DAL plugins don't work in apps with hardened runtime (e.g. in Zoom, Teams, Skype, Safari, Quicktime, Photo Booth etc) about obs-mac-virtualcam HOT 185 OPEN

Unfortunately, I made a mistake with the code I posted earlier. While resigning the code as I mentioned above works, it also completely removes the hardened runtime, which is not great for security. Instead, here is some very poorly written code that should do the following.

1. Get the entitlements as xml
2. Parse it using xml2
3. Add the Disable Library Validation Entitlement to the list
4. Turn it back into an xml file with 2xml and save it as an xml file
5. Using the preserve-metadata option, attempt to change the least amount of things when resigning (including keeping hardened mode on if it was enabled before) while adding the new entitlement.

I tested the below command on Zoom.us, and now I have obs-mac-virtualcam working with Zoom.us's hardened mode enabled.

APPLICATION=/Applications/zoom.us.app && codesign -d --entitlements :- $APPLICATION | { xml2; echo "/plist/dict/key=com.apple.security.cs.disable-library-validation"; echo "/plist/dict/true"; } | 2xml > entitlements.xml && sudo codesign --sign - $APPLICATION --force --preserve-metadata=identifier,resource-rules,flags --entitlements=entitlements.xml && rm entitlements.xml

from obs-mac-virtualcam.

Thank you all for the effort!! This helps a lot.

I confirm @hkatzdev's comment works for the latest zoom! For documentation sake, I wasn't familiar with PropertyLists, but I made it work having the below content for entitlements.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.security.cs.disable-library-validation</key>
	<true/>
</dict>
</plist>

from obs-mac-virtualcam.

@johnboiles I seem to remember someone saying that the Virtual Camera Input for OBS running on Windows works in Zoom. Might be interesting to check what it is being built with in terms of the whitelist?

This is what I have asked the Zoom Support Team:

Is the Virtual Camera support limited to a certain selection of Virtual Camera Inputs, or is there something in particular that this project needs to do in order to be able to work with Zoom?

I will follow up if/when I get a response.

from obs-mac-virtualcam.

For Zoom at least, it is possible to get this to work by resigning it with the Disable Library Validation Entitlement. I signed the latest zoom with sudo codesign --entitlements entitlements.xml -f -s - /Applications/zoom.us.app and have not noticed any issues yet. Perhaps there could be a script that automates this for apps of your choosing?

Edit: Adding the Disable Library Validation Entitlement doesn't appear to be necessary, although if I had to guess that has to do with it not being signed with a certificate (although if zoom.us and the plugin were signed with the same certificate I believe it still wouldn't be necessary). This is definitely not optimal for security reasons but it works.

from obs-mac-virtualcam.

@ChaseOnTheWeb & @budisangithub I was told that Cisco confirmed that the WebEx 'virtual camera' issue is a defect and the fix is allegedly going to be included in the 40.6 release.

from obs-mac-virtualcam.

I believe I found the whitelist:

strings /Applications/zoom.us.app/Contents/Frameworks/nydus.framework/Versions/A/nydus | grep "Developer ID Application"
Developer ID Application: Zoom Video Communications, Inc. (BJ4HAAB9B3)
Developer ID Application: Snap, Inc. (424M5254LK)
Developer ID Application: Visicom Media Inc. (6SUWV7QQBJ)
Developer ID Application: Blackmagic Design Inc (9ZGFBWLSYP)
Developer ID Application: Telestream LLC (WSG985FR47)
Developer ID Application: Wizards of OBS LLC (2MMRE5MTB8)
Developer ID Application: Kinoni Oy (P2N5288CNQ)
Developer ID Application: Boinx Software Ltd. (6372P8EH2J)
Developer ID Application: Ecamm Network, LLC (5EJH68M642)
Developer ID Application: NewTek, Inc. (W8U66ET244)

from obs-mac-virtualcam.

@chrisspiegl, you're in luck! Just announced that Zoom will be fixing the problem in the release slated for today.

"Changes to existing features
Re-enable virtual camera support
Support for virtual cameras will be re-enabled for users on client version 5.0.4."

https://support.zoom.us/hc/en-us/articles/201361963-New-updates-for-macOS

That appears to be the only purpose of this release so they must have gotten a lot of noise on this issue. Way to go to everyone who bugged them and posted about this!

from obs-mac-virtualcam.

@kenlowrie thinking about it... my company is a paying customer if Zoom. I am going to raise a support ticket asking what is required, and I will report back here if I find out anything.

from obs-mac-virtualcam.

Another data point here.

• Catalina 10.15.4
• Xcode 11.4
• Homebrew other bits
• No special security software
• security fin... returns a valid identifier from xcode for my account
• I get the same error whether I use ad-hoc (-) or my hex identifier

code signature in (/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam) not valid for use in process: mapping process is a platform binary, but mapped file is not

Rebooting and/or re-signing does not change this. No action/response needed, I'll keep following this issue on my own. Thanks for digging into this feature so quickly!

from obs-mac-virtualcam.

I am experiencing this issue as well. I was able to get this plugin working on my employer laptop (which I believe is Mojave) but not on my personal computer which is on Catalina.
I am able to see the virtual camera in Hangouts and Quicktime, but not Zoom or Photobooth.
I tried to get a list of available input devices and got the following which makes me think that this is onto something:

$ system_profiler SPCameraDataType

2020-04-04 17:21:25.454 system_profiler[884:23513] Error loading /Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam:  dlopen(/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam, 0x0106): code signature in (/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam) not valid for use in process: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)
Camera:

    FaceTime HD Camera (Built-in):

      Model ID: UVC Camera VendorID_1452 ProductID_34304
      Unique ID: 0x[redacted]8600

    HD Pro Webcam C920:

      Model ID: UVC Camera VendorID_1133 ProductID_2093
      Unique ID: 0x[redacted]082d

Hope this helps narrow it down, when this is working it's great!

from obs-mac-virtualcam.

