Walt Stoneburner's Ramblings

Currating Chaos

Strange Preference Files

Ran into a mystery today. Inside my ~/Library/Preferences directory were two files that had short names, unidentifable, cryptic names that contained obscure Unicode.

$ cd ~/Library/Preferences
$ ls -l | tail -n 2  This shows two strange files
-rw-rw-r--@  1 root  admin     240 Oct 13  2020 …hgdlkf
-rw-rw-r--@  1 wls   staff     240 Dec 19  2020 …^?fiilh

When doing a search, this article seems to indicate that the hdglkf file was MAMP PRO's doing. I certainly hope that is not the case, I love those folks.

The files are 240 bytes each, containing binary. Maybe it's a license or some piece of saved state... but it certainly isn't following the Apple filenaming conventions for this directory.

A little closer inspection shows the filenames are really mangled. This is not discorruption, it's obfucation.

$ ls -1 *dlk* *iilh | od -a -t x1

Binary Characters in the Filenames

 .   .   .  h   g   d   l   k   f   .   .      
e2  80  a6  68  67  64  6c  6b  66  c2  a0

 .   .   .  del f   i   i   l   h
e2  80  a6  7f  66  69  69  6c  68

The Unicode e2 80 a6 (U+2026) is the HORIZONTAL ELLIPSIS. The Unicode c2 a0 (U+00A0) is the NO-BREAK SPACE.

The Finder has a problem showing these files.

With GNU bash, version 3.2.57(1)-release (x86_64-apple-darwin18), the only way I can even type these files is with wildcarding like this:

$ ls -l@e *hgdlkf* *fiilh

Due to trailing Unicode, this won't catch the first:

$ ls -1 *hgdlkf  # Remember, there's a hidden no-break space

The com.apple.FinderInfo 32, which appears in the directory listing makes the file(s) not visible from Finder. One fixes that with:

$ xattr -d com.apple.FinderInfo *fiilh

For now I've moved both files to a holding file outside of Preferences to assess the fall out.

For what it's worth, MAMP PRO still seems to start, acknowledge I'm registered, and shows all my resources.