From 297c312fe3ad0540a0f7d9ef6c0914fa84409ddb Mon Sep 17 00:00:00 2001 From: Patrick Wardle Date: Thu, 15 Nov 2018 20:44:34 -1000 Subject: [PATCH] minor project updates improved error checking removed (some) spurious code --- lib/libprocInfo.a | Bin 210296 -> 210944 bytes procInfo.xcodeproj/project.pbxproj | 18 +-- procInfo/Binary.m | 11 +- procInfo/Signing.m | 10 -- procInfo/procInfo.h | 204 ----------------------------- 5 files changed, 13 insertions(+), 230 deletions(-) delete mode 100644 procInfo/procInfo.h diff --git a/lib/libprocInfo.a b/lib/libprocInfo.a index 33d135fb4c3f7d96cfccc6deb200b7af2651b9df..9819ae14111c5ce095284d5148a8875345f0ab22 100644 GIT binary patch delta 14904 zcma)j30zgxzW-i(yAS6ezD?Mg%6N%Jz zwXAndY%sgk4IkC9LDMot>y|LRzh_&^`KS5*cwj$xd}xQOv# zVAEz*d7SYj#&;R_X^PxDS&cG6_XpR%Dt2of(Dxp_dw2JGv(huXUT^nw{CG3c(|h*l z0bXWSR!`$e{qD#QH=4ttoNjI5hlX$r7q1#4@!P}LfZyfD1;={vsIew!IDU@@ofq#J z`<>^-VPl7DxcIg{GB{6&AL>W8PE+-eor;oVZ2hK(@pkA~_ZN|t&&FB{qdzk4I@-EbYU6XQGwNS|LWI{B)fL67&fxmT_XdY# zb<9Z1zzj8)jI2y^$#&2F{b}pbvwQb!=cW%hs2BBOaph-82mrI-1#k}shP%I z!TsDt%pTL$GEUDl{ubOX^4S3vd6~!WFGj}Uy!gipEpB;&h4+uNP}yj#Jlr!ndHRgcZx6GnmW!;WOTATGNDG~WMN(8f^fVaGcE*?! zInK{9pheY-_ZdH&YU{WPetlbG^Vull(-U39Oyk;#w!=n{M%C`q)J{=#A?XbLEo;DU zS-pPC>e|-0H7ddIe_IsW*$jo;nLR10j&>GR>w$P<>8V&X>jmT5x3{Rv;>}okeOII= z#2XKNH%J^Y8u0s+5q>gWJZyA1nc%F%Wm^eSZ*Z!5HI!^ zIX|R{4aUqL#&qvvT4&uJ1rt)QbpGg3?a*s)SU6jt^g=jAYsHkYr)qCe?+?P4 zr&-BDPTw0k{i&qb++6~JUmgTQYUzI2cu50+OB?*DCip(E)<55?qrtDS|@DeZe?>Fgc=Jk<%;)> zw=UhPJ`h6o(6J_`uwhr>Zqiw7I4_^W()s7*1m|>fJhIA+c0Y9#xkmm^1?rw)nQ_1B zF`oHppx9^}{V7I_HLm>Rg+ZGuLqk?joYnK2u=P6|& zX=BSOrWcgr4pLUJsE?8K@9Td1G5i`oj<+!GVBE#HkFk;QB;!R!H6HVU63Q6O*pV@Z zv5>LYLccPO88aBG7}qks$XL&~jqxz!Wyb4_ZXCT-+A?|>(;0Ia2bt(s6#Kb4n+5Y3 zA7EU?_zdF)#@89&W!%Sji18@nImZ8Gbnq1?O(_^O;K_BOlPHn?J!