I Reverse-Engineered CleanMyMac So You Don’t Have To

Will Carpenter

6 min read

·

Dec 25, 2025

--

1

Listen

Share

TL;DR: It’s rm -rf ~/Library/Caches/* with a $35/year subscription, 3.3 million filesystem operations of overhead, and a "malware scanner" that flagged my Arduino code as suspicious.

Press enter or click to view image in full size

The Experiment

I had a free trial of CleanMyMac 5. Curious of what voodoo was happening, I ran the app alongsidefs_usage, a macOS utility that logs every filesystem operation a process makes.

sudo fs_usage -w -f filesys CleanMyMac_5_MAS > cleanmymac_log.txt

I ran three tests:

1. The Scan — let it look for “junk”
2. The Clean — let it actually delete things
3. The Protection Scan — the “malware removal” feature

Here’s what I found.

Test 1: The Scan

1.25 Million Operations to Delete Its Own Cache

Results:

• Total filesystem operations: 1,252,353
• Files actually deleted: 8
• What those 8 files were: CleanMyMac’s own temporary files

Read that again. Over one million filesystem operations to find eight files to delete — and those files were its own cache that it created while scanning.

/Users/will/Library/Containers/com.macpaw.CleanMyMac-mas/Data/Library/Caches/...
/Users/will/Library/Containers/com.macpaw.CleanMyMac-mas/Data/tmp/...

It’s cleaning up after itself and counting it as “junk found.”

Test 2: The Clean

When I clicked “Clean,” here’s what happened:

Results:

• Total filesystem operations: 26,094
• Files deleted: 9,650
• Files written: 92

Finally, some action. But what did it delete?

99% Apple Neural Engine Cache

Almost every deleted file looked like this:

/25B78/.../076F134A823D9E856CE6890A4611F6B1CD3264D4CEF6DCC7FB8804FDE5BC757B.bundle/
    H16G.bundle/
        main/
            main_bnns/
                bnns_program.bnnsir

Let me decode this:

• H16G = Apple Silicon GPU identifier
• bnns = Basic Neural Network Subroutines (Apple's ML framework)
• .bnnsir = Compiled neural network intermediate representation

These are compiled CoreML models for your Mac’s Neural Engine — the thing that powers face detection, Siri, keyboard predictions, and Spotlight search.

What happens when you delete them? Your Mac recompiles them the next time any of these features run. You spend CPU cycles and battery life regenerating what you just deleted.

Test 3: The Protection Scan (Malware Removal)

This is where it gets good.

Results:

• Total filesystem operations: 3,332,109
• Files “deleted” (flagged): 41,603
• Files written: 64,294

Three million operations. And what did the “malware scanner” find suspicious?

My Arduino Source Code

/3.5inch_SPI_Module_ILI9488_MSP3520_V1.1/1-Demo/Demo_Arduino/Demo_Mega2560_Hardware_SPI/
    Example_01_Simple_test/Simple_test/Simple_test.ino
/3.5inch_SPI_Module_ILI9488_MSP3520_V1.1/1-Demo/Demo_Arduino/Demo_UNO_Hardware_SPI/
    touch_screen_calibration/touch_screen_calibration/touch_screen_calibration.ino

CleanMyMac’s “Protection” feature flagged .ino files — Arduino sketch source code — as potential threats. These are plain text files containing C++ code for microcontrollers. They're about as dangerous as a shopping list.

Also flagged: WiFiWebServer library patches, STM32 firmware examples, and a file literally named 匹配的图片显示代码函数.txt (Chinese text meaning "image display code function").

The scanner isn’t doing signature-based malware detection. It’s doing heuristic filename pattern matching and flagging anything that looks “weird” to pad its threat count.

The Archaeology: Searching for Games from 2008

While crawling my system, CleanMyMac checked for the existence of these directories:

/.CookingDash3-ThrillsandSpills
/.VacationMogulFull
/.WorldofBlackjack
/.vMac
/.Torch
/.Modulaser
/.MIDIHub
/.Freeway
/.Ecto
/.colloquy

These are application support folders for casual games and utilities that haven’t been sold since the Mac App Store changed its sandboxing rules in 2012.

CleanMyMac is still looking for your aunt’s Cooking Dash save files from 2009.

Their codebase has been accumulating app-specific cleanup rules for 15+ years and they’ve never pruned the list. It’s digital archaeology.

The Math

Let’s look at the efficiency of each operation:

Test Operations Useful Deletes Efficiency Scan 1,252,353 0 (own cache) 0% Clean 26,094 ~9,650 (all regenerate) 0% lasting Protection 3,332,109 0 (false positives) 0%

Total: 4.6 million filesystem operations to accomplish nothing permanent.

What CleanMyMac Is Actually Selling You

After analyzing all the logs, here’s what you’re paying $35/year for:

1. A recursive directory walker that checks for cache folders
2. A very large hardcoded list of legacy application paths from 2008–2015
3. The rm command wrapped in a progress bar
4. A “malware scanner” that flags Arduino code and Chinese text files
5. Scary numbers (“4.7 GB of junk found!”) that are technically accurate but meaningless
6. Temporary disk space that refills within hours of normal use

The Full Breakdown

CleanMyMac Says What It Actually Is Regenerates? “System Junk” Neural Engine compiled models Yes, on next use “System Cache” ~/Library/Caches/* Yes, immediately "Browser Cache" Chrome/Safari/Brave cached assets Yes, on next browse "Mail Attachments" Mail.app index files Yes, on next Mail launch "Photo Junk" Photos ML model cache Yes, on next photo analysis "Malware" Your Arduino projects, apparently N/A "Trash" Your actual Trash No (it's already trash)

