Mystery solved: iTeaHAL
I’ve been getting strange messages in my system and console logs, or when executing certain applications from the command line. Notably iMovie and Skype:
iTeaHAL: Entering... iTeaHAL: Not iTunes, exiting.
And when executing iTunes, I get this:
iTeaHAL: Entering... iTeaHAL: Early startup... itea_hijack_init: result: 0 iTeaHAL: Early startup done. new_AudioDeviceAddIOProc:0x2281b68 link added iTeaHAL: Late startup...{length = 6, capacity = 6, bytes = 0x000a95c4a60e} itea_fx_init: result: 0 itea_menu_init: result: 0 iTeaHAL: Late startup done.
If you have no idea what “iTeaHAL” is, this sounds rather ominous… something’s hijacking my iTunes?! It also didn’t help that I noticed this soon after using my laptop (if only for about 30 seconds) on “the worlds most hostile network” at DEFCON 15. I thought perhaps this was some kind of trojan backdoor that was piggybacking off of iTunes Music Sharing or something.
It turns out it’s nothing quite so evil.
Google turned up nothing except other people also wondering what the hell iTeaHAL was. Then I tried finding files named iteahal: “find / -iname iteahal*” also turned up nothing. I knew those strings must be stored somewhere, so next up was a grepping of the entire drive: “grep -arsi iteahal /”.
Success! Other than the system and console logs, the following files were found to contain “iteahal”:
/Library/Audio/Plug-Ins/HAL/iWow.plugin/Contents/Info.plist /Library/Audio/Plug-Ins/HAL/iWow.plugin/Contents/MacOS/iTea
It’s the SRS iWOW iTunes plugin from SRS Labs that’s supposed to make crappy laptop and computer speakers sound better (it actually does a decent job)
Apparently when an application loads audio plugins (like iTunes, iMovie, Skype, and other audio applications), it tries to load the iWow plugin, which detects whether or not it is iTunes, and spews all this debug information to the console.