }
echo "Removing temporary plist..."
rm $entitlements_plist

Mac

MacVim – text editor (Free)
DaisyDisk – disk usage management tool (Paid)
MachOView – binary explorer (Free)
homebrew – package manager (Free)
ParallelsDesktop – running Windows on mac (Paid)
XCode – … (Free)
ImHex – hex editor (Free)

Win

gVim – text editor (Free)
VisualStudio + vim plugins – … (Paid/Free)
chocolatey – package manager (Free)
ImHex – hex editor (Free)

Mac’n’Win

Cyberduck – (S)FPT – client (Free)
SmartSVN – SVN client (Free/Paid)
Araxis Merge – merging tool (Paid)
VeraCrypt – disk encryption tool (Free)
doubleCommander – file explorer (Free)
ImHex – hex editor (Free)

Debian

Eclise – IDE (Free)
gVim – text editor (Free)
doubleCommander – file explorer (Free)
ImHex – hex editor (Free)
Midnight Commander

First figure out what current vendors does. Open terminal and do this to find out which AUs declare themselves as sandbox (un)safe.

find /Library/Audio/Plug-Ins/Components -name "Info.plist" -exec grep -sl sandboxSafe {} \; | xargs -I {} /usr/libexec/PlistBuddy -c 'Print :AudioComponents:0:sandboxSafe' {} > 2.tx

paste 1.txt 2.txt | sort > sandboxsafe.txt

find /Library/Audio/Plug-Ins/Components -name "Info.plist" -exec grep -sl sandboxSafe {} \; > 1.txt                                                                                  

And which one uses resourceUsage tag:

find /Library/Audio/Plug-Ins/Components -name "Info.plist" -exec grep -sl resourceUsage {} \; > 3.txt

find /Library/Audio/Plug-Ins/Components -name "Info.plist" -exec grep -sl resourceUsage {} \; | xargs -I {} /usr/libexec/PlistBuddy -c 'Print :AudioComponents:0:resourceUsage' {} > 4.txt

paste 3.txt 4.txt | sort -f > resourceUsage.txt

In my installed plugins I found out some interesting points:

• MHThumb declares itself as sandbox unsafe and uses resourceUsage tag – GarageBand doesn’t require lowering the security settings.
• Youlean Loudness meter declares itself as sandbox safe and uses resourceUsage tag – GarageBand doesn’t require lowering the security settings.
• SoundToys doesn’t use either option – GarageBand requires lowering the security settings.
• Melodyne uses just resourceUsage tag – GarageBand requires lowering the security settings.
• Replika XT just declares itself as sandbox unsafe – GarageBand requires lowering the security settings.

PS: To reset GarageBand security settings open a terminal and paste:

defaults delete com.apple.audio.SandboxHelper app.com.apple.garageband10