Reading the undocumented MEMS accelerometer on Apple Silicon MacBooks via iokit
80 points
8 hours ago
| 10 comments
| github.com
| HN
seductivebarry
5 hours ago
[-]
Way back in ~2008 I wrote the Newton Virus https://www.everita.com/how-the-newton-virus-was-made + https://www.youtube.com/watch?v=eh75j6OHhRc (sorry for the broken images, need to update that site). Between that and using a hidden API to take screenshots of each individual element on your desktop (from icons, to taskbar, to windows) the effect was pretty believable. One of the most fun (and frustrating) projects I ever worked on.
reply
swiftcoder
4 hours ago
[-]
Offtopic, but I have nostalgic feelings for the era of MacBook in the video
reply
tmslnz
4 hours ago
[-]
Troika! Hello from a friend in London :)
reply
47282847
24 minutes ago
[-]
I would like an app to lock my screen on sudden movement; optionally disable TouchID for next login.
reply
ohyoutravel
21 minutes ago
[-]
Maybe you’re also interested in having it start the fuse on your thermite pot, that you have time to stop if it turns out it’s not the FBI raiding your house for what’s on your hard drive?
reply
krackers
5 hours ago
[-]
>have a hard to find mems accelerometer managed by the sensor processing unit

How did OP even know that an accelerometer exists in the first place?

reply
rustyhancock
5 hours ago
[-]
The presence of the sensor is well documented as part of Apples Sudden Motion Sensor hard drive protection system.

How to access it is undocumented.

reply
future10se
5 hours ago
[-]
Aaackshually, the Sudden Motion Sensor was introduced on 2005 in the PowerBook G4, and continued through the intel MacBooks with hard drives.

While officially undocumented, people figured out how to access it back then, with novel uses like smacking your MacBook to change spaces (virtual desktops) or swinging the Mac around to make lightsaber noises.

- https://www.youtube.com/watch?v=6uvQTTPr9Rw

- https://osxdaily.com/2006/12/06/macsaber-turn-your-mac-into-...

(I should know, I was in university back then and swung my Mac around like an idiot, lol.)

On the first Retina MacBook Pro 15" in 2012, and moving forward with all MacBooks that were SSD-only, they removed the SMS as it was not needed.

To my knowledge, this is the first time we're hearing that Apple Silicon machines have an accelerometer on the SoC, officially or otherwise. It's also certainly not branded or marketed as the SMS was. (https://support.apple.com/en-us/100871)

Happy to be corrected on this!

reply
1e1a
2 hours ago
[-]
I think there's some sort of motion sickness reducing feature in MacOS Tahoe which would require an accelerometer.
reply
nerdsniper
5 hours ago
[-]
Given that current drives don't have moving parts, what function is this serving today?
reply
juggerl6
2 hours ago
[-]
Void warranty if dropped
reply
nerdsniper
6 minutes ago
[-]
Has anyone reported this happening?
reply
argsnd
4 hours ago
[-]
Apple has a motion sickness mitigation feature that displays dots on your screen that move based on physical motion, so it’s fairly well known that the accelerometer exists.
reply
mschuster91
1 hour ago
[-]
That's for iOS devices though
reply
angulardragon03
1 hour ago
[-]
It’s also for macOS
reply
nom
57 minutes ago
[-]
No.
reply
saagarjha
5 hours ago
[-]
> the sensor lives under AppleSPUHIDDevice in the iokit registry, on vendor usage page 0xFF00, usage 3. the driver is AppleSPUHIDDriver which is part of the sensor processing unit.
reply
1e1a
2 hours ago
[-]
On my M4 14-inch MacBook Pro, it looks like there are two accelerometers: One with {"DeviceUsagePage"=0xff00,"DeviceUsage"=3}, and one with {"DeviceUsagePage"=0xff00,"DeviceUsage"=9} - They both identify as Bosch BMI286
reply
1e1a
1 hour ago
[-]
Ah, after some testing, it looks like these both refer to the same IMU, DeviceUsage=3 is for the accelerometer and DeviceUsage=9 is for the gyroscope. The serial number is also the same for both.
reply
userbinator
5 hours ago
[-]
undocumented

The one thought that comes to mind is this: "Your warranty claim was denied because we determined that the laptop was subjected to a sudden shock."

reply
consp
5 hours ago
[-]
Back in the days this was to lock up the hard disk read/write head. Maybe a relic from those times instead?
reply
userbinator
5 hours ago
[-]
Apple is not known for backwards-compatibility, and they were already using SSDs in their laptops long before switching to ARM.
reply
sysguest
5 hours ago
[-]
idk you can just use simple liquid-container or sticker?

maybe apple was preparing for "carrying-around laptop experience"?

reply
XorNot
5 hours ago
[-]
That's an entirely different product build path compared to the electronics production line though.

If a pick and place machine can drop it on and reflow it, that's what you want.

reply
sysguest
5 hours ago
[-]
well it would be hardened when contact with air or something

see "Shipping Damage Indicators"

reply
altairprime
5 hours ago
[-]
Did it park the drive heads?
reply
greyface-
6 hours ago
[-]
reply
JSR_FDED
4 hours ago
[-]
If it can read your heartbeat from your wrists resting next to the trackpad, maybe it can use that as a user satisfaction signal for gratuitous UI changes.
reply
pbhjpbhj
4 hours ago
[-]
If it's sensitive enough to read a heart beat, then surely it can be used as a covert microphone?
reply
gavinsyancey
1 hour ago
[-]
The laptop also contains a normal microphone. You can't access this without root; if you have that you have permissions to access the real microphone.
reply
nottorp
54 minutes ago
[-]
... but think how much "engagement" a "security expert" would get out of this!
reply
Quppi
2 hours ago
[-]
From testing, it seems to require me to press my wrists quite hard against the macbook to get a somewhat accurate reading on the heartbeat. Non the less a cool project and I wasn't even aware my macbook has an accelerometer.
reply
rcxdude
3 hours ago
[-]
Depends on the bandwidth.
reply
rcxdude
3 hours ago
[-]
depends on the bandwidth
reply
1e1a
2 hours ago
[-]
I've been wondering about this for a while, glad someone's finally managed to access it.
reply
ggm
4 hours ago
[-]
Could this be used as "shake your mac for highly random seed" bits?
reply
mlajtos
1 hour ago
[-]
Shake your Mac to undo would be consistent with iPhone, iPad, Vision Pro. Yes, you shake your head to undo when wearing AVP.
reply
RupertSalt
1 hour ago
[-]
This is a milder version of “Shake to Reboot” which is standard for all Etch-a-Sketch models
reply
c22
4 hours ago
[-]
Probably not as random as you want it to be.
reply
sysguest
3 hours ago
[-]
well wouldn't it add up?

someWhatRandom1 xor someWhatRandom2 xor notRandom3 xor ...

should be more 'random' than just 'someWhatRandom1'

reply
throawayonthe
3 hours ago
[-]
i'm not sure it would necessarily be more random if you're mixing in a lower-entropy source which the accelerometer probably is
reply
LoganDark
3 hours ago
[-]
XOR is the worst hashing function imaginable, especially if the data isn't truly random, because it can cancel out to become even less random!

It's better to use a KDF or something. Even a block cipher should work far better than XOR.

reply
LoganDark
3 hours ago
[-]
I wonder if this sensor is used for Vision Pro display mirroring.
reply
1e1a
2 hours ago
[-]
I think it's used for the motion sickness reducing feature in MacOS Tahoe that puts a bunch of dots on your screen that react to motion.
reply