About | Buy | Forum | Industry Watch | Learning Curve | Products | Search | Twitter | Xnews
Home » Products » Reviews » The Very Ugly » eyeHide 2.0

eyeHide 2.0: Collateral Damage

Jaan Patterson
Rating: (four burnt toasts)

Jaan Patterson
Speicherstraße 44
Frankfurt Am Main D-60327 DE
+49 6997945949 jaanone@mac.com


Collateral damage:
At least €5 for your files held hostage in a bait and switch

Taken Hostage?

eyeHide was supposed to stop usage after five launches - what would it do if it thought a user had somehow launched it 999 times? The first part of that answer's simple: it simply bumps the key 'startMeup' to '1000'. The other part is unexpected.

Thank goodness this is only a toy and even a preschooler can get the files out.

How It Works

Everything is in the script. Script kiddies don't write any code to speak of - they don't know how.

The script itself is saved in binary 'run-only' format (natch) so you can't see what they're doing (or so they think).

But that doesn't stop Xstrings. The following is pruned a bit - do take time to look at what's inside. You'll see a few further tricks are used - such as the special user/system flags.

You'll also see how the app checks for updates (click here for a sample) and you'll find the support mail address for the app. You'll also find several inspirational messages. So do have a look.

0000000000000000 FasdUAS 1.101.10
0000000000000111 appversion
000000000000011d appVersion
000000000000012f foldername
000000000000013b folderName
000000000000014d thedot
0000000000000155 theDot
0000000000000163 thedir
000000000000016b theDir
0000000000000179 thedirname
0000000000000185 theDirName
0000000000000197 thedirnamez
00000000000001a4 theDirNamez
00000000000001b7 thediskname
00000000000001c4 theDiskName
00000000000001d7 volname
00000000000001e0 volName
00000000000001ef firstrun
00000000000001f9 firstRun
0000000000000209 firsthelp
0000000000000214 firstHelp
0000000000000225 helprun
000000000000022e helpRun
000000000000023d donated
000000000000024e thepass1
0000000000000258 thePass1
0000000000000268 getthepath
0000000000000274 getthePath
0000000000000286 createhidden
000000000000029c openhidden
00000000000002a8 openHidden
00000000000002ba deletehidden
00000000000002c8 deleteHidden
00000000000002dc deleterecent
00000000000002ea deleteRecent
000000000000030b tsum
0000000000000326 adde
0000000000000334 fadde
0000000000000343 idid
000000000000035f wfaddei
0000000000000370 faddei
0000000000000380 startmeup
000000000000038b startmeUp
0000000000000399 .coVScliInull
00000000000003ae obj 
00000000000003ba openpanel
00000000000003c5 openPanel
00000000000003d6 openpanel1
00000000000003e2 openPanel1
00000000000003f4 openpanel2
0000000000000400 openPanel2
0000000000000412 closepanel
000000000000041e closePanel
0000000000000430 closepanel1
000000000000043d closePanel1
0000000000000450 closepanel2
000000000000045d closePanel2
000000000000046d .appSactVnull
0000000000000482 obj 
000000000000048b .appSwiFLnull
00000000000004a0 obj 
00000000000004a9 .appSlauNnull
00000000000004be obj 
00000000000004c7 .appSwilQnull
00000000000004dc obj 
00000000000004e5 .menSchMInull
00000000000004fa obj 
0000000000000503 .appSshoCnull
0000000000000518 obj 
0000000000000521 .coVSactTnull
0000000000000536 obj 
0000000000000542 nofeed
000000000000054a noFeed
0000000000000558 setprefs
0000000000000562 setPrefs
0000000000000572 getprefs
000000000000057c getPrefs
000000000000058c registersettings
000000000000059e registerSettings
00000000000005b6 readsettings
00000000000005c4 readSettings
00000000000005d8 writesettings
00000000000005e7 writeSettings
0000000000000608 asdscriptuniqueidentifier
0000000000000623 ASDScriptUniqueIdentifier
0000000000000651 untitled folder
0000000000000698 eyeHide_crypt
00000000000006ba boovtrue
00000000000006c8 boovtrue
00000000000006d6 boovtrue
00000000000006e4 boovtrue
000000000000071d Thanks for your Support!
000000000000073f MYour donation makes it possible to keep eyeHide development going!
0000000000000783 Thank you!
0000000000000798 Thank you so much!
00000000000007b5 Registered! 
00000000000007cb $Wrong Info! Please register eyeHide!
00000000000007fa boovfals
0000000000000808 msng
0000000000000813 Wrong Information!
0000000000000830 Please verify that everything appears exact the way as in your Infomation email from eyeHide.
000000000000088e If something's wrong, or you need a serial, please contact me at contact@jaanpatterson.com.
00000000000008ea You can do this by choosing -> Help -> Email Developer, from eyeHide's menu!