<@$N5u1@wbH;3 zN~OKAe_f2MRfW@~^0g;Ku2DrBS2&XqCaHSc(v_+0! zGRh>yWcjit0-{!ywi3Pku^hF1v9ShOQS9~cF<*FWzP(;r^6mB0l5el4mi+csyMCpm zz#jH5S~P4AcT4?b?m$a^Z{~l~!cXB%`dBA+Y0LB2(!gGLCtEt=h1pWy-VrVJ?VWd% zKDBRe&6WoCmb=LS`u3J=sXyuudTj5wmin}C&HlG+z}~7Y4eXuKQs3HgiqcZw-dQd6 z?VShxZuaP#IPMR6U~jpTvVV|B^xHFafoFs+o6Z{?*=Nze{y=We#2?A+fp_u^y@h|j zVvlt6?<*)YvQ+*^K8^eNNAe1mclurbn6n32p=A&77*z1YP@du~|DTNi#Ta1xl<^D3 zGmMuRJ&6>)qO@nsWgJL21pnQ`j55YY84boa7~f}Hjyn!bk^O4VpXI20k>yf6mSQitCST;b@|nCx z9wg}mCZ+WBhqRW-t@7^vkZx!4pYmx)gBAL`gOU&GC+~=1bR|fFhYekT35fD3K2ljF2xAOqcr!Cdg|93uV$>fO0vQV1=ARuv9)x zuvYFMSS`;GY?6_818QY&f-SO?piWj1G|0^a+vOpGMk&ULMCWnbB2{HdP#`^9eOwst zzck0le|fi2{_-eUI9{BW)5eS6egva0UJqN}zJ`^GOY-SFwX2*pQRK+Wd1{1wd!l$) zv<~D>67OmL=nZ*0=f^>&V8J;d2f@06pv9n> zy$a@GD9_uCO?(d>O!0 z?7?KF+W@@r9*j^w7wh7n|^h#hJ z*2Kd=TEzDN$!-{M5Z0fsEh=Qt8b|@qhYxc2FWf80;bkDn4*YUY=5Bt zY;iO~RLCU1Smn1bJ%7Vj)G*wu>NSZ-f%YS2hnYeiX@Y__LtWZKRJV40cnt9)CfYkim> z23tB=1~j_l;8MUiW3 zL^iHN`)kB-TzQfn6X!*fj9dlPqQK@=0(rs_feWieno3ebtcs))l1l1p7EYHt43QRJ z{)P2MfexC}yAU*XtCHFn2!2Aee|f`r#WGWMQ~HX5cEw6L(|$!3=S!qSAp~&mg2Bc14}DPQ8yjklt(n( zmDq_y%h}x0^66!h=GnFb=Fgrylahy~Yb(KMR_z3%NuUMRL8i2P?tPPB5F$tBt8J1o zmE-4+pESL6E_gT~p)hgYEYxxA%&V9@dCFAO!{lT6YDW?bFn4zv0L*xd6%YptgRm}9{ zz(ccC%=EW%^L^^7$lh$)$gU7)xtivRE>INu*78Q6s$3oK3(A6;svHiSU#FfDYFf9O z^S=Sg|BAqY4Qg>Kp#%~)s@ELiY#{D6wO;FiWU7_q_FBbCrlJ#numduCbnhu!ZC1x6 zd1sluQdVG8&B8RsjmA##7?F;&nB^EcDx`%8R#q%flm^9k>|mVndQe;feHx~cYJn1g ziy$_z(ttFXZulBA-F2+7fi<#Yjn{(P8a0g_6H4%upfbV&s7C+%#thX)nN&%@hqm2Z~kI~;p8Lr z?ND!JCPSMJ1{rC=aqfMr$y2A4v^A5Pjm$opZh4r{mXe$9K!1zuK)V(tZ-{X{xL?Ad z0*jo+PnyzU7JUrOxs95`neO~MEsp)$Fv)nPb-!jd_euf#d$9Ynb~f|(Ofvd}^m8w| z%QEM~TM<)?m0+)H!R|c8_!