MayLocation

macOS Location Simulator & Device Fingerprint Randomizer
_{Inject fake GPS coordinates and fabricated device identities into target processes. No SIP disable, no root, no hardware.}

中文文档 • Features • Installation • Usage • MIT License

---

Features

Location Simulation

• Click-to-set coordinates on an interactive map
• Realistic GPS jitter (Gaussian random walk, bounded radius)
• Cold start simulation (accuracy improves over ~15s like real GPS)
• NMEA-0183 TCP server (port 4352) for external tool integration
• Real-time coordinate updates via Unix socket IPC

Fingerprint Randomization

• Hardware UUID & Serial Number (IOKit hook)
• MAC address & hostname (network hook)
• CPU brand/cores, memory size (sysctl hook)
• App-stored IDs like Claude's ant-did (filesystem hook)
• WebGL renderer string (OpenGL hook)
• Profile system: generate, save, switch complete fake identities

Injection Engine

• Launch apps with DYLD_INSERT_LIBRARIES (zero-config)
• Attach to running processes via task_for_pid
• Works on Debug builds and side-loaded apps (.dmg, Homebrew, Electron)

Requirements

• macOS 26 (Tahoe) or later
• Swift 6.0+ toolchain
• For runtime injection: sudo DevToolsSecurity -enable (one-time)

Installation

git clone https://github.com/user/MayLocation.git
cd MayLocation
make run

Build targets:

make          # Debug build → MayLocation.app
make release  # Release build
make run      # Build + launch
make clean    # Remove build artifacts

Usage

1. Set Location

• Click the map to place a pin at any coordinate
• Search by address, POI, or enter coordinates directly (e.g. 1.28, 103.86)
• Manual input in the Coordinates section

2. Inject a Target

Click "Launch App..." → select any non-hardened app → it launches with the hook dylib. The target will immediately see your fake coordinates.

3. Fingerprint Profile

Switch to the Fingerprint tab → "Randomize All" generates a complete fake device identity. All changes auto-apply to injected targets.

4. NMEA Output

When simulation is running, connect any NMEA client:

nc localhost 4352

Architecture

MayLocation.app
├── SwiftUI (Split Panel: controls + map)
├── GPS Simulator (jitter, cold start, satellite model)
├── Coordination Server (Unix socket IPC)
├── NMEA TCP Server (port 4352)
└── Injection Engine (DYLD / task_for_pid)

libMayHook.dylib (injected into target)
├── CLLocationManager swizzle
├── IOKit hook (UUID, serial)
├── Network hook (MAC, hostname)
├── Sysctl hook (CPU, memory, model)
├── Filesystem hook (app ID files)
└── Renderer hook (WebGL strings)

Supported Targets

Type	Supported	Method
Own apps (Debug)	✅	DYLD_INSERT_LIBRARIES
Side-loaded (.dmg, brew, Electron)	✅	DYLD or task_for_pid
App Store apps (hardened runtime)	❌	—
Apple system apps	❌	—

How It Works

Instead of trying to modify macOS system-level location services (which requires SIP off), MayLocation takes a consumer-side interception approach:

1. Injects libMayHook.dylib into the target process
2. Uses ObjC runtime to swizzle CLLocationManager methods
3. Uses fishhook-style runtime rebinding for C-level APIs
4. Target process sees fake data — no system modification needed

License

MIT