0000000000000940 boovfals
0000000000000961 .coVScliInull
0000000000000976 obj 
0000000000000987 theobject
0000000000000992 theObject
00000000000009c5 theobject
00000000000009d0 theObject
00000000000009e1 myobject
00000000000009eb myObject
00000000000009fb thepass2
0000000000000a05 thePass2
0000000000000a15 old_delim
0000000000000a28 the_error
0000000000000a3b the_icon
0000000000000a4d the_result
0000000000000a61 the_button
0000000000000a82 thepass3
0000000000000a8c thePass3
0000000000000a9c thepass4
0000000000000aa6 thePass4
0000000000000ab6 getalert
0000000000000ac0 getAlert
0000000000000cb1 pnam
0000000000000cbb TEXT
0000000000000cc6 createHidden
0000000000000cdc cwin
0000000000000ce7 main
0000000000000cf6 Enter a Password...
0000000000000d13 texF
0000000000000d1e feedBack
0000000000000d30 pcnt
0000000000000d3b createHiddenpw
0000000000000d55 openpanel
0000000000000d60 openPanel
0000000000000d70 getPass
0000000000000d82 createHiddenpw
0000000000000d9a seTF
0000000000000da5 pass1
0000000000000db5 createHiddenpw
0000000000000dce pass2
0000000000000dde Password does not match!
0000000000000e00 as A
0000000000000e0a EAlTinfA
0000000000000e18 mesS
0000000000000e23 Please retype your Password!
0000000000000e49 attT
0000000000000e54 createHiddenpw
0000000000000e70 .panSdisAnull
0000000000000e85 obj 
0000000000000e90 main
0000000000000e9f Password not verified!
0000000000000ec0 feedBack
0000000000000ed3 333333
0000000000000ede .sysodelanull
0000000000000ef3 nmbr
0000000000000eff nofeed
0000000000000f07 noFeed
0000000000000f14 main
0000000000000f23 Password verified!
0000000000000f40 feedBack
0000000000000f53 createHiddenpw
0000000000000f6d closepanel
0000000000000f79 closePanel
0000000000000f89 prmp
0000000000000f93 ;Please locate where you want to have your folder created...
0000000000000fd8 .sysostflalis
0000000000000fed null
0000000000001001 txdl
0000000000001017 cobj
0000000000001021 citm
000000000000103c Enter a name:
0000000000001053 dtxt
000000000000105d btns
0000000000001068  Cancel 
0000000000001087 dflt
0000000000001091 disp
000000000000109f .panSdlognull
00000000000010b4 obj 
00000000000010be ttxt
00000000000010c8 bhit
00000000000010d3  Cancel 
00000000000010fb alis
0000000000001106 An item with the name 
0000000000001129  already exists in 
0000000000001149 . Try again.
000000000000115f ret 
000000000000116a createHiddenpw
0000000000001183 main
0000000000001192 Creating Folder...
00000000000011af feedBack
00000000000011c2 createHiddenpw
00000000000011db mkdir 
00000000000011eb psxp
00000000000011f5 strq
00000000000011fe .sysoexecTEXT
0000000000001213 TEXT
000000000000121e chmod 700 
0000000000001233 echo 
0000000000001244 writesettings
0000000000001253 writeSettings
0000000000001267 Your Folder 
000000000000127e  has been successfully created!
00000000000012a8 Your folder 
00000000000012bf  will be opened!
00000000000012df open 
00000000000012ef main
00000000000012fd butT
0000000000001308 createHidden
000000000000131e enaB
0000000000001329 openHidden
000000000000133e deleteHidden
0000000000001362 createHiddenpw
000000000000137b File exists
0000000000001391 Attention!
00000000000013a6 The folder name already exists
00000000000013ce  in the location you have chosen!
00000000000013f9 0Please choose a new name for your hidden folder,
0000000000001435 or choose a different location.
000000000000145f main
000000000000146e createHidden
0000000000001485 openHidden
000000000000149a deleteHidden
00000000000014b1 openHidden
00000000000014d1 openHiddenpw
00000000000014e8 pass3
00000000000014f8 openHiddenpw
0000000000001510 openpanel1
000000000000151c openPanel1
000000000000152d getPass2
0000000000001540 openHiddenpw
0000000000001557 pass3
0000000000001567 Wrong Password!
0000000000001581 Please retype your Password!
00000000000015a8 openHiddenpw
00000000000015ca openHiddenpw
00000000000015e1 pass3
00000000000015f1 main
0000000000001600 Password not verified!
0000000000001621 feedBack
0000000000001634 main
0000000000001643 Password verified!
0000000000001660 feedBack
0000000000001673 chmod 700 
0000000000001687 useD
0000000000001691 kocl
000000000000169b defE
00000000000016a5 insh
00000000000016af prdt
00000000000016ba getthePath
00000000000016cd .corecrel****
00000000000016e2 null
00000000000016eb .appSregInull
0000000000001700 obj 
000000000000170c readsettings
000000000000171a readSettings
000000000000172d openHiddenpw
0000000000001745 closepanel1
0000000000001752 closePanel1