{gT%$|vd2$jK8j4q-564ED_lu~PfvgKZDXv*g^l5rM=-2NI}o#|8hL}l)1VGw zpI49m7RKvBW#9MIuCABB8B!fu9xBV)A*hvu6e zpp@mHD9qH{LPPu%<)@nr(t1dloHKn^TKS%>l;uHwX-IXYmG60zGCV^_k#jwj6TmQ| zFRC`{c0%OLMTDQR9cd(Fma6A}Y4z|5V(dHr=BWPKS_wnPD6ENS9AO!WUQcdKXoVRh z1yyVXRf4vVl^W3;6xE8V-Yha16cp8vZ_GC){1lrwj3W3P`7Y{vG-eAe93e0}o=qK} zc;0N0+V}_(^fTM^ur=LuNgbye+DJ7S)CSeih8JLWoa%PR-=Vc?HEMR;81aM0UlaP2 z+0br;FvMyo*0k9g0iXMv1XsZ>~jNU{8+F~?mrJU)HgX+wE*2;;+ zxrO9kBbxgTRoSpj^?Gku37_I>VGa2cq-hR_Vy=XZ<^a)vJO~N;uUK(j{kOdmsD=S) zG8r@=R72pW0rr4U-46WBQk*!v61M!GE1`=E*L^FjCIo1Ob*$N~o!hJlRhxrsgdTz< zC9I4_fVEtyh9LKu3<{EJ2(kfS2TAqjAP-~Uuvp5h)$*K^#xH9|a}?W~?S747u{m@! zRHLjYNC{DF0a#H`4N=sY42ptkh+-2!ZhlKdkF?k4Vj3ApY9X=W`?Z}EvmIJGM-Ucz zOG;>GEx=kjRD=o$IhcGaUk;FPPM7HwqR4z*R( z3b-)!3p2J4tlC~wU9&>&-k~N9?t-T6RC3KyTgx84qMFbG!#e0=vsLEP}Y2)uEs~h_8+RZ0^WH`Bqoo5 z%kWBiBI2+kqUfQWbr?uab5EVxEj)3#BA0)t{>|AFyAghVk=~EgPV%mus?T`@`v9zs z7OS3E%PrPWixu*b8sZ#cu{;47PS@nsC2FjEvO!IeyBpN9V*6h4F3v_Odl}C&hVa!P zf$>(x48~rJgTmzfd(?ls?5jq&-0;4Lb+R;EW-L<^g_US@9cHe_N<&^`lCzSbd?Vr9 zXFQXZR80$)cYUn3SA)Whhr;6I6Xj}zu{z8Zc=cmd&r~OQWY<&?D?k3X8tS+2TxuPr zg31e6_f*7~6F%G&-xg{V2yG2m8b)1x-=!(DObtbQ&t`t$(wsJPr_KDxrA64x&%lf$ z^9Gj|%gk2ln(4Qf;EJQZy$4^eKu-SOG@`ay)TDb%SurSGT~jiRsP`xuM?ZXZ`HAE8 zVFyrAKM6edi~3op=o6S5s(mYNe~}f$nBhK%J%YYQ32NmFYQ?k8YNh0gNzs%-_8(>h z9*O{M771!I_N?3xuC)_;v)|0ibo6;G3Ej_6CuPj7>kbTnuR%J z9U+P_b)D2T<+F*5GQ}XL-%lj|J_gz#CsY#|Cuj+QELlTjJ5g(qBi0d_DClE}(zzB* z;=ZFOZ4fjSF-GqO`6nV7t!^UKPfkz}it1$zdz!_V4y1Wq^nri|W1%?#*LecUKOy7m zG|`aFGza54Psa>%Iv*hAPf**BKm=N0Yr-YSEQCdpd0Z9f)|Uq$|9l=L?MVA zA_jpN1EPS4+d!0opg5z7Kr9C_PA+k4*%40Sg$tp$LQ!+Oiv*!4;p#SahL3>M0+98KHg>m--bdsc6*nocc{O6^M)0mT7$`6bwI=9}qbDr__VR zpN^=n#2WW2YZOMGSZCx{ZM19=B*S8{_P5Etv0CS7>JxjL%zAEFK@u8EenFriB@e~& zwOB1XnkI)Om249yufay7$iz69(!{d@jW?OjlqGT6?I|?lETK^+32j~uo|YZ4n&jR% zO^R-EV!W1@LZibWn)3n$TH|bUgxzeC4e^K|N1lt8`$~vBnV?Znz3Hz<(VXHI(_~t7S*=8rfE=;-VY4Su~H(Mx;8+HR$r?t_s_O>=j1s3T(Z zzMzVVbzhF|LjEq@p%!?M9xQI@Q@=}wchcJXe=nT%@a=PG-zmre{(lGbgcVTJ4FNgS zp;kP%{b4+}+nsc1m2i;i(3XmK^b)iho`W>vYNQd7PJC8d>Yqy8eHa5=4B`F7G=MG) zp!V|;wW}b*N92W0n#XxHx7tLr7swW z1IqVLEOOjD6X^XP`_pp@Nc=B>t-$}7`8%2a1`zup;T7hu1tvlN5nwX#e#Tjh!