In the classic Mac days developers could create extensions that could essentially override anything in the Mac operating system. After OS X was released none of those methods worked, but in 2002-2003 for OS X 10.2 (Jaguar) and 10.3 (Panther), developers found a way.
One type of hack used an InputManager dynamic library, which OS X loaded into every application’s process for text handling. Using that hook, in 2003 Mike Solomon created SIMBL (Smart InputManager Bundle Loader) to inject his ad-blocking plugin PithHelmet into Safari. SIMBL was designed as an open source loader for other developers to use.
Once the InputManager library was loaded, the next trick it used was method swizzling, where the library could override the methods in the Cocoa applications.
Eventually Apple killed the InputManagers vector, forcing SIMBL to switch to exploiting Scripting Additions (.osax).
Meanwhile Unsanity released Application Enhancer (APE) in 2002. It used method swizzling for Cocoa applications – same as SIMBL – but it could also change Carbon applications. The Carbon code was changed by aggressive, low-level techniques, such as replacing the memory addresses of Carbon functions with the haxie’s functions (Import Address Table Patching) and directly overriding code.
You know what else uses these techniques? Malware.
And in fact the Carbon IAT patching sounds a lot like a technique that was used to compromise Linux systems in 2024, that almost succeeded. Look up the XZ Utils backdoor (CVE-2024-3094), which exploited a GNU C Library (glibc) feature called IFUNC (Indirect Function) resolvers.
Both are doing the same thing: dynamically patching a function routing table in memory so that the calls are redirected to the injected code.
With System Integrity Protection (SIP) in El Captain, and other changes, these runtime process injection attacks are harder.
Which gets to the point: How do the new Haxies work? They’re not using the old techniques. It looks like they are (ab)using Accessibility features.