Could it be unable to run even if signed due to Library Validation?
https://developer.apple.com/documentation/security/hardened_runtime
https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-library-validation

Judging from https://nvd.nist.gov/vuln/detail/CVE-2020-11470, it appears that Zoom removed the entitlement in version 4.6.8, which could explain why it works for some people but not others.

I might try installing https://github.com/mologie/macos-disable-library-validation tomorrow in order to see if this is truly the issue.

Since installing the above requires disabling SIP, I just downgraded Zoom.us to 4.6.8. If any of you also want to do so for testing purposes, you can run brew cask install hkatzdev/cask-zoomus-vc/zoomus if you use Homebrew or just download it from https://zoom.us/client/4.6.19178.0323/Zoom.pkg. After downgrading, I was able to use the OBS Virtual Camera. Additionally, another app called CamTwist, which similarly stopped working in later versions of Zoom.us, started working again in the older version.

Therefore, I'm pretty sure it was to do with Library Validation. Unfortunately, I can't think of a good solution that doesn't involve disabling SIP unless Zoom signs the plugin, which would only fix it for Zoom.

from obs-mac-virtualcam.

Thanks again, I have reinstalled zoom and this works perfectly (I just had to use homebrew to install xml2).

from obs-mac-virtualcam.

It may be possible to create a virtual webcam by using the new DriverKit, but that would be macOS 10.15+ and it seems like you need to apply to get a special entitlement to use it. According to this you should be able to turn off System Integrity Protection to test it locally but I haven't tried that and Xcode won't even compile a project with a DriverKit component otherwise.

Also I'm a little surprised the zoom update works, I guess it only checks the signature of the update and not whether old and new version match?

from obs-mac-virtualcam.

I think this https://en.wikipedia.org/wiki/USB_video_device_class would be the correct USB device class to virtualise, the spec is here: https://www.usb.org/document-library/video-class-v15-document-set
a correct UVC implementation could then be picked up by the native macos uvc driver which would probably be the ideal and future proof implementation

the main hurdle, beside the probably sizeable effort, might be communicating between the driverkit driver implementation and another app/obs I don't know if the drivers might be sandboxed in a way that might make this difficult, so testing this first is probably a good idea, but I'm way out of my depth here, I hope this helps someone!

from obs-mac-virtualcam.

On this issue: I was only able to get video in quicktime. While in other apps like photo booth and discord i can select the virtualcam, it won't give output.
For discord the preview shows a black screen, and the actual video shows that it is loading all the time; and for photo booth when i select the virtualcam, the picture of the facetime camera i had before just freezes.
I know we're probably not at this point yet, but I just wanted to inform you about the issue. Also rebooting didn't help.

from obs-mac-virtualcam.

from obs-mac-virtualcam.

DriverKit seems super promising. If anyone can find any DriverKit sample code that implements a camera that would be hugely helpful. I wonder if Apple is going to remove DAL plugins all together at some point

from obs-mac-virtualcam.

There seems to be very little DriverKit code yet, I could only find the code from the USB sample from the WWDC session video https://github.com/knightsc/USBApp

Here are the general debugging docs https://developer.apple.com/documentation/driverkit/debugging_and_testing_system_extensions and this https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_hid_virtual_device?language=objc could be an indicator that it's at least not impossible to create a virtual camera

I think it's not unlikely for apple to remove DAL plugins at some point in the future

from obs-mac-virtualcam.

Seems that CoreMedia DAL is the common means for making virtual cameras work right now; I tried looking at the webcamoid source and it looks to be using the same process. (I know nothing about this- literally acting as a human text filter ;-) )

And looking at /Library/CoreMediaIO/Plug-Ins/DAL/ on my system (Catalina), I see plugins for CamTwistStudio and Webcamoid (AkVirtualCamera.plugin).

I agree, long term, given that we should expect more apps to be hardened, an alternative is needed, but my 2c is abstract the interfaces, and make it work with DAL for now, especially as there are so few DriverKit examples right now, and none re non-HID virtual devices.

I did find this article that was useful as an introduction to DriverKit for the complete noob like me:
https://www.apriorit.com/dev-blog/669-mac-system-extensions.

from obs-mac-virtualcam.

The problem with removing the signature is that it also completely removes the hardened runtime instead of only partly disabling it, which is probably worse for security. Could you please send me a log of Zoom crashing @blackmad? Would like to figure out why - not the first time I've heard that it crashes zoom but an uninstall and reinstall usually works. Also I forgot to mention that you have to install xml2 in homebrew first and only run this command once on an unmodified zoom.

from obs-mac-virtualcam.

Seems like Chromium does a workaround (running a child process with com.apple.security.cs.disable-library-validation=true for video capture) to enable virtual cameras while hardend runtime is on.
I hope Zoom does the same too.

from obs-mac-virtualcam.

From a little sleuthing about @johnboiles request for DriverKit examples of camera drivers, I came across the youtube: https://youtu.be/rD4Ng4okVis which describes some of the major changes that recent OS updates have made to (hardware) device drivers. It looks like, as of Feb 2, any device driver needs to be "notarized" by Apple before it will work--this makes sense since it is a very solid way to make sure no "unauthorized" code is run on an unsuspecting machine. But it also prevents code generated locally from being run on the "platform".

Thus, it seems that this project is stuck in a bit of limbo, it sounds like compiling the driver code locally and even signing it locally will fail in the latest OS Version, so it needs to be distributed in compiled form with a valid and notarized signature??? Maybe going through the process of notarization would work for all?

So far, I have been unable to get the plug-in to work with anything other than Skype & Quicktime. Zoom (I'm on 5.0.1, so it obviously won't work with that), but Photobooth, Hangouts, Discord do not see it, no matter what.