+|(C z{kgZGg3aYi0CoVnfoQ;U7EC;1d|v~J|2dHOe`oqRrWY|ihv}(6JmGy~fSrNESl*ZA zK41dUOUb~Flun94g%s&~KQ-h4QbWIB`=dvmeL(6#Es%P&ifMWuMh|kQ0ja^UK=Lyj zNPcbulAnAa`AGwkULuh6+5kJ?vg8X#g%q7YQoM*W2vy%nAovON7p7#m3rL3BfYiWS zmfZ6?knElYl3fi@gWX~v+06oy-4r0%-2_5gxTxCKZ(4gum1l6)6% zLK58o#3LwSD-b1N0}$UEee;3%keE9gNFy{JNczJW^B8Xhb^^Z*5QFUdDG1|Fl`n8= z6TShY2ww(LgwFsSz`rnm3G?Rxsb^Dx)U!VU;nQ~q^9KRRj}J(Gl7ZwW5oiuQ%k?0P zKPg;-v^{!o07#B^14;3HAUS#iNO~KAq_-YOdIrnyXZbuJ{&{BNhwLW<$^H%?+2;cj zVc!u*_R)S+NHGLRiUMc`q+5z#0&zL;eE=kbdLZeo0+Js6r8!JIOMsoh|1%Js^W6g^ zefs7_`f)(g4+oOI6WAGiKP4nd;R2+j@I8K1U?Y$m>;aOTa(MXXS&1KV@Gy`ZJOCv5 zOd$SwC{;)HgMoCe^Z=5d&Op*@(k#7`K=|={j-o=24gyJ`ffcp^$`4LEZp8?6wZXn6u z2j-B%o2>8>(2LdiIFKAJ1Cqi0Kr)yMB>fpcawsc&TBm57*J0RvN;nWeKVh=&6?H`5 zUp}ow_-RieBF8@bkYZf~X(`H!L}MoGm+s?mNwobA|1#6|o4TP{a{G1uD#_u4-Z`nz p|5i!%)a)msIl{6D8l2yOrX delta 14175 zcmb7rd0bXi{{KDqdLNz#+2KJ%AHfx@5D-u+Hc|2kH_XwvKi!nA+zxU_f&jp8?KYr&$&-=bV+xeXB-gED< z6=y?QPlVKU3mP~u>+(T^(&~HV1{yxmv<7bSmjM4BT zyUQ4_W}LzJERf>9&3KkEmg~vTwE9EiCQ*ne!!{j_(3C<7_>OX28_qb9aSr3HjCTN= z8+Gk|#-|uxwQ$Ql;<(`&I4~`9;Nbe6UCgYEth6EWLG${^)lXWj)ml2+xLOL=SaFLS zhhI%@z;CfU=UOjHWPQ+B{2mE9BUZ@|+-Jl_xzjUNG;WCu&J$wmmT{d^b@RX*n$}aE z`YJh zXF(gHX~Ra0n6==hS(TO!e9ZWZcxUC;>r=|}~ zY%l3q8SNvHIVde-kTgFXA9d(1yO*4iICPi1@zY#yeAjkyCtU8mU(*)IZJ%cN5?NDh z8))vnnugKV^4DovuuOMH%fthT@fB?4W~&mms#_-~9T*gO3#&iEl%z6EZa9z^U)%kqHQ(A z2Cexr+p4iap7?B#Z2rvc@w3V;(+}oFmi4r$ho!}G<-t7PEi8?|8lf^R#SYWbplSD5 zm7P797`dvSrPOY=L938GKhNu`CE3*Jl9qwC?+|(G=Yyl%9kgc$%1Oa_ku06q&Gu~_ zD4z+=jhtOz(;vC}#>nYka)`)1hG`F&A}FZ0@@+j9OAo5c~3}g#b*bG6#ZSo-Uk!?EthB`qH0My($n-;bU5jtE+3HXmhg31j>O-lX{EeD6 z8iI%|I}a^0LIz-J`Kt>L`)jfcS@d;k=%tt-{+iJ(5Hxp_cYU4heh9tkuUXbCySH?6 zwL*SdH+kf{X!+~cmxxT+|7f={ab!