TotalFinder on Apple Silicon (M1, etc.)

Good news! TotalFinder is compatible with Apple Silicon (arm64 / AArch64 architecture) as of version 1.14.1! Not only that, but it works with macOS 12 (Monterey), too!

… The bad news is that you’ll have to disable even more security features on your machine.

The instructions below will guide you through switching your Apple Silicon system into “Reduced Security” mode, and then disabling System Integrity Protection (SIP) afterwards.

Please note that while TotalFinder works on Apple Silicon, this is NOT officially supported by BinaryAge, as we have officially announced that we have stopped TotalFinder development. If you are looking for help, please kindly ask our community members on the forums.

Your machine may be less secure when you disable these security features. It is entirely your decision whether or not to modify these settings.

1. Switching your Apple Silicon Mac to “Reduced Security” mode

If you’ve already placed your Mac in “Reduced Security” mode before, simply skip this section.

※ If you use kernel extensions (kexts) on your system, you are already in “Reduced Security” mode.

① Shut down your Apple Silicon Mac.
② Press and hold down the power button until the text under the Apple logo says “Loading startup options…”, then let go.
③ Select “Options”.
④ You are now in recoveryOS — enter your password if it asks.
⑤ Go to Utilities → Startup Security Utility.
⑥ Select “Reduced Security” and enable “Allow user management of kernel extensions from identified developers”.
⑦ Shut down your Apple Silicon Mac.

※ TotalFinder does not actually use any kernel extensions for any part of its functionality. The only reason why we perform this step is because it is required in order for SIP to be correctly disabled. The reason why is not yet fully understood.

2. Disabling SIP (System Integrity Protection)

IMPORTANT: Disabling SIP in any capacity, even partially, will also disable Apple Pay, as well as iOS-on-macOS apps downloaded from the App Store (more on this below). This is a strange (and annoying) decision that Apple has decided to make specifically on Apple Silicon, as Apple Pay actually works fine even when SIP is disabled on x86_64 (Intel) Macs.

※ iOS-on-macOS apps that were installed through other non-App Store means, such as via sideloading, third-party tools, or your own developed apps from Xcode will continue to function normally. The only iOS apps that will stop working are ones encrypted with Apple's FairPlay DRM — in other words, just those downloaded from the App Store.

① Follow steps 2〜4 from above.
② Go to Utilities → Terminal.
③ Type in the following to fully disable SIP: csrutil disable
④ Reboot your Apple Silicon Mac.

3. Disabling TotalFinder’s architecture check

① Run the following command in a Terminal session.

touch ~/.totalfinder-dontcheckarchitecture

※ If you have multiple users on your Apple Silicon Mac that use TotalFinder, you will need to repeat just the touch command above for each user.

② Either run the following command in a Terminal session, or use Activity Monitor to force-quit and then open it again from /Applications.

killall TotalFinder; open /Applications/

TotalFinder should now be fully operational!

Enjoy TotalFinder on your Apple Silicon Mac!

Is there a way to only disable just the parts of SIP that TotalFinder strictly needs? I want my system to be as secure as possible while still using TotalFinder!

TotalFinder requires that you have at least CSR_ALLOW_TASK_FOR_PID (0x04) and CSR_ALLOW_UNRESTRICTED_FS (0x02) disabled.

All other SIP features do not affect TotalFinder’s functionality and can be in any state you want.

You can partially disable just the two SIP flags mentioned above for TotalFinder operation using this csrutil invocation in recoveryOS.

csrutil enable --without debug --without fs

※ Using unsigned or ad-hoc signed kexts? If so, you will need to add --without kext to your csrutil invocation. (CSR_ALLOW_UNAPPROVED_KEXTS (0x200))

※ Need to modify restricted NVRAM variables (such as boot-args)? If so, you will need to add --without nvram to your csrutil invocation. (CSR_ALLOW_UNRESTRICTED_NVRAM (0x40))

※ Do you use other software that requires SIP to be disabled? The vast majority of software that requires SIP to be disabled only really require the same two features as TotalFinder to be disabled. However, in some uncommon cases, you may have to disable additional SIP features. If something you use starts asking you to “disable SIP” after running the above csrutil invocation, please refer to the documentation and/or support of the software in question for more information.

※ Note: Please note that a partially-enabled SIP configuration is considered "unsupported" by Apple. Apple only supports an SIP-fully-disabled configuration.

That being said, many people, including myself (Karen), have been running a partially-enabled SIP configuration for years, ever since macOS 10.11 El Capitan without any issues. The choice is entirely up to you.

How do I revert these changes?

① Run the following command in a Terminal session.

rm ~/.totalfinder-dontcheckarchitecture

※ If you have multiple users on your Apple Silicon Mac that use TotalFinder, you will need to repeat just the rm command above for each user.

② Follow steps 2〜4 from the first section above.

③ If you are certain that you switched your Apple Silicon Mac to “Reduced Security” mode solely just for TotalFinder, go ahead and enable “Full Security” mode. This will also re-enable SIP.

However, if you use (or think you use) other applications on your Mac that use kernel extensions (kexts), run the following command in a Terminal session to re-enable SIP while keeping “Reduced Security” mode.

csrutil enable

④ Run csrutil status in a Terminal to verify that SIP has been re-enabled. The output should resemble something like what’s shown below:

-bash-3.2# csrutil status
System Integrity Protection status: enabled.

⑤ Reboot your Apple Silicon Mac.