I went ahead and signed it with my Developer ID and notarized it via Apple, and spctl verifies the signing and notarization:

obs-mac-virtualcam.plugin: accepted
source=Notarized Developer ID
origin=Developer ID Application: Kenneth Lowrie (XXXXXXXXXX)

But unfortunately, it still only works with Quicktime and Skype.

So I'm not so sure that the notarization step is going to make any difference... Hopefully someone will figure out a solution soon. :)

from obs-mac-virtualcam.

If you're interested in seeing how I've been using this at scale:
https://www.facebook.com/KostumeKultPage/videos/2948232085290743

Basically layers performers and DJs on top of participants in virtual zoom events. Underground themed .... clearly.

from obs-mac-virtualcam.

The Zoom update (which came out today with the virtual camera support "added") is still giving me

Error loading /Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam:  dlopen(/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam, 262): no suitable image found.  Did find:
	/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam: code signature in (/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam) not valid for use in process using Library Validation: mapping process and mapped file (non-platform) have different Team IDs
	/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam: stat() failed with errno=60

in the console... So I don't know what has actually changed with Zoom.

from obs-mac-virtualcam.

The change needed is in Zoom. The only way this could be made to work without changing Zoom would be if the Zoom team codesigned this plugin. That would solve it for Zoom but not all the other apps with similar issues.

from obs-mac-virtualcam.

@johnboiles Changing the permissions locally (and rebooting to make sure the plugin wasn't cached somewhere) didn't change anything for me, and the codesign checks still passed.

@kenlowrie ah good point, running the stapler validation against snapcam to see if that is any different, looks like it's the same

xcrun stapler validate SnapCamera.plugin                                          
Processing: /Library/CoreMediaIO/Plug-Ins/DAL/SnapCamera.plugin
SnapCamera.plugin does not have a ticket stapled to it.

I haven't found any more clues 😞

from obs-mac-virtualcam.

That's a good point @kenlowrie; maybe it was a mistake. Can't hurt to ask them to add it!

from obs-mac-virtualcam.

Thanks for the additional info @gxalpha! Every bit is helpful to try to understand what is happening!

from obs-mac-virtualcam.

The inconsistency is super frustrating to me -- sometimes macOS allows it to run and sometimes it doesn't. I haven't been able to find a pattern.

I think this will be solved once we make a distribution package of this with a real production code signature. If anyone wants to help get a release infrastructure up and running here that'd be great!

For now, my hack above seems to be working ok when I get into this state where it won't run. To make/retrieve your codesigning identity

1. Make sure you're logged into Xcode with your Apple ID (Xcode->Preferences->Accounts)
2. security find-identity -v -p codesigning to see the available codesigning identities and the associated 40 character hex identifier.
3. Change the CMakeLists.txt file for dal-plugin to use codesign --sign [your 40 char id] instead of codesign --sign -

diff --git a/src/dal-plugin/CMakeLists.txt b/src/dal-plugin/CMakeLists.txt
index c354f13c..a358bfc1 100644
--- a/src/dal-plugin/CMakeLists.txt
+++ b/src/dal-plugin/CMakeLists.txt
@@ -155,6 +155,6 @@ add_custom_command(TARGET dal-plugin

 add_custom_command(TARGET dal-plugin
        POST_BUILD
-       COMMAND /usr/bin/codesign --force --deep --sign - --timestamp=none ${TARGET_DIR}/obs-mac-virtualcam.plugin
+       COMMAND /usr/bin/codesign --force --deep --sign [my 40 char codesign identity] --timestamp=none ${TARGET_DIR}/obs-mac-virtualcam.plugin
        COMMENT "Codesign plugin"
 )

from obs-mac-virtualcam.

Thanks @yasushisakai and @hkatzdev this works fine for me and Zoom 4.6.10 (20041.0408)

from obs-mac-virtualcam.

Yeah thanks @hkatzdev and @yasushisakai, your solution fixed it for me too, Zoom 4.6.10 on Catalina 10.15.3. I can access my Blackmagic capture device again from within Zoom. Cheers!

from obs-mac-virtualcam.

Am I correct in assuming manually resigning third party apps will likely cause issues with their update mechanism?

from obs-mac-virtualcam.

Am I correct in assuming manually resigning third party apps will likely cause issues with their update mechanism?

It appears that for zoom.us (4.6.8-->4.6.10 at least) the app is replaced on an update, which just means that we would have to resign it again. Everything else seems to work. However, it would be a good idea to test with other apps to see if this does lead to a problem.

Also this is definitely not the optimal solution, since it reintroduces CVE-2020-11470. Unfortunately, I don't know of a better, more secure way.

from obs-mac-virtualcam.

Just starting to learn Objective C so I can't help with this issue directly but I got an e-mail from Apple that it's offering some individual consultations to developers. Maybe we could pitch this issue there?

Btw. The xml2 works great for me on Catalina

from obs-mac-virtualcam.

I'm at the same stage as @anoldguy, with "system_profiler SPCameraDataType" giving me the "mapping process is a platform binary, but mapped file is not" and zero functionality from the plug-in across any app. I'm using macOS 10.15.4, so I've been lurking here waiting for someone to come up with a workaround that doesn't disable security.

From a little sleuthing about @johnboiles request for DriverKit examples of camera drivers, I came across the youtube: https://youtu.be/rD4Ng4okVis which describes some of the major changes that recent OS updates have made to (hardware) device drivers. It looks like, as of Feb 2, any device driver needs to be "notarized" by Apple before it will work--this makes sense since it is a very solid way to make sure no "unauthorized" code is run on an unsuspecting machine. But it also prevents code generated locally from being run on the "platform".

Thus, it seems that this project is stuck in a bit of limbo, it sounds like compiling the driver code locally and even signing it locally will fail in the latest OS Version, so it needs to be distributed in compiled form with a valid and notarized signature??? Maybe going through the process of notarization would work for all?