0000000000001764 main
0000000000001773 Opening Folder...
000000000000178f feedBack
00000000000017a2 open 
00000000000017b2 main
00000000000017c1 Folder not found...
00000000000017df feedBack
00000000000017f1 #Your Folder does not exist anymore!
000000000000181f >Please choose "Create a Hidden Folder" to create a new folder.
0000000000001869 openHiddenpw
0000000000001880 main
000000000000188f createHidden
00000000000018a6 openHidden
00000000000018bb deleteHidden
00000000000018d2 deleteHidden
00000000000018f4 deleteHiddenpw
000000000000190d pass4
000000000000191d deleteHiddenpw
0000000000001937 openpanel2
0000000000001943 openPanel2
0000000000001954 getPass3
0000000000001967 deleteHiddenpw
0000000000001980 pass4
0000000000001990 Wrong Password!
00000000000019aa Please retype your Password!
00000000000019d1 deleteHiddenpw
00000000000019f5 deleteHiddenpw
0000000000001a0e pass4
0000000000001a1e main
0000000000001a2d Password not verified!
0000000000001a4e feedBack
0000000000001a61 main
0000000000001a70 Password verified!
0000000000001a8d feedBack
0000000000001aa0 chmod 700 
0000000000001ab5 deleteHiddenpw
0000000000001acf closepanel2
0000000000001adc closePanel2
0000000000001aee main
0000000000001afd Deleting Folder...
0000000000001b1a feedBack
0000000000001b2c 3Are you sure you want to delete your Hidden Folder?
0000000000001b6a TPlease make sure your hidden Folder is empty! Otherwise it will be deleted, forever!
0000000000001bc9 othB
0000000000001bd4 Cancel
0000000000001be5 Cancel
0000000000001bf6 rm -rf 
0000000000001c08 thePass1
0000000000001c1b firstHelp
0000000000001c2f firstRun
0000000000001c42 Your Folder has been deleted!
0000000000001c69 5Choose "Create Folder" to create a new hidden Folder.
0000000000001caa main
0000000000001cb9 main
0000000000001cc8 createHidden
0000000000001cdf openHidden
0000000000001cf4 deleteHidden
0000000000001d0b deleteRecent
0000000000001d21 staB
0000000000001d2b #Your Folder does not exist anymore!
0000000000001d59 *Choose "Create Folder" to use this option.
0000000000001d8f deleteHiddenpw
0000000000001da8 main
0000000000001db7 createHidden
0000000000001dce openHidden
0000000000001de3 deleteHidden
0000000000001dfa deleteRecent
0000000000001e1e cancelCreate
0000000000001e40 createHiddenpw
0000000000001e59 pass1
0000000000001e74 createHiddenpw
0000000000001e8d pass2
0000000000001e9d createHiddenpw
0000000000001eb6 cancelOpen
0000000000001ed6 openHiddenpw
0000000000001eed pass3
0000000000001efd openHiddenpw
0000000000001f14 cancelDelete
0000000000001f36 deleteHiddenpw
0000000000001f4f pass4
0000000000001f5f deleteHiddenpw
0000000000001f86 goin
0000000000001fa2 goin
0000000000001fcb getprefs
0000000000001fd5 getPrefs
0000000000001fef .panScloPnull
0000000000002004 obj 
000000000000200e )http://www.jaanpatterson.com/support.html
0000000000002041 .GURLGURLnull
0000000000002056 TEXT
0000000000002061 main
000000000000206e .coreclosnull
0000000000002083 obj 
000000000000208e cancelGoin
00000000000020b0 idid
00000000000020bd .aevtquitnull
00000000000020d2 obj 
0000000000002b45 openpanel
0000000000002b50 openPanel
0000000000002b7c createHiddenpw
0000000000002ba2 thepanel
0000000000002bac thePanel
0000000000002bc9 cwin
0000000000002bd4 createHiddenpw
0000000000002bec attT
0000000000002bf7 main
0000000000002c04 .panSdisQnull
0000000000002c19 obj 
0000000000002c53 openpanel1
0000000000002c5f openPanel1
0000000000002c8c openHiddenpw
0000000000002cb0 thepanel
0000000000002cba thePanel
0000000000002cd7 cwin
0000000000002ce2 openHiddenpw
0000000000002cf8 attT
0000000000002d03 main
0000000000002d10 .panSdisQnull
0000000000002d25 obj 
0000000000002d5f openpanel2
0000000000002d6b openPanel2
0000000000002d98 deleteHiddenpw
0000000000002dbe thepanel
0000000000002dc8 thePanel
0000000000002de5 cwin
0000000000002df0 deleteHiddenpw
0000000000002e08 attT
0000000000002e13 main
0000000000002e20 .panSdisQnull
0000000000002e35 obj 
0000000000002e6f closepanel
0000000000002e7b closePanel
0000000000002ea8 createHiddenpw
0000000000002ed0 panel_wins
0000000000002f06 cwin
0000000000002f16 pcls
0000000000002f20 panN
0000000000002f2a pnam
0000000000002f34 leng
0000000000002f3e cobj
0000000000002f47 .panScloPnull
0000000000002f5c obj 
0000000000002fc7 closepanel1
0000000000002fd4 closePanel1
0000000000003002 openHiddenpw
0000000000003028 panel_wins
000000000000305e cwin
0000000000003068 pcls
0000000000003072 panN
000000000000307c pnam
0000000000003086 leng
0000000000003090 cobj
0000000000003099 .panScloPnull
00000000000030ae obj 