{bRtweRuPG!O@9#yyzZd-$|2xMY|zg$X5K`AoISB z7bE4QZ+-63SSUzofDC+_D7>=a+g$ytILqyaZ!ZxeWRGL<;$C_AF(16HJyz^4wCv3u za`UksLdo}z_38P~E)-(f0e|%_^j5Ro(zX_7z0*ZTw=CB`ij}hEZ(^%VIsSKXyZrii zANSfga?H6(hM$-!2FL{`R*L83xfA(fE`DQ-nykt4>hFB+R`I;8$ov@AcBBp$%kQui4zC6N^;y{CJk z34>4j^uv*I;^}^(K`uL8EUuOBoh}u@GUH5*cv5aZGf0e;=g*82jnaSi%FvZmN6j+I z@RKlEcQzI_Po3=_KsT;&(r<7kPx{-{Fr2W)e|d9w72PzB55-Eul-lZ8AWTs>wa3YN z$yRi4o+VmV=db?RU$X>IxXO-QJE6IHC#qjn{hrfsRFJbhD%EOJgymPb!e9O1Ep2_% z7CP%+VPs{gWWBeS{QO*3{naplvU0na_A3fV!T}RL!NF}x~ST$lXh!c_7olyurcL%vv*J7TV%6Dmi>5|mc>s#_cW_FvZl+WKlK(_vf-y;`p#fA?l#>k zFZ?uItdn`?V=?p-&nLp+=JTUNR#2WbOU`1^`egI@{^DVI;e7Yu@8KbVNsYBsxc9dY z+8eSAhFL4yl{+q0W;Kwa`iQ?;_-nlnZ<+LSOi=WUTPtTR*5=KcKc})xTU@!QeEuAH z->(+})L)wO&|Jn3&sB`|jDKZpVBE;~55`@LA2NQ)c$D!6#t_`YsCXIUj7u2rV7!mDxr+A0lw(Rn9DevaU|n4j8hm(85c1w zXOxVOFh0uo0^{q9Z!`W?i2nM#61CtRJ-%tU5RZxAz5H0)>yr!D#i||Kh1;`_AG{&z zh3%q?=ToK;7S&sP*dVawaaMJ*El)EwZTchAaEppg>H|Y0h_31!L5hm(B$`B-s`rT0 z0B*(_S%1!%I$ICwJ}Sc~gG7SI8L5}m2SHda&Oq$8sngF)onCCVwN58}VN<6Im|nsOFdfYF zq-~tX6p`JcOJFKCWmHNTZ)04+s2Cq%e35Y*<5!Hw7+nc=yimq|i~|`bFiy5HSX;(| zRcfIJ{jh-FG0K{-!jlt3eA6q*BBF~}sNTsFqw?0{p+zMd&owIPMtx(T7(*8vE_PXx zfh$;b3wA10#Kb+=I9-c-MX*oR4HeycXc;S5w=u@C=>+}VWK*E(@ZF{P-rWd)~Yv1TgUV*B??4Na5K|WUga+knVz%E zlT;Pdo;2(TsfD|gR4B9%T&#SS+L{@Mk(_^vfzF{KUbC!9i`Uq-I1R73d zgo+#v=VGQescVNrTfy`x^&n{*nZBz&Cv7v+Al0=H+6cPWqQo~%EfgPwi*z||Z5NNz z*RAq}wOzytRXzbT+vz%={9s*z7_53`>2Ypuq)$e!hfKcE&@NI#GujOX!zm8C`V(;V z%HZ`0Zf+7iY2q9**zysv>R_hcW-(ZvYq#*()p8>S%ld{qq;ez^HL;A+Ya@1+>g{Vq zo+qsa8#t7Y$5)}*WSL3%fHGIqZe>gwy@>Q@T^p5k@3flrFZDC|xWPHPj6gRn$JP7+Ca#X9-W zWBu^tn-1n#(PnZECby^;$ONAku6VqkSf#}EU=8c!Jz#6pIAV?K*OU* z^b=dvIWSLiTdTbzz1W8D@!{?>infex|4r!A+md6t5Y9gbik{tI`}+WG1*PO}9QM$_)A5 z#HGhoZiY`bySs|aboXpCx5(`6{=_r~xHg;7kOk}gqD<3$)QoYpn7v)Mn`Vg_OfJw} z?cQsq6q%k9bC^rNI@~l}uec_=j8n@>OyM%t=(n4i%V=4qCkt0EW3BGaHp7G6>4;Qh zx=}}ndjJwJ4lkRHh{j{8q)d!-f3oZoq-1PV&z6b%#YauKeKQ$zSe^=`3Jk_CvE(Su`#?