Welcome to the MacNN Forums.

Roderick · Jun 2, 2005, 09:31 PM

Hi.

I was trying the old tutorial to change the cursor with HexEdit and Photoshop modifying the CoreGraphics file, but the values in the CoreGraphics file seem to have changed. Anybody knows where the cursor(s) are defined at present or how to find out?

I believe the original info was discovered by desktopper.net but they're gone.

Also, this is not a question about MightyMouse, before I get twenty replies telling me to use that. :-)

dru · Jun 4, 2005, 04:03 PM

Originally Posted by Roderick

Hi.

I was trying the old tutorial to change the cursor with HexEdit and Photoshop modifying the CoreGraphics file, but the values in the CoreGraphics file seem to have changed. Anybody knows where the cursor(s) are defined at present or how to find out?

I believe the original info was discovered by desktopper.net but they're gone.

Also, this is not a question about MightyMouse, before I get twenty replies telling me to use that. :-)

Get MightyMouse.

Now... how do you find things in CoreGraphics? Well first off, work on a copy... use a resource editor (I like Resourcerer) to look at the Data fork and copy chunks of data from it and into a NEW resource, save the resource and open it in Photoshop (or GraphicConverter) as RAW. Tell Photoshop the thing is 16 pixels wide. Do this until you finally see the arrows. I suppose you could open the whole CoreGraphics file as raw but that's going to require ample patience, RAM and well... have fun... If you use Graphic Converter, you might need to pick a different color space on import until you can see the cursor properly.

It's been awhile since I went through this but this is what I did myself. Took me maybe an hour to get through a pre-Tiger Coregraphic file and find the cursors I wanted. Even if you had desktopper's info, the location seems to change from one release to the next so it wouldn't help.

Good luck!

Zimphire · Jun 5, 2005, 12:27 AM

Thanks for the info dru

Roderick · Jun 6, 2005, 09:15 AM

Thanks dru.

I don't want MightyMouse. :-)

The whole CoreGraphics file can be opened in a couple of seconds by Photoshop, at least in my old G4 PB. However, what I do not know is how to find the cursor in it. With the desktopper data it was a matter of seconds to replace it. You had the data range (numbers), you opened CoreGraphics in HexEdit, exported the data as .raw, imported in Photoshop, modified, re-imported to CoreGraphic. Voila. Couple of minutes at most.

As you said, the numbers have changed, and no idea how to find the correct range of data now...

CDragon · Aug 19, 2012, 05:09 PM

I didn't want to use MightyMouse because it adds some code to every running process and I didn't want to risk that code interfering with the software I develop. So, based on the offsets mentioned in this discussion, I found the cursor icons in a /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics file from Tiger. Knowing what the icons looked like in binary form, I used HexEdit to find the same bytes in a Snow Leopard CoreGraphics file. I copied the area around those bytes and opened in Photoshop using Open As > Photoshop RAW. Through experimentation I found that you must tell Photoshop the image is 16 pixels wide for the bar cursor or 24 for the standard arrow cursor, 4 channels, interleaved, 8 bits, and 0 header. It will also demand that you provide the height of the image which you can get by dividing the file size (displayed at the top of the Photoshop dialog) by 4, and then divide again by 16 or 24, depending on which width you've entered.

The thing that really delayed me is that changing any of the cursors I found had no effect. After a lot of experimenting I finally found there are actually three copies of the mouse cursors in CoreGraphics. I'm guessing the first copy is used on 32 bit systems, the second on 64 (or it might be reversed), and the third copy is for PowerPC and has something like every two or four bytes reversed so the cursor data is slightly different but still visible in Photoshop. Because of the byte reversal, the PowerPC cursor I'd found started with bytes 55 55 55 55 FF 00 00 00 and when I searched for those bytes elsewhere in the file, they weren't found. Instead, I ended up opening the first half of CoreGraphics in Photoshop at 24 pixels wide (you can't open the entire CoreGraphics at 24 pixels wide because it's taller than 300000 pixels, Photoshop's limit) and hitting pagedown till I saw an arrow cursor. Then I hit pagedown for awhile again and found a second arrow cursor. I ended up going through the whole file and there are exactly three sets of the same cursors.

Anyway, I don't know if this still holds true on Lion or Mountain Lion, but you CAN edit the CoreGraphics file while Snow Leopard is running. You must start HexEdit as root from a Terminal app with this command:
sudo /Applicatons/HexEdit.app/Contents/MacOS/HexEdit

Make sure “Save Backup Files” is turned on or it gets an error when you try to save.

Open a search dialog in HexEdit, make sure it's set to look for Hex instead of ASCII, and search for:

55555555000000FF000000FF

Or, if using PowerPC, search for 55555555FF000000FF000000 instead.

The first match you find is the one my system is using. The whole thing is 0x400 bytes long and looks like this in its entirety:
55 55 55 55 00 00 00 FF 00 00 00 FF 00 00 00 00
00 00 00 00 55 55 55 55 00 00 00 FF 00 00 00 FF
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 55 55 55 55 00 00 00 FF
55 55 55 55 00 00 00 FF 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 55 55 55 55 00 00 00 FF
00 00 00 FF 00 00 00 FF 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55
00 00 00 FF 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 55 55 55 55 00 00 00 FF
55 55 55 55 00 00 00 FF 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
55 55 55 55 00 00 00 FF 00 00 00 FF 00 00 00 00
00 00 00 00 55 55 55 55 00 00 00 FF 00 00 00 FF
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

You might want to replace a few lines with all FF, save, and restart OSX to see if you modified the cursor you wanted to. That's as far as I got because when I finally got the cursor to change, I found the i-beam in XCode had NOT changed and that was the only reason I wanted to change the system i-beam.

I can tell you that OSX 10.6.8 doesn't complain that CoreGraphics was changed despite it having a "_CodeSignature" folder in the same folder. I haven't done any research as to how OSX uses the code signature but it could be that it will notice the change eventually and try to repair it with the next Software Update or something.

I can also tell you that I believe the bytes that make up the icon represent red, green, blue, and transparent. Every four bytes is a single pixel. So 00 00 00 FF is fully opaque black while 55 55 55 55 is about 1/3 opaque and 1/3 black (light grey).

Also, the 0x400 bytes that come after the shadowed bar cursor represent the non-shadowed bar cursor, but I haven't found any apps that use it. The 0x900 bytes above the shadowed bar cursor are the default arrow cursor, and it looks like all the frames of the beachball cursor are not far below the ibeams. Wouldn't it be fun to change the beachball into a rolling smiley and freak out your friends?

Other cursors in CoreGraphics include a smaller, non-shadowed arrow and an arrow with some odd bars at its lower right.

If you want to change other system cursors, see here

If you want to change the XCode bar cursor, I later figured out how to do that too.