0000000000003119 closepanel2
0000000000003126 closePanel2
0000000000003154 deleteHiddenpw
000000000000317c panel_wins
00000000000031b2 cwin
00000000000031bc pcls
00000000000031c6 panN
00000000000031d0 pnam
00000000000031da leng
00000000000031e4 cobj
00000000000031ed .panScloPnull
0000000000003202 obj 
000000000000326a .appSactVnull
000000000000327f obj 
0000000000003290 theobject
000000000000329b theObject
00000000000032b8 theobject
00000000000032c3 theObject
00000000000032df cwin
00000000000032ea main
00000000000032f7 .appSshoHnull
000000000000330c obj 
0000000000003318 nofeed
0000000000003320 noFeed
0000000000003353 .appSwiFLnull
0000000000003368 obj 
0000000000003379 theobject
0000000000003384 theObject
00000000000033a1 theobject
00000000000033ac theObject
0000000000003460 cwin
000000000000346b main
000000000000347a reading...
000000000000348e texF
0000000000003499 feedBack
00000000000034ab pcnt
00000000000034b7 registersettings
00000000000034c9 registerSettings
00000000000034e1 readsettings
00000000000034ef readSettings
0000000000003503 setprefs
000000000000350d setPrefs
0000000000003528 butT
0000000000003533 idid
0000000000003541 staB
0000000000003550 long
0000000000003568 idid
0000000000003576 bool
0000000000003580 msng
0000000000003598 idid
00000000000035a7 Please Register Me!
00000000000035c5 main
00000000000035d4 notReg
00000000000035e5 goin
00000000000035f3 attT
00000000000035fe main
000000000000360b .panSdisPnull
0000000000003620 obj 
000000000000362b Please Register Me!
0000000000003649 main
0000000000003658 notReg
0000000000003680 idid
000000000000369a main
00000000000036a9 notReg
00000000000036b9 useD
00000000000036c3 kocl
00000000000036cd defE
00000000000036d7 insh
00000000000036e1 prdt
00000000000036eb pnam
0000000000003706 .corecrel****
000000000000371b null
0000000000003726 idid
0000000000003733 .appSregInull
0000000000003748 obj 
0000000000003753 main
0000000000003762 createHidden
0000000000003778 enaB
0000000000003783 openHidden
0000000000003798 deleteHidden
00000000000037af deleteRecent
00000000000037c6 chmod 700 
00000000000037da psxp
00000000000037e4 strq
00000000000037ed .sysoexecTEXT
0000000000003802 TEXT
000000000000380d main
000000000000381c createHidden
0000000000003833 openHidden
0000000000003848 deleteHidden
000000000000385f deleteRecent
0000000000003876 firstHelp
000000000000388a createHiddenpw
00000000000038a4 openpanel
00000000000038af openPanel
00000000000038be <Please enter any given Password to create your hidden folder
0000000000003905 as A
000000000000390f EAlTinfA
000000000000391d mesS
0000000000003927 3Enter your desired Password twice for verification!
0000000000003965 ret 
000000000000396f &Please do not use your Admin Password!
00000000000039a1 Please Note:
00000000000039b7 kThe Finder will be restarted after quitting eyeHide to avoid using "Recent Folders", which will be deleted!
0000000000003a2c .panSdisAnull
0000000000003a41 obj 
0000000000003a4c main
0000000000003a5b ready...
0000000000003a6e feedBack
0000000000003d3f .appSlauNnull
0000000000003d54 obj 
0000000000003d65 theobject
0000000000003d70 theObject
0000000000003d93 theobject
0000000000003d9e theObject
0000000000003daf soft_info
0000000000003dc2 firstn
0000000000003dca firstN
0000000000003dd8 lastn
0000000000003ddf lastN
0000000000003e5f "system_profiler SPSoftwareDataType
0000000000003e8b .sysoexecTEXT
0000000000003ea0 TEXT
0000000000003eaa ctxt
0000000000003eb4 cpar
0000000000003ec3 cwor
0000000000003ed2 useD
0000000000003edc kocl
0000000000003ee6 defE
0000000000003ef0 insh
0000000000003efa prdt
0000000000003f04 pnam
0000000000003f0f helpRun
0000000000003f20 pcnt
0000000000003f2e .corecrel****
0000000000003f43 null
0000000000003f4c .appSregInull
0000000000003f61 obj 
0000000000003f6c eyeHide will launch 6 times...
0000000000003f94 ret 
0000000000003f9e Hif you like it, you can support eyeHide development by buying a license.
0000000000003ff1 as A
0000000000003ffb EAlTinfA
0000000000004009 mesS
0000000000004014 You will be enabled to receive life time upgrades for eyeHide! Email will be sent to you after donating, with additional informa
0000000000004094 tion.
00000000000040a3 PIf you have not yet donated, please choose "Buy license" from eyeHide Help Menu.
00000000000040fe -The fee is only 5
0000000000004111 !! for lifetime upgrades!!!
0000000000004136 attT
0000000000004140 cwin
000000000000414b createHiddenpw
0000000000004162 .panSdisAnull
0000000000004177 obj 
0000000000004181 msng
0000000000004198 butT
