Ran into a mystery today. Inside my ~/Library/Preferences
directory were two files
that had short names, unidentifable, cryptic names that contained obscure Unicode.
$ cd ~/Library/Preferences
$ ls -l | tail -n 2 This shows two strange files
-rw-rw-r--@ 1 root admin 240 Oct 13 2020 …hgdlkf
-rw-rw-r--@ 1 wls staff 240 Dec 19 2020 …^?fiilh
When doing a search, this article seems to indicate that the hdglkf
file was
MAMP PRO's doing. I certainly hope that is not the case,
I love those folks.
The files are 240 bytes each, containing binary. Maybe it's a license or some piece of saved state... but it certainly isn't following the Apple filenaming conventions for this directory.
A little closer inspection shows the filenames are really mangled. This is not discorruption, it's obfucation.
$ ls -1 *dlk* *iilh | od -a -t x1
. . . h g d l k f . .
e2 80 a6 68 67 64 6c 6b 66 c2 a0
. . . del f i i l h
e2 80 a6 7f 66 69 69 6c 68
The Unicode e2 80 a6
(U+2026) is the HORIZONTAL ELLIPSIS. The Unicode c2 a0
(U+00A0) is the NO-BREAK SPACE.
The Finder has a problem showing these files.
With GNU bash, version 3.2.57(1)-release (x86_64-apple-darwin18), the only way I can even type these files is with wildcarding like this:
$ ls -l@e *hgdlkf* *fiilh
Due to trailing Unicode, this won't catch the first:
$ ls -1 *hgdlkf # Remember, there's a hidden no-break space
The com.apple.FinderInfo 32
, which appears in the directory listing makes the file(s)
not visible from Finder. One fixes that with:
$ xattr -d com.apple.FinderInfo *fiilh
For now I've moved both files to a holding file outside of Preferences to assess the fall out.
For what it's worth, MAMP PRO still seems to start, acknowledge I'm registered, and shows all my resources.