How to uninstall Sunlogin on Mac

Sunlogin's Mac app is AweSun.app (bundle id com.oray.sunlogin.macclient), installed by a package that also puts a virtual audio driver in /Library/Audio/Plug-Ins/HAL, writes two configuration files in /etc and keeps logs in /var/log/AweSun. Oray's own help page only tells Mac users to delete the app or drag it to the Trash. One file matters for privacy: /etc/orayconfig.conf holds this Mac's device identity, including a hardware fingerprint (MAC address, host name, CPU, board, disk) and your account and certificate. This covers the official package from sunlogin.oray.com and the Homebrew cask awesun.

Quit and remove the app

  1. Quit AweSun from its menu bar icon. When it quits, it renames /etc/orayconfig.conf, /etc/sys_config.conf and ~/Library/Application Support/AweSun by adding .bak, so afterwards you will find the .bak names instead of the originals.
  2. Move AweSun.app from Applications to the Trash. Its four com.oray.awesun.* background items run programs from inside the app.
  3. Remove the system items in the table below, then restart the Mac: coreaudiod keeps the audio driver loaded until a restart, even after the driver has been moved.

Where Sunlogin keeps its data

In Finder, press Shift + Command + G and type the full path. Moving items under /etc, /var/log or /Library asks for an administrator password.

Location What it holds What to do
/etc/orayconfig.conf or /etc/orayconfig.conf.bak Device identity and hardware fingerprint, account and certificate Listed by Mole for review; remove it once the app is gone
/etc/sys_config.conf or /etc/sys_config.conf.bak Service configuration Listed by Mole for review; remove it once the app is gone
/var/log/AweSun Logs Listed by Mole for review; remove it once the app is gone
/Library/Audio/Plug-Ins/HAL/OrayVirtualAudioDevice.driver Virtual audio driver, installed by a nested package with its own receipt Listed by Mole for review; remove it once the app is gone, then restart
~/Library/Application Support/AweSun or AweSun.bak App data, owned by root but writable, so Finder moves it without a password Listed by Mole for review
~/AweSun A folder the app creates in your home folder Not listed by Mole; check its contents, then remove it yourself

Check the result

pgrep -il awesun
launchctl list | grep -i oray
ls -d /etc/orayconfig.conf* /etc/sys_config.conf* /var/log/AweSun /Library/Audio/Plug-Ins/HAL/OrayVirtualAudioDevice.driver
pkgutil --pkgs | grep -i oray
  • No output from pgrep means AweSun is not running.
  • No output from launchctl list means none of its background items is loaded in your session; a com.oray.awesun line means one still is.
  • ls -d printing a path means that item is still on disk, a .bak name being the copy the app made when it quit; "No such file or directory" for every path means they are all gone.
  • A line from pkgutil --pkgs means an Oray installer receipt is still registered; that is a record only, with no files of its own.

If you installed it with Homebrew

Mole skips --zap when its list reaches unchecked or shared data, or cannot be fully checked, and still cleans the leftovers you selected.

The awesun cask's uninstall step quits the app, unloads five com.oray.awesun.* jobs, forgets three Oray package receipts including the audio driver's, and deletes /Applications/AweSun.app. Its zap list reaches /private/var/log/AweSun, /Library/Application Support/Oray/AweSun, two LaunchDaemons, ~/AweSun, ~/Sunlogin Files, ~/protocol_config.conf and several ~/Library entries. Because many of those paths are outside ~/Library, Mole always drops --zap for this cask and removes the rows you selected itself. The zap list does not name the /etc files. Running brew uninstall --cask --zap awesun yourself also removes ~/Sunlogin Files and ~/AweSun, so check both folders first, or remove only the app:

brew uninstall --cask awesun

Account

Removing the app does not delete your Oray account, unbind this device on Oray's side or cancel a paid plan; manage those on Oray's website.

What Mole lists

For Sunlogin, Mole selects the app and its four com.oray.awesun.* background items by default. It lists /etc/orayconfig.conf, /etc/sys_config.conf, their .bak copies, /var/log/AweSun, OrayVirtualAudioDevice.driver and ~/Library/Application Support/AweSun for review without selecting them. The system items move through Mole's administrator helper, only once AweSun.app is gone and only if each still has the expected shape; the driver is also checked against Oray's signature. When quitting the app renames an original you ticked to .bak after the scan, Mole moves the .bak with it once the rest of the removal has run, and counts it as a leftover of AweSun on the result screen. A row the app already removed or renamed reads "Already gone" and is not counted as not removed. The audio driver's receipt, com.oray.sunlogin.MacVirtualAudioDevice, is forgotten only after the app and all of these items are gone. ~/AweSun is not listed.

What this test covered

On September 26, 2026, the official AweSun 16.6.0.32198 package, checked against the MD5 on Oray's site and signed and notarized by Team ZBNMDRTU32, was installed with an administrator password and removed with a development build of Mole. The helper moved the audio driver and /var/log/AweSun to the Trash. Quitting the app renamed both /etc files and ~/Library/Application Support/AweSun to .bak after the scan, so those rows read as already gone; the .bak handling and the receipt step were added after this run and have not been re-run on a second install. coreaudiod kept the driver loaded until a restart. The Status page and the Login Items view for the background items were not checked, and the Homebrew cask was not installed.