00000000000041a3 idid
00000000000041b1 staB
00000000000041bc goin
00000000000041cb main
00000000000041d8 .panSdisPnull
00000000000041ed obj 
00000000000041f8 Please Register Me!
0000000000004216 main
0000000000004224 texF
000000000000422f notReg
0000000000004240 open 
000000000000424f psxp
0000000000004259 strq
000000000000426e Attention!
0000000000004283 Your hidden folder is open!
00000000000042a9 Please recover your files now!
00000000000042d1 aYou will not be able to access your hidden Folder anymore with eyeHide until you have registered!
000000000000433e .0-10
000000000000434e Please Register Me!
000000000000436c main
000000000000437b notReg
00000000000043b5 OfEc
000000000000451c .appSwilQnull
0000000000004531 obj 
0000000000004542 theobject
000000000000454d theObject
000000000000456c theobject
0000000000004577 theObject
00000000000045e0 cwin
00000000000045eb main
00000000000045fa Preparing Folder...
0000000000004617 texF
0000000000004622 feedBack
0000000000004634 pcnt
0000000000004640 writesettings
000000000000464f writeSettings
0000000000004663 main
0000000000004672 Quit
0000000000004681 feedBack
00000000000046a0 butT
00000000000046ab idid
00000000000046b9 staB
00000000000046c3 ,defaults delete com.jaanpatterson.eyeHide fW
00000000000046f9 .sysoexecTEXT
000000000000470e TEXT
0000000000004723 main
0000000000004732 createHidden
0000000000004748 enaB
0000000000004753 deleteHidden
000000000000476a openHidden
000000000000477f deleteRecent
0000000000004796 main
00000000000047a5 Quit
00000000000047b4 feedBack
00000000000047c7 main
00000000000047d5 opaA
00000000000047e4 alpV
00000000000047fa .sysodelanull
000000000000480f nmbr
000000000000481a main
0000000000004829 deleteRecent
000000000000483f /defaults delete com.apple.finder recent-folders
000000000000487a killall Finder
00000000000049f1 .menSchMInull
0000000000004a06 obj 
0000000000004a17 theobject
0000000000004a22 theObject
0000000000004a4f theobject
0000000000004a5a theObject
0000000000004a6b myobject
0000000000004a75 myObject
0000000000004a85 checkresults
0000000000004a9b thereply
0000000000004aa5 theReply
0000000000004ab5 buttonclicked
0000000000004ad9 nuburn
0000000000004ae1 nuBurn
0000000000004aef theresult
0000000000004afa theResult
0000000000004b0b getfile
0000000000004b14 getFile
0000000000004c6c pnam
0000000000004c76 TEXT
0000000000004c81 softwareUpdate
0000000000004c9a Update at jaanpatterson.com!
0000000000004cc0 cwin
0000000000004ccb main
0000000000004cd9 texF
0000000000004ce4 feedback
0000000000004cf6 pcnt
0000000000004d0c .sysodelanull
0000000000004d21 nmbr
0000000000004d2b =curl http://www.jaanpatterson.com/versions/eyeHideVersion.txt
0000000000004d72 .sysoexecTEXT
0000000000004d87 TEXT
0000000000004d92 Found newer version!
0000000000004db1 main
0000000000004dc0 feedback
0000000000004dd2 "There is a new version of eyeHide 
0000000000004dff 8 available. Would you like to Download  the new eyeHide 
0000000000004e43  version now?
0000000000004e5a btns
0000000000004e7f dflt
0000000000004e97 disp
0000000000004ea5 .panSdlognull
0000000000004eba obj 
0000000000004ec4 bhit
0000000000004edd downloading ...
0000000000004ef7 main
0000000000004f06 feedback
0000000000004f18 6http://www.jaanpatterson.com/release/files/eyeHide.dmg
0000000000004f58 .GURLGURLnull
0000000000004f6d TEXT
0000000000004f8d main
0000000000004f9c feedback
0000000000004fba main
0000000000004fc9 feedback
0000000000004fe7 main
0000000000004ff6 feedback
0000000000005008 =Congratulations! You are using the latest version of eyeHide!
0000000000005050 as A
000000000000505a EAlTinfA
0000000000005068 mesS
0000000000005073 Be Welcome to try again later!
000000000000509b attT
00000000000050a6 main
00000000000050b3 .panSdisAnull
00000000000050c8 obj 
00000000000050de main
00000000000050ed feedback
000000000000510d No Internet Connection found!
0000000000005135 main
0000000000005144 feedback
0000000000005156 OCould not establish a internet connection, please check your internet settings.
00000000000051b1 main
00000000000051cb main
00000000000051da feedback
00000000000051ed licenseMenu
0000000000005202 HThanks for using eyeHide! You will receive lifetime Updates and Support!
0000000000005256 Later
0000000000005266 PayPal
0000000000005277 Kagi
0000000000005285 givu
0000000000005295 PayPal
00000000000052a5 :Thank you so much for Supporting the eyeHide development!!
00000000000052ea kYou will be registered to receive life time support for eyeHide! Email will be sent shortly after donating.
0000000000005361 main
