Managing Classic Mac OS resources in ResEdit

The Macintosh was intended to be different in many ways. One of them was its file system, which was designed for each file to consist of two forks, one a regular data fork as in normal file systems, the other a structured database of resources, the resource fork.

Resources came to be used to store a lot of standard structured data, such as the specifications for and contents of alerts and dialogs, menus, collections of text strings, keyboard definitions and layouts, icons, windows, fonts, and chunks of code to be used by apps. You could extend the types of resource supported by means of a template, itself stored as a resource, so developers could define new resource types appropriate to their own apps.

Apple’s engineers developed a resource editor that quickly became one of the best-known apps on the Mac: ResEdit, last seen in version 2.1.3 way back in 1994. This was the power user’s quintessential tool: if you didn’t like a particular dialog in an app, ResEdit could be used to change it; if you wanted to create your own custom keyboard layout, it was the first choice for that too. If you were wicked enough to want to mess someone’s Mac up, you could go into their system files and change things around when they were out at lunch. Not that anyone ever did that, of course.

Each resource type had a four-character name, such as ALRT for an alert definition, CODE for executable code, DLOG for dialogs, KCHR for keyboard layouts, MENU for menus, STR for text strings, and so on.

You could have many different KCHR resources, each numbered, so that changing your keyboard layout was a matter of switching from KCHR number 2, the standard British layout, to number 26 for Dutch, for example. Adding your own custom keyboard layout was then merely a matter of defining a new KCHR resource with a unique ID number, here 128, and editing it to map the keys how you wanted.

Many resource types had custom editors: that for KCHR has a simple keyboard layout and tabular form. The highlighted (black) keys indicate that the Euro character € being shown would be generated by holding the Opt (Alt) modifier key and pressing the 2 key on the top row of the main keyboard, but not the 2 on the numeric keypad.

Customising the icon displayed for QuarkXPress was another fun job for ResEdit.

In those days, it was ResEdit that displayed the Get Info dialog for folders and files, where the sizes of resource and data forks were revealed. Note the vital Type and Creator fields shown: those used four characters that determined the icon to be used for documents, and which app would open them when double-clicked. They were used to build the Desktop Databases, mapping files to their icons and apps.

Resource forks and the thinking behind them are ingenious and empowering, but open up many security issues. In the days when there was Classic Mac OS malware, it often came in resource forks, and took advantage of their features. Although it was possible to lock and protect individual resources, armed with a copy of ResEdit you could soon change that, and almost anything else that you wished to, just as malware could and did.

This is demonstrated in the names seen in this malware library: WDEF preyed on windows resources, MDEF on those for menus, and several of these malicious files are shown with the icon for ResEdit’s resource files.

With Mac OS X, resource forks went into hiding, soon becoming extended attributes. App resources were split out into bundles, folders containing standard structures of files and more folders. Within those, the data structures that would have gone into resources are now folders full of files with standard data forks. In many cases, structured data are set out in XML, which is far less efficient than those old resources, and less suitable for power users to tamper with.

Instead of the limitless customisations to Mac OS, apps, and almost everything on your Mac, accomplished using ResEdit, apps are now locked down by their signatures, and can’t be tampered with any more. While they lasted, resources and ResEdit were exciting and satisfying, if horribly insecure.

References

Wikipedia on resource forks.
Wikipedia on ResEdit.
Apple reference manual for ResEdit 2.1.