At this point, I'm well beyond my (extremely dated) programming skills, and don't feel that I can contribute more than this. If it's helpful, use it. If it's not, ignore it. Meanwhile, back to lurking....

from obs-mac-virtualcam.

This will be fixed once the new DAL-plugin is implemented.

Which browser are you using to access Hangouts? Chrome should work.

from obs-mac-virtualcam.

FWIW I found hacky workaround for getting this plugin to work with Slack Version 4.5.0 030422a-s@1588375643 (Production).

I wrote up a step by step on my page here, but essentially you can utilize Electron's codesigning tool electron-osx-sign.

electron-osx-sign /Applications/Slack.app \
    --type=development \
    --entitlements="/path/to/entitlements.xml" \
    --gatekeeper-assess=false \

with the same entitlements as above. Not ideal, but works.

from obs-mac-virtualcam.

Has anyone discovered a workaround with Cisco Webex Meetings? As of release 40.2.16.14 or so, use of virtual cameras seems to have been removed.

Removing codesignature from the ~/Library/Application Support/WebEx Folder//Meeting Center.app seems to just break the application from launching meetings.

I've discovered that, after I unsign ~/Library/Application Support/WebEx Folder/<versioned folder>/Cisco Webex Meetings.app (which is apparently called Meeting Center.app in your build), and then try to join a meeting using the standard /Applications/Cisco Webex Meetings.app, nothing happens at all as you observed.

However, if I launch ~/Library/Application Support/WebEx Folder/<versioned folder>/Cisco Webex Meetings.app directly, the meeting launches and I can choose the virtual cameras.

EDIT: It seems that launching the Application Support .app directly loads whatever meeting you last tried to start, so e.g., if I just clicked a web link to start a meeting, it will load that, or if I just clicked a recent room in /Applications/Cisco Webex Meetings.app it will load that.

from obs-mac-virtualcam.

For Zoom users, the workaround to install a backdated version (4.6.8 or earlier) will NO LONGER BE AN OPTION on May 30 due to a required update that Zoom is enforcing related to a move to GCM Encryption.

https://zoom.us/docs/en-us/zoom-v5-admin.html?zcid=1231

from obs-mac-virtualcam.

@johnboiles @gxalpha I was just doing some digging, and I turned up the following...

https://devforum.zoom.us/t/zoom-desktop-does-not-detect-obs-virtual-cam-anymore/9609/21

I don't have OBS on a Windows machine just now, but I am wondering if something was added specifically to handle the OBS Virtual Cam plugin that runs on a Windows machine. If so, it could be that there is an avenue to get this plugin working in Zoom as well.

There is a workaround in the Wiki. It’s under compatibility.

sudo codesign -f -s - /Applications/zoom.us.app

from obs-mac-virtualcam.

@gxalpha to be clear, this is the update that I installed:

@mizt I was able to correctly get the NDI Virtual Input to work in Zoom, but enabling the NDI Output in OBS.

from obs-mac-virtualcam.

@kenlowrie the pkg here is already notarized. Is there a way to also notarize a binary? I'm signing things with a real Apple Distribution certificate but let me know if you know of another step.

Hi @johnboiles. I hadn't seen this before my last reply. I'm not sure about notarizing the individual binary, but I think you are probably correct. I think the notarization is intended more for bundles and packages, and not individual binaries. Although I thought that the notarization process actually extracts all the binaries, scans them for viruses, etc., and then generates some type of hash that it stores for when later when things need to be "validated".

But I don't know for sure, this is mostly speculation on my part.

from obs-mac-virtualcam.

Great find @statik!! That's it!

Ooh Wizards of OBS LLC is in there. So this will magically work once this gets merged into the OBS codebase. In the meantime we have a few options

1. Ask Zoom to add my codesigning to their whitelist
2. Ask the OBS folks to let me use their codesigning certs from this repo
3. Do nothing (keep re-codesigning Zoom manually) and push forward towards getting this ready for merging with the OBS codebase (see #105)

from obs-mac-virtualcam.

The biggest thing I'm unsure about for merging into the OBS codebase is whether we'd be open to merging this in without Windows and Linux support. I don't think that was captured explicitly in the RFC. @dodgepong mentioned the Windows work is happening now, not sure about the Linux work. The time horizon for merging this in is going to greatly depend on that decision.

from obs-mac-virtualcam.

Also interesting that Wizards of OBS LLC is in there at all! That means they must have looked at this plugin and decided they would hold out until was merged into the main OBS codebase. I see no other reason for them to add that codesigning in there since OBS doesn't have any other Mac plugins that Zoom would want to load.

from obs-mac-virtualcam.

Yeah I've been running into sporadic code signing issues. Every now and then macOS will block the plugin from loading. I haven't been able to pin down why it only happens sometimes. Do you see anything in Console.app if you search for virtualcam?

from obs-mac-virtualcam.

It shouldn’t be needed, but after a restart I got it (Google Meet on Chrome, but only shows sometimes on Photo Booth: this also happens with other virtual camera devices)

from obs-mac-virtualcam.

Did you try a Google Meet meeting and the person on the other end was able to see you? I've been having trouble with this (see #2) -- I can see my own preview fine but the person on the other end reports my video as frozen.

from obs-mac-virtualcam.

Yes I’ve seen your other issue. No, it was late and I just was confirming it seemed to work, this was only in the preview. The frame syncing you added didn’t fix the issue?

from obs-mac-virtualcam.

Sure enough, I get the following in Console (even after a reboot):
default 10:00:02.619975 -0700 Photo Booth Error loading /Library/

CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam:  dlopen(/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam, 0x0106): code signature in (/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam) not valid for use in process: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)
default	10:00:02.620077 -0700	Photo Booth	Cannot find function pointer AppleCMIODPSampleVCamPlugIn for factory <CFUUID 0x6000017270c0> 35FDFF29-BFCF-4644-AB77-B759DE932ABE in CFBundle/CFPlugIn 0x7f82913134f0 </Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin> (bundle, not loaded)

FWIW - This is a corporate laptop and it's pretty locked down. (I dont think I could get away with disabling SIP to get some of the other solutions to work).

from obs-mac-virtualcam.