000000000000536e .miscactvnull
0000000000005383 null
000000000000538d useD
0000000000005397 kocl
00000000000053a1 defE
00000000000053ab insh
00000000000053b5 prdt
00000000000053c0 firstRun
00000000000053d6 .corecrel****
00000000000053eb null
00000000000053f4 .appSregInull
0000000000005409 obj 
0000000000005413 Xhttps://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=stermachine%40gmail%2ecom&item_name=eyeHide&item_number=1&amount=5%2
0000000000005493 e00&no_shipping=1&return=http%3a%2f%2fwww%2ejaanpatterson%2ecom%2fthanks%2ehtml&cancel_return=http%3a%2f%2fwww%2ejaanpatterson%2
0000000000005513 ecom%2f&cn=Optional%20Message&tax=0¤cy_code=EUR&bn=PP%2dDonationsBF&charset=UTF%2d8
0000000000005577 Kagi
0000000000005585 :Thank you so much for Supporting the eyeHide development!!
00000000000055ca kYou will be registered to receive life time support for eyeHide! Email will be sent shortly after donating.
0000000000005641 main
0000000000005650 firstRun
0000000000005662 <http://store.kagi.com/cgi-bin/store.cgi?storeID=6FDQT_LIVE&&
00000000000056ab writesettings
00000000000056ba writeSettings
00000000000056ce deleteItems
00000000000056e4 Deleting Recent Finder Items
000000000000570b main
000000000000571a feedback
000000000000572c 4rm ~/Library/Preferences/com.apple.recentitems.plist
000000000000576b /defaults delete com.apple.finder recent-folders
00000000000057a6 killall Finder
00000000000057d7 main
00000000000057e6 feedback
00000000000057f9 emailSupport
0000000000005810 mailto: eyeHide@gmail.com
0000000000005834  ?subject=Help :   
0000000000005852 eyeHide 
0000000000005865 getLicversion
000000000000587c "http://www.jaanpatterson.com/store
00000000000058aa webSite
00000000000058bb (http://www.jaanpatterson.com/eyehide.php
00000000000058ef createDmg
0000000000005902 RPlease enter a name for the 700MB encrypted SPARSE Disk... Spaces are not allowed!
000000000000595f dtxt
0000000000005969 ttxt
0000000000005973 prmp
000000000000597d IChoose, where do you want to place the 700MB encrypted SPARSE Disk Image?
00000000000059d0 .sysostflalis
00000000000059e5 null
00000000000059fd psxp
0000000000005a07 strq
0000000000005a12 ;hdiutil create 
0000000000005a2c ; -megabytes 700 -encryption -type SPARSE -fs HFS+ -volname 
0000000000005a73 Your Disk Image 
0000000000005a8e  has been successfully created!
0000000000005ab7 $You may start using your Disk Image 
0000000000005ae6 c by double clicking the Disk Image to open it. Then you are able to copy files into the Disk Image.
0000000000005b55 File exists
0000000000005b6a 3Please choose a new name! A Disk Image by the name 
0000000000005ba8 ! already exists in this location!
0000000000005bd4 [Please select your Disk Image you wish to create, either with a new name or a new location.
0000000000005c3b Only one image
0000000000005c53 0Please Note! Spaces are not allowed in the name.
0000000000005c8e ZPlease choose a new name without spaces in the name for the Disk Image you wish to create.
0000000000005cf4 Authentication
0000000000005d0c 6Disk Image has not been created, no password provided!
0000000000005d4d =To create a encrypted Disk Image you must provide a password!
0000000000005d96 burnDmg
0000000000005da7 DPlease Note! If you want to cancel, simply press Command and Period!
0000000000005df6 .Command, is the key with the Apple on it ; ) !
0000000000005e2f ret 
0000000000005e39 =The burning may take a while because the files get verified!.
0000000000005e81 8Where is the .dmg or .sparseImage file you want to Burn?
0000000000005ec4 lfiv
0000000000005ecd .sysostdfalis
0000000000005ee2 null
0000000000005eed Burning...
0000000000005f02 main
0000000000005f11 feedback
0000000000005f24 hdiutil burn  
0000000000005f3d Burning .dmg file is done!
0000000000005f62 main
0000000000005f89 main
0000000000005f98 feedback
0000000000005fab lockFolder
0000000000005fbf *Please select the Folder you want to LOCK.
0000000000005ff5 chflags uchg  
000000000000600e unLockFolder
0000000000006024 ,Please select the Folder you want to UNLOCK.
000000000000605c chflags nouchg  
000000000000661e .appSshoCnull
0000000000006633 obj 
0000000000006644 theobject
000000000000664f theObject
000000000000666c theobject
0000000000006677 theObject
000000000000668c .aevtquitnull
00000000000066a1 obj 
00000000000066c9 .coVSactTnull
00000000000066de obj 
00000000000066ef theobject
00000000000066fa theObject
0000000000006717 theobject
0000000000006722 theObject
0000000000006753 nofeed
000000000000675b noFeed
000000000000678c cwin
