XPCSniffer

xpcsniffer

XPCSNIFFER는 XPC 정보를 파일과 콘솔에 덤프합니다.

용법

• MacOS에서 콘솔을 엽니 다
• 장치에서 XPCSniffer 검색하십시오
• 출력은 +[XPCSniffer] Writing to /var/mobile/Containers/Data/Application/APP_UUID/Library/Caches/XPCSNiffer.log 입니다
• SSH 장치와 tail -f /var/mobile/Containers/Data/Application/APP_UUID/Library/Caches/XPCSniffer.log

메모

• 덤프하려는 Bundles 이나 Executables 로 필터를 업데이트하십시오.
• 로깅을 위해 MakeFile 내부에서 DEBUG 1 또는 0 으로 설정하십시오.
• jlutil 사용하여 bplist16 데이터를 구문 분석하십시오.

스크린 샷

예제 출력

 {"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:32:37 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:32:47 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:32:57 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:33:07 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:33:17 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:33:27 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:33:37 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.runningboard","process_id":31,"connection_time":"Tue Nov 10 17:31:47 2020","xpc_message":{"clientPid":10857,"bsx_class":"RBSAssertionIdentifier","count":13699,"serverPid":31,"rbs_selector":"async_invalidateAssertionWithIdentifier:"},"process_name":"SpringBoard","connection_address":"0x281084180"}