I've gotten this sometimes as well and it's baffling to me. One thing I'm trying is changing my codesigning identity to my personal developer account

diff --git a/src/dal-plugin/CMakeLists.txt b/src/dal-plugin/CMakeLists.txt
index c354f13c..a358bfc1 100644
--- a/src/dal-plugin/CMakeLists.txt
+++ b/src/dal-plugin/CMakeLists.txt
@@ -155,6 +155,6 @@ add_custom_command(TARGET dal-plugin

 add_custom_command(TARGET dal-plugin
        POST_BUILD
-       COMMAND /usr/bin/codesign --force --deep --sign - --timestamp=none ${TARGET_DIR}/obs-mac-virtualcam.plugin
+       COMMAND /usr/bin/codesign --force --deep --sign [my 40 char codesign identity] --timestamp=none ${TARGET_DIR}/obs-mac-virtualcam.plugin
        COMMENT "Codesign plugin"
 )

Then that assigns a Team ID during codesigning. But it doesn't explain why it sometimes works without a team id.

@ChrisWeiss does your locked down corporate laptop have Carbon Black on it? Mine does and I always give that thing a suspicious look when spooky system things like this happen.

from obs-mac-virtualcam.

I have intermittent functionality after reboots, recompiles, etc

right now Im getting

$ system_profiler SPCameraDataType
2020-04-04 19:55:21.258 system_profiler[8078:40898] Error loading /Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam:  dlopen(/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam, 0x0106): code signature in (/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam) not valid for use in process: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)
2020-04-04 19:55:21.258 system_profiler[8078:40898] Cannot find function pointer AppleCMIODPSampleVCamPlugIn for factory 35FDFF29-BFCF-4644-AB77-B759DE932ABE in CFBundle/CFPlugIn 0x7fa31722cbc0 </Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin> (bundle, not loaded)
Camera:

    FaceTime HD Camera:

      Model ID: Apple Camera VendorID_0x106B ProductID_0x1570
      Unique ID: …

from obs-mac-virtualcam.

No Carbon Black, we do have other security tools installed that I can't disclose :) I'll try doing the build on my personal Mac.

Any other information I can provide to help?

from obs-mac-virtualcam.

@anoldguy Thanks for the data point! What software are you using to try to view the webcam stream? I think one part of this is that some software seems more sensitive than others

from obs-mac-virtualcam.

Anything. PhotoBooth, Hangouts, Meet, Zoom, Whereby, Quicktime.

from obs-mac-virtualcam.

Just one more piece of info, as of the latest update to zoom it is not working in either Mojave or Catalina.

Still showing up in quicktime and hangouts for me though.

from obs-mac-virtualcam.

@hkatzdev Thank you for all the info about library validation and the workarounds! The Snap Camera docs also talk about how Zoom 4.6.9+ are not supported.

So here are the codesigning issues we know about:

• Some apps (Zoom, Slack) cannot any DAL plugins that are not signed with the same code signature as the application.
  • Why this happens: The macOS Library Validation security feature does not allow apps to load plugins with different code signatures unless the app explicitly disables library validation.
  • Workarounds: Add the entitlement to disable library validation or download older versions of apps (thanks @hkatzdev!)
• Adhoc codesigning (codesign --sign -) only sometimes works (Console.app shows mapped file has no Team ID and is not a platform binary in the console). This will probably cease to be an issue once we make production certificate codesigned releases.
  • Why this happens: We don't know yet. We haven't figured out the pattern! More research needed.
  • Workaround: codesign with your personal developer certificate.
• System applications (Safari, FaceTime, PhotoBooth) cannot load DAL Plugins (Console.app shows not valid for use in process: mapping process is a platform binary, but mapped file is not) (reported by @anoldguy)
  • Why this happens: Seems to be a macOS security feature to prevent arbitrary code from loading in macOS.
  • Workaround: None so far. 3rd party webcams seem to work though. Is that because the driver for those comes from Apple (for UVC cameras). If we went deeper and emulated hardware could we make it work?

from obs-mac-virtualcam.

@anoldguy can you double check that when using your own signing identity, and trying to open the source in QuickTime and Chrome you get the same not valid for use in process: mapping process is a platform binary, but mapped file is not message?

I want to make sure you didn't copy/paste that log from a system application (like Facetime) and got a different error from other applications (QuickTime, Chrome) that are working for some of us on Catalina.

from obs-mac-virtualcam.

Clean built the project. Current state:

Quicktime: Works
Browser based: Safari, no camera. Firefox, camera, but no video.
OS (Facetime/Photobooth): No camera.

from obs-mac-virtualcam.

@anoldguy and do you get that same platform binary error message when using QuickTime/Firefox? Or only for Safari/Facetime/Photobooth?

from obs-mac-virtualcam.

Agreed. Let's make what we have work first then later we can get DriverKit working.

from obs-mac-virtualcam.

Unfortunately, I made a mistake with the code I posted earlier. While resigning the code as I mentioned above works, it also completely removes the hardened runtime, which is not great for security. Instead, here is some very poorly written code that should do the following.

1. Get the entitlements as xml
2. Parse it using xml2
3. Add the Disable Library Validation Entitlement to the list
4. Turn it back into an xml file with 2xml and save it as an xml file
5. Using the preserve-metadata option, attempt to change the least amount of things when resigning (including keeping hardened mode on if it was enabled before) while adding the new entitlement.

I tested the below command on Zoom.us, and now I have obs-mac-virtualcam working with Zoom.us's hardened mode enabled.