0000000000006797 main
00000000000067b0 texF
00000000000067bb feedback
00000000000067cd pcnt
0000000000006803 setprefs
000000000000680d setPrefs
0000000000006835 cancelgoin
0000000000006841 cancelGoin
0000000000006853 renm
0000000000006859 reNM
0000000000006896 cwin
00000000000068ad butT
00000000000068b8 idid
00000000000068c6 staB
00000000000068d1 goin
00000000000068e0 cancelGoin
00000000000068f4 *defaults read com.jaanpatterson.eyeHide fW
0000000000006928 .sysoexecTEXT
000000000000693d TEXT
0000000000006948 .8-29
0000000000006957 ,defaults delete com.jaanpatterson.eyeHide fW
000000000000698f goin
000000000000699d texF
00000000000069a8 adMe
00000000000069b6 pcnt
00000000000069c1 goin
00000000000069cf attT
00000000000069da main
00000000000069e7 .panSdisPnull
00000000000069fc obj 
0000000000006a14 idid
0000000000006adc getprefs
0000000000006ae6 getPrefs
0000000000006b0e renm
0000000000006b14 reNM
0000000000006b20 cancelgoin
0000000000006b2c cancelGoin
0000000000006b5f *defaults read com.jaanpatterson.eyeHide fW
0000000000006b93 .sysoexecTEXT
0000000000006ba8 TEXT
0000000000006bb3 .8-29
0000000000006bc2 ,defaults delete com.jaanpatterson.eyeHide fW
0000000000006bf9 cwin
0000000000006c10 butT
0000000000006c1b idid
0000000000006c29 staB
0000000000006c4b idid
0000000000006c5a goin
0000000000006c69 cancelGoin
0000000000006d07 registersettings
0000000000006d19 registerSettings
0000000000006d78 useD
0000000000006d82 kocl
0000000000006d8c defE
0000000000006d96 insh
0000000000006da0 prdt
0000000000006daa pnam
0000000000006db5 helpRun
0000000000006dc6 pcnt
0000000000006dd9 .corecrel****
0000000000006dee null
0000000000006e06 startMeup
0000000000006e1a idid
0000000000006e29 firstRun
0000000000006e3c donated
0000000000006e4e firstHelp
0000000000006e62 thePass1
0000000000006e75 getthePath
0000000000006e8a createHidden
0000000000006ea1 deleteHidden
0000000000006eb8 openHidden
0000000000006ecd deleteRecent
0000000000006ee2 .appSregInull
0000000000006ef7 obj 
000000000000706f readsettings
000000000000707d readSettings
00000000000070ca useD
00000000000070d4 defE
00000000000070df helpRun
00000000000070f0 pcnt
0000000000007108 startMeup
000000000000711b long
0000000000007126 idid
0000000000007135 firstRun
0000000000007148 donated
000000000000715a firstHelp
000000000000716e thePass1
0000000000007181 getthePath
0000000000007196 createHidden
00000000000071ad deleteHidden
00000000000071c4 openHidden
00000000000071d9 deleteRecent
00000000000072be writesettings
00000000000072cd writeSettings
0000000000007319 useD
0000000000007323 defE
000000000000732e helpRun
000000000000733f pcnt
0000000000007357 idid
0000000000007366 startMeup
000000000000737a firstRun
000000000000738d donated
000000000000739f firstHelp
00000000000073b3 thePass1
00000000000073c6 getthePath
00000000000073db createHidden
00000000000073f2 deleteHidden
0000000000007409 openHidden
000000000000741e deleteRecent
000000000000758f var1
000000000000759d var2
00000000000075ab var3
00000000000075b9 the_user
000000000000765c psof
0000000000007672 psin
0000000000007680 .sysooffslong
0000000000007695 null
00000000000076ab leng
00000000000076ba pi  
00000000000076ce long
00000000000076e1 .sysorondlong
00000000000076f6 doub
0000000000007701 EYE-v2.0-108766818
000000000000771d cwin
0000000000007728 goin
0000000000007736 texF
0000000000007741 adMe
000000000000774f pcnt
0000000000007759 as A
0000000000007763 EAlTinfA
0000000000007771 mesS
000000000000777a .panSdisAnull
000000000000778f obj 
00000000000077a6 butT
00000000000077b1 idid
00000000000077bf staB
00000000000077c9 ,defaults delete com.jaanpatterson.eyeHide fW
00000000000077ff .sysoexecTEXT
0000000000007814 TEXT
000000000000781e .defaults delete com.jaanpatterson.eyeHide idid
00000000000078ab 0-10
00000000000078ba goin
00000000000078d6 USER
00000000000078e3 .fndrgstl****
00000000000078f8 ****
0000000000007903 goin
0000000000007912 adMe
0000000000007921 goin
0000000000007930 added
000000000000794b main
000000000000795a notReg
0000000000007978 idid
0000000000007986 useD
0000000000007990 kocl
000000000000799a defE
00000000000079a4 insh
00000000000079ae prdt
00000000000079b8 pnam
00000000000079d3 .corecrel****
00000000000079e8 null
00000000000079f3 idid
0000000000007a00 .appSregInull
0000000000007a15 obj 
0000000000007a20 goin
0000000000007a2f adMe
0000000000007a4b idid
0000000000007a59 ,defaults delete com.jaanpatterson.eyeHide fW
0000000000007a90 .defaults delete com.jaanpatterson.eyeHide idid
0000000000007d59 eyeHide.applescript
0000000000007d70 ascr

