XPCSniffer

Xpcsniffer

O XPCSniffer despejará informações XPC em um arquivo e o console.

Uso

• Abra o console.App no ​​macOS
• Procure XPCSniffer no seu dispositivo
• A saída será +[XPCSniffer] Writing to /var/mobile/Containers/Data/Application/APP_UUID/Library/Caches/XPCSNiffer.log
• Ssh em seu dispositivo e tail -f /var/mobile/Containers/Data/Application/APP_UUID/Library/Caches/XPCSniffer.log

Notas

• Atualize o filtro com os Bundles ou Executables você deseja despejar.
• Defina DEBUG como 1 ou 0 dentro do Makefile para registro.
• Use jlutil para analisar os dados bplist16 .

Captura de tela

Exemplo de saída

 {"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:32:37 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:32:47 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:32:57 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:33:07 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:33:17 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:33:27 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.backboard.system-app-server","process_id":4148,"connection_time":"Tue Nov 10 17:33:37 2020","xpc_message":{"isAlive":true},"process_name":"backboardd","connection_address":"0x281084240"}
{"connection_name":"com.apple.runningboard","process_id":31,"connection_time":"Tue Nov 10 17:31:47 2020","xpc_message":{"clientPid":10857,"bsx_class":"RBSAssertionIdentifier","count":13699,"serverPid":31,"rbs_selector":"async_invalidateAssertionWithIdentifier:"},"process_name":"SpringBoard","connection_address":"0x281084180"}