APPLICATION=/Applications/zoom.us.app && codesign -d --entitlements :- $APPLICATION | { xml2; echo "/plist/dict/key=com.apple.security.cs.disable-library-validation"; echo "/plist/dict/true"; } | 2xml > entitlements.xml && sudo codesign --sign - $APPLICATION --force --preserve-metadata=identifier,resource-rules,flags --entitlements=entitlements.xml && rm entitlements.xml

This just made my zoom crash on startup. Removing codesigning entirely worked well

from https://www.reddit.com/r/VIDEOENGINEERING/comments/fy7xi3/fyi_zoom_v4610_breaks_blackmagic_capture_devices/?utm_source=share&utm_medium=web2x

codesign --remove-signature /Applications/zoom.us.app/

from obs-mac-virtualcam.

This will be fixed once the new DAL-plugin is implemented.

Which browser are you using to access Hangouts? Chrome should work.

I'm using Chrome. Version 81.0.4044.129 (Official Build) (64-bit)

Any ETA on the new DAL-plugin release? Do you need any alpha/beta testers? Let me know, I'd be happy to take a look at it as soon as it's ready.

from obs-mac-virtualcam.

@kenlowrie I found the approach described earlier (contributed by @hkatzdev) to work for me:

If you are running an app and do NOT see the virtual camera appear, first check the known bugs. If you believe that it is not a bug, then the app probably has a hardened runtime without the library entitlement. By running remove-library-validation ${APPLICATION}, you can manually add the library entitlement. For example, with Zoom.us you would run remove-library-validation /Applications/Zoom.us.app. Don't worry - it will first back up your app in case something goes wrong. Keep in mind that this can introduce certain (minor in my opinion) security vulnerabilities in apps (see CVE-2020-11470)

For me, the remove-library-validation works with Zoom and GoToMeeting, and the OBS-Mac-VirtualCam appears as an option along with appropriate video.

from obs-mac-virtualcam.

Confirming that Skype for Business 16.28.185 works when you use
codesign --remove-signature /Applications/Skype\ for\ Business.app/

the virtual camera doesn't show as a source without running that.

from obs-mac-virtualcam.

Has anyone discovered a workaround with Cisco Webex Meetings? As of release 40.2.16.14 or so, use of virtual cameras seems to have been removed.

Removing codesignature from the ~/Library/Application Support/WebEx Folder/<versioned folder>/Meeting Center.app seems to just break the application from launching meetings.

I had a similar experience with the com.apple.security.cs.disable-library-validation approach as well.

For now, launching the meeting directly from a Chrome browser still works with the virtual cameras, but it's not a great experience.

We have a support case open with Cisco but I'm not expecting much.

from obs-mac-virtualcam.

@ChaseOnTheWeb - confirmed, I just unsigned ~/Library/Application Support/WebEx Folder//Meeting Place.app/. Launching from /Application/Cisco Webex Meetings.app will change nothing, but launching from ~/Library/Application Support/WebEx Folder//Meeting Place.app/ will allow me to choose the virtual cameras. The problem is, it will only launch my last meeting only.

from obs-mac-virtualcam.

If any of y'all are able I'd love to start collecting these per-app workarounds in the COMPATIBILITY.md file. That will be the place for folks to understand what software supports this plugin out-of-the-pox as well as what workarounds are possible to make different apps work

from obs-mac-virtualcam.

@johnboiles said...
If any of y'all are able I'd love to start collecting these per-app workarounds in the COMPATIBILITY.md file. That will be the place for folks to understand what software supports this plugin out-of-the-pox as well as what workarounds are possible to make different apps work

Would it make sense to open the wiki on this repository? That might be an easier way to update/edit the contents, rather than PR'ing into a single file. Just a thought.

from obs-mac-virtualcam.

🤷 I don't have a strong opinion. @gxalpha has been the most active person in updating the documentation. @gxalpha do you have a preference?

from obs-mac-virtualcam.

It probably would be.
I personally don't have experience with the GitHub wiki, but everything can be learned :D

from obs-mac-virtualcam.

Let's try it and we can always go back if we need.

from obs-mac-virtualcam.

Ok created the wiki and opened it up if anyone wants to work on moving the existing COMPATIBILITY.md file to the wiki

from obs-mac-virtualcam.

@johnboiles @gxalpha I was just doing some digging, and I turned up the following...

https://devforum.zoom.us/t/zoom-desktop-does-not-detect-obs-virtual-cam-anymore/9609/21

I don't have OBS on a Windows machine just now, but I am wondering if something was added specifically to handle the OBS Virtual Cam plugin that runs on a Windows machine. If so, it could be that there is an avenue to get this plugin working in Zoom as well.

from obs-mac-virtualcam.

@jkuepker thank you. yes, I am aware of the workaround, and currently using it. Based on the link above though, I am hoping that a workaround may not be required.

from obs-mac-virtualcam.

Going to close this since I think we've solved all the codesigning issues we can solve on our side with the .pkg installer and distribution codesigning.

from obs-mac-virtualcam.

@johnboiles would it then be an option to provide a detailed tutorial in the readme for people who want to use the Zoom workaround? It's a bit of a pain to read through all of this issue to figure it out — or are you planning a release which already makes this possible in itself?

from obs-mac-virtualcam.

See the wiki https://github.com/johnboiles/obs-mac-virtualcam/wiki/Compatibility#apps-dont-allow-dal-plugins

from obs-mac-virtualcam.

Until now, I am using the package from @hkatzdev ,
https://drive.google.com/file/d/1SuL6BAubTMbXGXgGGvGPz6Bld0w_ovrX/view.

The package from @hkatzdev (1) work with Webex Team (2) work with Webex Web App under Chrome (3) does not work with Webex Desk App

Last night, I tried the pkg from @johnboiles, and follow the steps below :

1. download the pkg-installer artifact from my recent build.

