How to uninstall Sunlogin on Mac

Sunlogin's Mac app is AweSun.app (bundle id com.oray.sunlogin.macclient), installed by a package that also puts a virtual audio driver in /Library/Audio/Plug-Ins/HAL, writes two configuration files in /etc and keeps logs in /var/log/AweSun. Oray's own help page only tells Mac users to delete the app or drag it to the Trash. One file matters for privacy: /etc/orayconfig.conf holds this Mac's device identity, including a hardware fingerprint (MAC address, host name, CPU, board, disk) and your account and certificate. This covers the official package from sunlogin.oray.com and the Homebrew cask awesun.

Quit and remove the app

1. Quit AweSun from its menu bar icon. When it quits, it renames /etc/orayconfig.conf, /etc/sys_config.conf and ~/Library/Application Support/AweSun by adding .bak, so afterwards you will find the .bak names instead of the originals.
2. Move AweSun.app from Applications to the Trash. Its four com.oray.awesun.* background items run programs from inside the app.
3. Remove the system items in the table below, then restart the Mac: coreaudiod keeps the audio driver loaded until a restart, even after the driver has been moved.

Where Sunlogin keeps its data

In Finder, press Shift + Command + G and type the full path. Moving items under /etc, /var/log or /Library asks for an administrator password.

Check the result

pgrep -il awesun
launchctl list | grep -i oray
ls -d /etc/orayconfig.conf*
ls -d /etc/sys_config.conf*
ls -d /var/log/AweSun
ls -d /Library/Audio/Plug-Ins/HAL/OrayVirtualAudioDevice.driver
pkgutil --pkgs | grep -i oray

• No output from pgrep means AweSun is not running.
• The launchctl filter checks only current-user jobs with oray in their names, not system daemons or differently named registrations. Identify a com.oray.awesun match before stopping it, and check AweSun in Login Items & Extensions too.
• Run each ls line separately. A printed path still exists; “No such file or directory” applies to that exact path. In zsh, “no matches found” for one pattern means it matched no file and that line did not run; it says nothing about the other lines. Permission errors leave the path’s state unknown. A .bak name is the renamed app data, not proof of a usable backup.
• A line from pkgutil --pkgs means an Oray installer receipt is still registered; that is a record only, with no files of its own.

If you installed it with Homebrew

Mole skips --zap when its list reaches unchecked or shared data, or cannot be fully checked, and still cleans the leftovers you selected.

The awesun cask's uninstall step quits the app, unloads five com.oray.awesun.* jobs, removes the files registered by three Oray package receipts, including the audio driver’s, then forgets those receipts, and deletes /Applications/AweSun.app. Its zap list reaches /private/var/log/AweSun, /Library/Application Support/Oray/AweSun, two LaunchDaemons, ~/AweSun, ~/Sunlogin Files, ~/protocol_config.conf and several ~/Library entries. Because many of those paths are outside ~/Library, Mole always drops --zap for this cask and removes the rows you selected itself. The zap list does not name the /etc files. Running brew uninstall --cask --zap awesun yourself also removes ~/Sunlogin Files and ~/AweSun, so check both folders first, or remove only the app:

brew uninstall --cask awesun

Account

Removing the app does not delete your Oray account, unbind this device on Oray's side or cancel a paid plan; manage those on Oray's website.

What Mole lists

For Sunlogin, Mole selects the app and its four com.oray.awesun.* background items by default. It lists /etc/orayconfig.conf, /etc/sys_config.conf, their .bak copies, /var/log/AweSun, OrayVirtualAudioDevice.driver and ~/Library/Application Support/AweSun for review. Eligible ~/Library/Application Support/AweSun app data is selected by default; uncheck it or use Deselect all to keep it, while the /etc, /var/log and driver rows remain unselected and require individual review. The system items move through Mole’s administrator helper, only once AweSun.app is gone and only if each still has the expected shape; the driver is also checked against Oray's signature. When quitting the app renames an original you ticked to .bak after the scan, Mole moves the .bak with it once the rest of the removal has run, and counts it as a leftover of AweSun on the result screen. A row the app already removed or renamed reads "Already gone" and is not counted as not removed. The audio driver's receipt, com.oray.sunlogin.MacVirtualAudioDevice, is forgotten only after the app and all of these items are gone. ~/AweSun is not listed.

What this test covered

On September 26, 2026, the official AweSun 16.6.0.32198 package, checked against the MD5 on Oray's site and signed and notarized by Team ZBNMDRTU32, was installed with an administrator password and removed with a development build of Mole. The helper moved the audio driver and /var/log/AweSun to the Trash. Quitting the app renamed both /etc files and ~/Library/Application Support/AweSun to .bak after the scan, so those rows read as already gone; the .bak handling and the receipt step were added after this run and have not been re-run on a second install. coreaudiod kept the driver loaded until a restart. The Status page and the Login Items view for the background items were not checked, and the Homebrew cask was not installed.