alcove-patch

Static patch for Alcove that unlocks the paid features without a license key. arm64 only (Apple Silicon). Tested on 1.7.2.

Alcove keeps the whole entitlement in one tri-state byte on the LicenseManager singleton (+0xc30): 0 invalid, 1 valid, 2 unknown. The constructor sets it to 2, and every gate — onboarding window, both notch renderers, the menubar body, the trial/network paths — reads it inline and branches on bit 0. So a fresh launch is "unknown" and stays locked.

The patch flips the constructor init to 1, nops the two strb wzr stores that clear the byte (trial expiry, key mismatch), and pins the handful of inline reads that don't go through the constructor value. Net effect: the app boots activated.

usage

./patch.py                         # patches /Applications/Alcove.app in place
./patch.py /path/to/Alcove.app
./patch.py --restore               # roll back from the .orig backup

It verifies every original byte before writing, so it refuses to run against a build it doesn't recognise. The first run drops a backup of the original binary beside the bundle (Alcove.app.binorig).

Editing the binary breaks the Developer ID signature, so the script ad-hoc re-signs the bundle (hardened runtime off, restricted entitlements dropped) and clears quarantine. Run it again after any app update.

If the app pops a Sparkle update dialog, choose Remind Later — installing replaces the patched binary with a fresh signed one.

offsets (1.7.2 arm64)

va	what
0x100127a80	ctor: init _isValidLicense 2→1
0x10012138c	nop strb wzr (trial expiry)
0x100121928	nop strb wzr (key mismatch)
0x1002d2dd4	notch reveal gate
0x1001d1218	second notch renderer
0x100124d74	trial resolve gate
0x100191f00	menubar paywall body
0x1002013b0	nwpath revalidation