2. uninstall/remove any existing plugin

sudo rm -rf /Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin
sudo rm -rf /Library/Application\ Support/obs-studio/plugins/obs-mac-virtualcam
sudo rm -rf ~/Library/Application\ Support/obs-studio/plugins/obs-mac-virtualcam

3. delete the OBS app and re-install it obs 25.0.8

sudo rm -rf /Applications/OBS.app

4. unzip the pkg-installer.zip file and run the obs-mac-virtualcam-24d867b-pkg-build.pkg file.

Unfortunatelly ...

1. Webex Team : I can select OBS Virtual Cam, but the video does not appear

2. Webex Web App (Chrome) : I can not even select OBS virtual cam (but I can see TwistCam and SnapCamera)

3. Webex Desk App : I can not select OBS Virtual Camera (I also can not see TwistCam and SnapCamera)

So, I delete everything and fall back to pkg from @hkatzdev which at least (1) work with Webex Team (2) work with Webex Web App under Chrome (3) does not work with Webex Desk App

from obs-mac-virtualcam.

I got his working by first installing brew install xml2 to get xml2 (I also have Xcode and the Developer Tools installed on my system which is probably needed for this to work).

And then running the following as one command in the terminal (originally from @thedug):

APPLICATION=/Applications/zoom.us.app \
&& codesign -d --entitlements :- $APPLICATION | { \
xml2; \
echo "/plist/dict/key=com.apple.security.cs.disable-library-validation"; \
echo "/plist/dict/true"; \
} \
| 2xml > entitlements.xml \
&& sudo codesign --sign - $APPLICATION --force --preserve-metadata=identifier,resource-rules,flags --entitlements=entitlements.xml \
&& rm entitlements.xml

I truly hope that Zoom, Skype, and others are going to update their applications again to support these types of virtual sources. It's so damn limiting without them.

from obs-mac-virtualcam.

Wow, that's awesome news and I can't wait to get this update. Especially since I am about to make a video about especially using the OBS Virtualcam. Glad they are open to this and are already in the process of fixing the issue themselves. Could have been faster, but better late than never.

from obs-mac-virtualcam.

@chrisspiegl thank you for the all-in-one command! I had been wanting something like that.

@raypp2 good eye! This is great! I wonder if they're doing it securely like chrome by running the virtual cam DAL plugins in a separate process. Will be interesting to reverse engineer a bit. Hopefully apple does something like this at the OS layer at some point

from obs-mac-virtualcam.

Same here. The good news is that running the entitlements again solves the problem.

from obs-mac-virtualcam.

Same here. The good news is that running the entitlements again solves the problem.

When you say "running the entitlements" what do you mean? I'm not getting an error, the virtual camera just doesn't show up as a camera to pick in Zoom.
[Edit] Ok I figured out. I ran the command that @chrisspiegl shows in a prior comment that he attributes to @thedug Thanks guys.

from obs-mac-virtualcam.

@justincormack @thedug @gbarnabic I was really hoping that the 5.0.4 update of the Zoom Client would allow the Virtual Camera to work without having to do anything extra.

Aside from the change to the entitlements, is there anything that this project can do, i.e. changes in the way that the pkg is made, or is this a change in Zoom itself to allow the Virtual Camera to work?

from obs-mac-virtualcam.

The Zoom update (which came out today with the virtual camera support "added") is still giving me Error

On the zoom website it is still under upcoming, so maybe they released something else and didn't include the virtual camera support

from obs-mac-virtualcam.

The same error occurs on other virtual cameras (NDI Virtual Input), but that can select from the pulldown.

from obs-mac-virtualcam.

I can confirm that with the Zoom 5.0.4 update running on MacOS 10.15.4, I am able to see and activate the Snap Camera virtual camera inside zoom without resigning the zoom application, so it appears that the Zoom update does re-enable virtual cameras. The obs mac virtual cam is not appearing in the list of cameras inside zoom though.

To summarize:
Zoom 5.0.4 without any changes loads these virtual cameras

• Snap Camera
• NDI Virtual Input
• Wirecast Virtual Camera

Unsigning zoom 5.0.4 (I'm not recommending that people do this) means that these other virtual cameras also show up:

• OBS Virtual Camera
• CamTwist

I don't know the underlying technical reason that the OBS and CamTwist plugins are not being listed.

from obs-mac-virtualcam.

I do wonder if Zoom has a whitelist off known Virtual Cameras, perhaps based on the certificate used to sign the pig/dmg, and that is being used to populate the list.

Does anyone have any contacts at Zoom to ask this question?

from obs-mac-virtualcam.

I do wonder if Zoom has a whitelist off known Virtual Cameras, perhaps based on the certificate used to sign the pig/dmg, and that is being used to populate the list.

Does anyone have any contacts at Zoom to ask this question?

I wonder if notarizing the obs-virtual-camera plugin would make a difference? Might be worth a try, unless someone has a contact at Zoom they could ask directly to find out the requirements needed so the virtual camera from obs would also work out of the box...

from obs-mac-virtualcam.

@gep13 thanks for opening a ticket with Zoom. If Snap Camera works but not this plugin, seems very possible they're using a whitelist.

@kenlowrie the pkg here is already notarized. Is there a way to also notarize a binary? I'm signing things with a real Apple Distribution certificate but let me know if you know of another step.

from obs-mac-virtualcam.

For those of you who can see other virtual cameras in Zoom do you still see the mapping process and mapped file (non-platform) have different Team IDs Console.app log referring to obs-mac-virtualcam (like @justincormack mentioned above). If that's the case it seems like there is some extra codesigning hoop we need to jump through.

from obs-mac-virtualcam.

I do see the message

mapping process and mapped file (non-platform) have different Team IDs
	/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam: stat() failed with errno=1

Interestingly, I see those different TeamID messages appearing for SnapCam, Wirecast, and NDI plugins as well.

Not sure if I am interpreting these results correctly, but from everything that I've been able to check locally it seems that the obs-mac-virtualcam plugin is properly notarized, although I'm not familiar with the finer points of stapling.

