KNOCKKNOCK CHANGELOG VERSION 2.3.0 (03/04/2021) added plugin: system extensions VERSION 2.2.1 (02/26/2021) icon++ improved Big Sur compatibility VERSION 2.2.0 (02/25/2021) native support for M1 improved Big Sur compatibility improved plugin: browser extensions (Safari, via pluginkit) VERSION 2.1.1 (11/22/2019) cmd+h now hides app additional error checking in user enumeration(s) VERSION 2.1.0 (11/20/2019) added 'save' icon to main window added plugin: quicklook plugins (@theevilbit) added plugin: directory services plugins (@CodeColorist) improved Catalina compatibility (request for full disk access) VERSION 2.0.5 (12/23/2018) improved (automatic) update check VERSION 2.0.4 (12/23/2018) escape characters (\n, etc) for JSON output VERSION 2.0.3 (12/20/2018) improved JSON output VERSION 2.0.2 (12/19/2018) notarized (by Apple) no icon shown when run w/ cmdline options 'Check for Updates' added to main app menu VERSION 2.0.1 (11/23/2018) integrated version checking improved parsing of JSON output restored compatibility with OSX 10.10 & before VERSION 2.0.0 (11/22/2018) improved mojave support a) privacy checks b) dark mode support command line interface (-h for options) a) outputs JSON to stdout b) run as root (scan all users) view contents of property lists directly in app improved whitelisting (via path + code signing cert) integrated Senty.io error reporting VERSION 1.9.3 (3/28/2018) improved plugin: library inserts (logic bug/memory usage) improved plugin: browser extensions (support for newer versions of Chrome) minor UI fixes VERSION 1.9.2 (3/26/2018) added plugin: event monitor actions fixed autolayout issues on older versions of macOS VERSION 1.9.1 (3/23/2018) improved parsing of launch item plists a) key search now case insensitive (credit: @i0n1c) b) type of 'Program' label now checked (credit: @i0n1c) VERSION 1.9.0 (6/24/2016) added plugin: extensions and widgets (Finder Syncs, etc) VERSION 1.8.0 (6/6/2016) improved UI to show if persistent binaries are packed or 'OS X'-encrypted Launch Daemon/Agent plugin extended to lists items with 'StartInterval'/'StartCalendarInterval' keys Launch Daemon/Agent improved to use 'Program' key (over 'ProgramArguments') when both are present compiled in latest mach-O parser (bug fixes, etc) signing authorities now ignored if code signing checks fail updated hashes & whitelisting for OS X 10.11.5 VERSION 1.7.1 (3/28/2016) fixed bug when processing VirusTotal results in plugins that enumerate files & commands VERSION 1.7.0 (3/27/2016) added plugin: period scripts added plugin: OS startup scripts (/etc/rc*, etc) improved browser extension plugin for newer versions of Firefox & Safari improved login/out hook plugin as payload can be file *or* command improved code signing checks (flags: kSecCSCheckNestedCode|kSecCSStrictValidate) updated whitelist for El Capitan UI fixes, such as file name extraction (via Info.plist when possible, etc. VERSION 1.6.1 (10/8/2015) updated crontab plugin, so it would ignore commented out jobs VERSION 1.6.0 (10/5/2015) made application fully resizable improved 'inserted dylibs' plugin (now checks for __XPC_DYLD_INSERT_LIBRARIES) added self verification check so malicious modifications (e.g. whitelists) may be detected updated whitelist hashes for El Capitan fixed bug where VirusTotal timeout could trigger crash VERSION 1.5.0 (7/19/2015) added Cron Job plugin added Login/Logout Hook plugin improved Launch Daemon/Agent plugin (now includes items with 'OnDemand' set to False) apple-signed binaries now shown with green 'signed' icon fixed issue with copy & paste (via NSApplicationKeyEvents subclass) updated whitelist to include various Apple binaries (kexts) when saving results, user can now specify name and location of output network availability now checked before trying to connect to VirusTotal other minor UI tweaks/improvement (e.g. fixed text color issue in unselected rows, etc.) extra error checking to improve stability VERSION 1.3.1 (5/18/2015) made preferences persistence fixed logic bug where re-scans might hang added extra error checking in launch item plugin VERSION 1.3.0 (5/13/2015) added ability to enumerate login items, installed by sandboxed apps improved vertical scrollbars, so they'd always be rendered in 'modern' style other minor UI tweaks (e.g. pref window clipping) VERSION 1.2.4 (5/4/2015) added timeout to injected dylib scanning plugin improved logic for making windows modal (e.g. window checks) VERSION 1.2.3 (4/30/2015) improved VirusTotal logic (e.g. when an signed OS file was flagged) tweaked UI to be more compatible with OS X 10.9 VERSION 1.2.2 (4/28/2015) browser extensions plugin now supports enumerating extensions in older versions of Safari improved JSON output & fixed bug when saving JSON when file hash or signature was nil recompiled with updated/improved (shared) MachO parser fixed issue where on multiple scans, result popup was not properly updated improved UI to display item's plist (when applicable) into the item's row listed items in item table are now selectable VERSION 1.2.1 (4/25/2015) improved DYLD_INSERT_LIBRARIES plugin to report path to applications' Info.plist as string (instead of URL) fixed issue in DYLD_INSERT_LIBRARIES plugin, where NSInvalidArgumentException would result if enviro var was string VERSION 1.2.0 (4/25/2015) added DYLD_INSERT_LIBRARIES plugin browser extensions plugin now supports enumerating Opera plugins browser extensions plugin improved to enumerate Google Chrome with multiple profiles increased timeouts for making a popups modal (to avoid NSInternalInconsistencyException issues) fixed nil dictionary insertion when processing Safari extensions with missing 'Bundle Identifier' VERSION 1.1.0 (4/24/2015) added plugin to scan for Authorization Plugins fixed NSJSONSerialization bug (parsing Google Chrome plugins) VERSION 1.0.0 (4/23/2015) initial release