Driving a Foreign Application's Menus: A Global MenuSelect Trap Patch Installed at Boot

Sun, 05 Jul 2026 11:35:18 +0200

Two earlier reports left the problem of driving an arbitrary front application’s menus unresolved. The journaling driver reaches only the daemon’s own menus, because MenuSelect uses the calling process’s menu list. The jGNE filter could read a foreign application’s menu structure but crashed the host when used to drive one. This report closes the problem with the third mechanism the literature pointed to — a global MenuSelect trap patch installed at startup from a system extension — and records two findings that the closing required: that a patch installed by a running application is process-local, and that a trap patch’s presence must be verified by scanning memory rather than by reading the trap vector.

Journaling on Defender TD5

Driving a Foreign Application's Menus: A Global MenuSelect Trap Patch Installed at Boot