The total tally of destruction on your HDD for this sucker is summed up by Xfind. Over 650 KB effective disk storage. For a bloody script. That puts a 'dot' in front of a file name, runs chflags, makes DMGs ('hdiutil burn') and stores passwords in plain text.

43 items, 370965 bytes, 1104 blocks, 99416 bytes in resource forks.

/Volumes/eyeHide/.DS_Store
/Volumes/eyeHide/.Trashes
/Volumes/eyeHide/.VolumeIcon.icns
/Volumes/eyeHide/Drop here...
/Volumes/eyeHide/eyeHide.app
/Volumes/eyeHide/eyeHide.app/Contents
/Volumes/eyeHide/eyeHide.app/Contents/Info.plist
/Volumes/eyeHide/eyeHide.app/Contents/MacOS
/Volumes/eyeHide/eyeHide.app/Contents/MacOS/eyeHide
/Volumes/eyeHide/eyeHide.app/Contents/PkgInfo
/Volumes/eyeHide/eyeHide.app/Contents/Resources
/Volumes/eyeHide/eyeHide.app/Contents/Resources/against.gif
/Volumes/eyeHide/eyeHide.app/Contents/Resources/back.tif
/Volumes/eyeHide/eyeHide.app/Contents/Resources/closed-folder.gif
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Credits.rtf
/Volumes/eyeHide/eyeHide.app/Contents/Resources/database.gif
/Volumes/eyeHide/eyeHide.app/Contents/Resources/edit.gif
/Volumes/eyeHide/eyeHide.app/Contents/Resources/English.lproj
/Volumes/eyeHide/eyeHide.app/Contents/Resources/English.lproj/InfoPlist.strings
/Volumes/eyeHide/eyeHide.app/Contents/Resources/English.lproj/MainMenu.nib
/Volumes/eyeHide/eyeHide.app/Contents/Resources/English.lproj/MainMenu.nib/classes.nib
/Volumes/eyeHide/eyeHide.app/Contents/Resources/English.lproj/MainMenu.nib/data.dependency
/Volumes/eyeHide/eyeHide.app/Contents/Resources/English.lproj/MainMenu.nib/info.nib
/Volumes/eyeHide/eyeHide.app/Contents/Resources/English.lproj/MainMenu.nib/keyedobjects.nib
/Volumes/eyeHide/eyeHide.app/Contents/Resources/eyeHide.icns
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/EnterPass.png
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/eyeHide.html
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/eyeHide.png
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/eyeHide128.png
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/eyeHide54.png
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/eyeHideFAQ.html
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/eyeHideHistory.html
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/eyeHideQuickStart.html
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/eyeHideStyles.css
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/Help.helpindex
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Help/Main.png
/Volumes/eyeHide/eyeHide.app/Contents/Resources/open-folder.gif
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Scripts
/Volumes/eyeHide/eyeHide.app/Contents/Resources/Scripts/eyeHide.scpt
/Volumes/eyeHide/Icon
/Volumes/eyeHide/jaanpatterson.webloc
/Volumes/eyeHide/License.rtf

Lessons Learned?

Pigs in pokes often turn out to be cats.
Learn some Unix before you run out of money.
Don't believe people who say they can hide things for you.
If you need to protect data then lock it away with Unix file permissions.

Final Word!

This 'exposé' of yet another blithering script kiddie app is not meant as a criticism of the author. On the contrary: the test team fervently hope that given enough time he can graduate into real programming.

Nor is it meant as a criticism of OS X user intelligence. On the contrary. Only of user ambition.

See Also
Tracker: Don't trust it - track it

About | Buy | Forum | Industry Watch | Learning Curve | Products | Search | Twitter | Xnews
Copyright © Rixstep. All rights reserved.