Comparing Snap Camera

codesign --test-requirement="=notarized" --verify --verbose SnapCamera.plugin
SnapCamera.plugin: valid on disk
SnapCamera.plugin: satisfies its Designated Requirement
SnapCamera.plugin: explicit requirement satisfied

spctl -a -vv -t install SnapCamera.plugin
SnapCamera.plugin: accepted
source=Notarized Developer ID
origin=Developer ID Application: Snap, Inc. (424M5254LK)

to obs-mac-virtualcam

codesign --test-requirement="=notarized" --verify --verbose obs-mac-virtualcam.plugin
obs-mac-virtualcam.plugin: valid on disk
obs-mac-virtualcam.plugin: satisfies its Designated Requirement
obs-mac-virtualcam.plugin: explicit requirement satisfied

spctl -a -vv -t install obs-mac-virtualcam.plugin
obs-mac-virtualcam.plugin: accepted
source=Notarized Developer ID
origin=Developer ID Application: John Boiles (62G85M9ZN5)

then comparing to CamTwist, I see CamTwist is not notarized (as expected)

codesign --test-requirement="=notarized" --verify --verbose CamTwist.plugin
CamTwist.plugin: a sealed resource is missing or invalid

spctl -a -vv -t install CamTwist.plugin
CamTwist.plugin: a sealed resource is missing or invalid

On minor difference that I have spotted is group ownership of the obs-mac-virtualcam bundle being admin instead of wheel:

pwd
/Library/CoreMediaIO/Plug-Ins/DAL
ls -lah *.plugin/                                        
CamTwist.plugin/:
total 0
drwxr-xr-x  3 root  wheel    96B May  2  2019 .
drwxr-xr-x  8 root  wheel   256B May 17 12:28 ..
drwxr-xr-x  6 root  wheel   192B May  2  2019 Contents

NDIVirtualCamera.plugin/:
total 0
drwxr-xr-x  3 root  wheel    96B May  4 16:45 .
drwxr-xr-x  8 root  wheel   256B May 17 12:28 ..
drwxr-xr-x  7 root  wheel   224B May  4 16:45 Contents

SnapCamera.plugin/:
total 0
drwxr-xr-x  3 root  wheel    96B Apr 23 08:45 .
drwxr-xr-x  8 root  wheel   256B May 17 12:28 ..
drwxr-xr-x  6 root  wheel   192B Apr 23 08:45 Contents

WirecastVirtualCamera.plugin/:
total 0
drwxr-xr-x  3 root  wheel    96B Mar 21 01:11 .
drwxr-xr-x  8 root  wheel   256B May 17 12:28 ..
drwxr-xr-x  6 root  wheel   192B Mar 21 01:11 Contents

obs-mac-virtualcam.plugin/:
total 0
drwxr-xr-x  3 root  admin    96B May 14 18:05 .
drwxr-xr-x  8 root  wheel   256B May 17 12:28 ..
drwxr-xr-x  5 root  admin   160B May 14 18:05 Contents

from obs-mac-virtualcam.

@statik good sleuthing! Not convinced the permissions would change anything but it's an interesting data point. Does changing the permissions break the codesignature? If you have any changes you want to try submit them in a PR and I can run the notarization & signing.

from obs-mac-virtualcam.

That's much more thorough a test than what I did, @statik ... :)

Maybe you're on to something with the ownership. Hmmm.

FWIW, I did:

$ xcrun stapler validate obs-mac-virtualcam.plugin 
Processing: /Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin
obs-mac-virtualcam.plugin does not have a ticket stapled to it.
ken:/Library/CoreMediaIO/Plug-Ins/DAL $ 

Which is how I have in the past checked to make sure my ticket was properly attached during the notarization process. But I'm sure I know much less about all this codesigning and notarizing junk than most folks on this thread.

from obs-mac-virtualcam.

@kenlowrie FWIW I get the same thing with SnapCamera.

> xcrun stapler validate /Library/CoreMediaIO/Plug-Ins/DAL/SnapCamera.plugin
Processing: /Library/CoreMediaIO/Plug-Ins/DAL/SnapCamera.plugin
SnapCamera.plugin does not have a ticket stapled to it.

This is the first time I've dealt with notarization so I"m not expert either. I thought notarization was just for the pkg, but if there's a notarization step for the .plugin I'm definitely not doing it.

from obs-mac-virtualcam.

I get the same mapped file (non-platform) have different Team IDs message for SnapCamera in Zoom. One difference is that I see

/Library/CoreMediaIO/Plug-Ins/DAL/SnapCamera.plugin/Contents/MacOS/SnapCamera: stat() failed with errno=60

vs

/Library/CoreMediaIO/Plug-Ins/DAL/obs-mac-virtualcam.plugin/Contents/MacOS/obs-mac-virtualcam: stat() failed with errno=1

Not sure if that means anything. Some quick googling makes it seem like 60 might mean a timeout where 1 is not found. 🤷

from obs-mac-virtualcam.

I don't like option 3, although I realize that's been the only way to use the virtualcam with Zoom so far. I wonder if they would go for option 1, at least in the interim, until the code is merged. Option 2 would seem like the easiest way, if approval could be obtained... my two cents.

from obs-mac-virtualcam.

Also interesting that Wizards of OBS LLC is in there at all! That means they must have looked at this plugin and decided they would hold out until was merged into the main OBS codebase. I see no other reason for them to add that codesigning in there since OBS doesn't have any other Mac plugins that Zoom would want to load.

Perhaps. Or maybe the developer that was tasked with determining all the IDs stopped after locating the one used with OBS, and just assumed that the mac plug-in would be part of it...

from obs-mac-virtualcam.

How can we ask Zoom to add this to the list of accepted apps? I'd happily send them support for that!

from obs-mac-virtualcam.