Giter Club home page Giter Club logo

xpcspy's Introduction

xpcspy - Bidirectional XPC message interception and more

Features:

  • Bidirectional XPC message interception.
  • iOS and macOS support.
  • bplist00, and the infamous bplist15 deserialization.
  • Filter by message direction (incoming or outgoing) and service name.
  • More to come?

Showcase

Usage: xpcspy [options] target

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -D ID, --device=ID    connect to device with the given ID
  -U, --usb             connect to USB device
  -R, --remote          connect to remote frida-server
  -H HOST, --host=HOST  connect to remote frida-server on HOST
  -f FILE, --file=FILE  spawn FILE
  -F, --attach-frontmost
                        attach to frontmost application
  -n NAME, --attach-name=NAME
                        attach to NAME
  -p PID, --attach-pid=PID
                        attach to PID
  --stdio=inherit|pipe  stdio behavior when spawning (defaults to “inherit”)
  --aux=option          set aux option when spawning, such as “uid=(int)42”
                        (supported types are: string, bool, int)
  --runtime=qjs|v8      script runtime to use
  --debug               enable the Node.js compatible script debugger
  --squelch-crash       if enabled, will not dump crash report to console
  -O FILE, --options-file=FILE
                        text file containing additional command line options
  -t FILTER, --filter=FILTER
                        Filter by message direction and service name. 'i'
                        denotes incoming and 'o' denotes outgoing. Service
                        name can include the wildcard character '*'. For
                        exmaple 'i:com.apple.*' or 'o:com.apple.apsd'.
  -r, --parse           Parse XPC dictionary keys that include `bplist` data.
                        Currently `bplist00` and `bplist16` are officially
                        supported, while `bplist15` and `bplist17` support is
                        still experimental..
  -d, --print-date      Print a current timestamp before every XPC message

screenshot_1.png

Installation

pip3 install xpcspy

TODO:

  • Deserialize data within the parsed bplists recursively.
  • Improve script loading performance, kinda slow for some reason.
  • Add an option to get the address, perhaps ASLR adjusted, for the XPC event handler, by spawning the process and hooking xpc_connection_set_event_handler.
  • Add fancy colors.
  • More pretty printing?

FAQ

  • Why are you reinventing the wheel?
    • I'm not; XPoCe doesn't intercept incoming messages, and doesn't support bplist00 or bplist15. `

License

Apache License 2.0

xpcspy's People

Contributors

hot3eed avatar dependabot[bot] avatar sn0wfreezedev avatar davidquan111 avatar tux-mind avatar jiska2342 avatar weizenberg avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.