The DIY Equivalent

Here’s CleanMyMac’s entire “cleaning” functionality:

#!/bin/bash
# cleanmymac.sh - The $35/year app, free forever
# 🎄 Merry Christmas from your terminal 🎄

echo "🔍 Scanning for 'junk'..."
echo ""# Show what would be cleaned
echo "=== CACHE SIZES ==="
du -sh ~/Library/Caches 2>/dev/null
du -sh ~/.Trash 2>/dev/nullecho ""
echo "=== TOP 10 LARGEST CACHES ==="
du -sh ~/Library/Caches/* 2>/dev/null | sort -hr | head -10echo ""
read -p "Delete all caches and empty trash? [y/N] " -n 1 -r
echo ""if [[ $REPLY =~ ^[Yy]$ ]]; then
    echo "🧹 Cleaning..."
    rm -rf ~/Library/Caches/*
    rm -rf ~/.Trash/*
    echo "✅ Done. You just saved \$35/year."
    echo "🎁 Happy holidays!"
else
    echo "Aborted. Your caches remain intact."
fi

And here’s the “Protection” scan equivalent:

#!/bin/bash
# cleanmymac-protection.sh - The "malware scanner"
# Spoiler: it just looks for weird filenames

echo "🛡️ Scanning for 'threats'..."
echo ""# Find files with non-ASCII characters (SUSPICIOUS!)
find ~ -name "*[^[:ascii:]]*" 2>/dev/null | head -20# Find Arduino files (EXTREMELY SUSPICIOUS!)
find ~ -name "*.ino" 2>/dev/null | head -20echo ""
echo "⚠️  THREATS DETECTED: Your Arduino projects"
echo "🎄 Merry Christmas, your code is safe."

The Real Way to Free Up Space

If you genuinely need disk space, here’s what actually helps:

# Find large files that won't regenerate
find ~ -type f -size +500M 2>/dev/null

# Check what's using space
du -sh ~/* | sort -hr | head -20# iOS backups (often huge)
ls -lah ~/Library/Application\ Support/MobileSync/Backup/# Xcode derived data (if you're a developer)
du -sh ~/Library/Developer/Xcode/DerivedData# Docker images (if you use Docker)  
docker system df

These are files that don’t regenerate. That’s actual cleanup.

How I Did This

For anyone who wants to reverse-engineer their own apps:

#!/bin/bash
# tail.sh - Watch any app's filesystem activity
# 🎄 Merry Christmas — now go catch some apps with their pants down 🎄

if [ -z "$1" ]; then
    echo "Usage: ./tail.sh <process_name>"
    echo ""
    echo "Example: ./tail.sh CleanMyMac_5_MAS"
    echo "         ./tail.sh Slack"
    echo "         ./tail.sh Safari"
    exit 1
fiPROCESS="$1"
TIMESTAMP=$(date +%Y-%m-%d_%H-%M-%S)
LOGFILE=~/Desktop/${PROCESS}_${TIMESTAMP}.log
REPORT=~/Desktop/${PROCESS}_${TIMESTAMP}_report.txtecho "🔍 Tailing: $PROCESS"
echo "📁 Log: $LOGFILE"
echo ""
echo "Do your thing in the app, then Ctrl+C when done."
echo ""sudo fs_usage -w -f filesys "$PROCESS" 2>&1 | tee "$LOGFILE" &
FSPID=$!generate_report() {
    echo ""
    echo "📊 Generating report..."
    
    {
        echo "=== $PROCESS Activity Report ==="
        echo "Captured: $TIMESTAMP"
        echo ""
        
        echo "=== FILES DELETED ==="
        grep -i "unlink" "$LOGFILE" | grep -oE '/[^ ]+' | sort -u
        echo ""
        
        echo "=== FILES WRITTEN ==="
        grep -i "WrData" "$LOGFILE" | grep -oE '/[^ ]+' | sort -u
        echo ""
        
        echo "=== DIRECTORIES ACCESSED ==="
        grep -oE '/[^ ]+' "$LOGFILE" | sed 's|/[^/]*$||' | sort -u | head -100
        echo ""
        
        echo "=== SUMMARY ==="
        echo "Total ops: $(wc -l < "$LOGFILE" | tr -d ' ')"
        echo "Deletes: $(grep -ci "unlink" "$LOGFILE" || echo 0)"
        echo "Writes: $(grep -ci "WrData" "$LOGFILE" || echo 0)"
        
    } > "$REPORT"
    
    echo ""
    echo "📄 Log:    $LOGFILE"
    echo "📋 Report: $REPORT"
    echo ""
    echo "🎄 Merry Christmas! Now go see what your apps are really doing."
}trap "kill $FSPID 2>/dev/null; generate_report; exit" INT
wait

Run it against any app. You’d be amazed what they’re doing when you’re not looking.

Conclusion

CleanMyMac is a $35/year animated progress bar that:

• Performs 1.25 million operations to find 8 files (its own cache)
• Deletes Neural Engine caches that rebuild immediately
• Runs a “malware scanner” that flagged my Arduino source code as a threat
• Still searches for Cooking Dash 3 save files from 2009
• Accomplishes 4.6 million filesystem operations across all features to do nothing permanent

The app isn’t harmful. It’s just not doing what you think it’s doing.

Save your money. Learn what ~/Library/Caches is. And for the love of god, don't let it near your Arduino projects.

Written December 24, 2024, using fs_usage, a healthy skepticism of software that promises to "optimize" things, and the Christmas spirit of exposing bloatware.

🎄 Merry Christmas. Your Mac was fine the whole time. 🎄

The raw logs and scripts are available if you want to verify this yourself. Trust, but verify — especially software that asks for disk access and shows you scary numbers.