(MF~(&qUjXc{ z1vK9<>q7JSSP>4SmVJ%YPPh$7fi?rF2ku~;!t${|>Z#t0|G{0>Y5Z1!WNQpAyUh16TyZBlLm}{J1H7fjAT)@>S#tu{z*9q@TfO#V|a9oXyV; z=Fao_92!IVw!IGX2&_&jU0k+4jrkGwuVCJZ^>xgXZU2DQ%z{hU;4JgeTtOOc8&vXG zU(7s7e}MI8nQwIx#(j*+Tq_>tsk8B!$Q3v{pBYXMu)}%|;Ou>Ttamm) zwFny48DIPRS@E?enL8iGF>NgU4&KDlD@9lU4lDZD4(MIWU}ImKPX&bIGq!WAFdYU7 zcw$cD085cD@e<~1SzpXNin*V8C_XHc{Sf9KLSIONWEOnK2KmhC8#?LJmj&Jd}>qfX@O-2s_1MbB9{ z?^-myqO5%8VjNas>Wmp*uw;JeJUXtjyzL_`>(V*WvZLBZTDYE9KBHpMf|>SN*VH9b z%jZ|(8aJ1ziz`dZ7m!@l4%OpA(bJHW&YBHTsCsdz-dlK@J{hXt?i2SnT{l&~yR&l) zHZU!*yQf_c&agXf4emHpZdNPj>SINO`hXx#^_-`#r+q2G*{10?=@^4) zO&jLx7=y#=g9?3hhq#Lxo6xwt0mg1U>kp!Ya_amx>EDXNLOm?OFUW03S*@${j;WR)8y-)c9olh zy85=VI@$Ks@^Op6+R;jv;-)XB9LR_|%oZEiqO6O2KDe9QcA!sp+=raZ17`uNzPxuIl^8fFX@ST>sOu_ey$uQTLBopam7+$s&?6A<6b z)uh(vZEAx{>8vg4qYmQhOXWd`e`fJK+`g#6dm&|FF7Q{qmYVsNa=^2g0k?py%+ZoI?0(@U6SB1uO-Vre?xXd>Q{C zL{)FoFZ28dm5izh-4mi--==3};7j@n93E6xEyasr3puCnsCkeG&QR{8Xvg>C7opa| z5piaRsK~c;Z(uKKz<)p6K5tj=qr;4vCHpO2UAPljkJd8(yKwiBl`|pVg%}dP{3_=HsPg ze{D_|D;bH8l8t5AoLD4{>jJ*{Hq^~L;b%W;!ak-(hwhn*{GUYGDEfzR<<<6 zZtIGMm}GtoF-g#R4d8SgUAK4L#Y6lBnt1ULZ|yL|OWjVM1$LgTzy494Q_z>FfQC53 zO0;+_1xYde>M3*j@kySgK;DzZshF9-E zzB|-&Z|FTs6A+e88tK@vcB^CMWbLmF9YYz^WF5m}42>lV$Gobs&AevYMb{nD*cQ~D z#zx1ZEsc#<8duMw@J<>Hj@3nJyh?f2WM$fEkcDGjwWiIyX4@JSyIW7Y>=$fe9cP>f zzvsVvPxzfZt)*|yu_BGe%9_xCh+Ea7-FlsrEhILgh zEz~1qU6`lok#}`7LofHrXQ%WHIJ+SIFvgO~e#|f`V&c~+*stvr?r0FB9wGyMuD|6m zTIX68n(>+=+~+a0c`V%R2;cP>Zb$e&gk8zK*<(bou#;Y2HnIe}4t?kQ_*?^8`b#RY z-8P#!#nKhiryRY$WDc?2l#MGFpBnmN;!v5wsPAvOUl{L)ih`yY;l@!h(rJ*GIF=gX z73Z+!7gWnfREzg9yOxsk7Tbq@hwe{S242blb@~O>8Fxj zg5L2#OX`XC5e+siUQ0Ad%%>6V+l(slQj5>}JSD|Ma{%=FML*QKkxcg=rzEsq#cbgW zvzXY6EOjBSK!dF;tr5@#4FQs__&;*j1&uZ6JgYx+K^+1**BTOC6vx_>U?_!VyA~_%uq#u!7kjFt%)VI+_ zenBS5aNO*T!w6kTq!6SKq=3j(AQM5ZCNct~9E2uIv>)V7kQu5h#uyS2MzU}rG*2|H zqT*CzjFBy_SEpi(?%|6_`5KJf-enOncd9tAkrc8C!cQTKOK`ueMtY6Jz(Gh7&{px7 z=MV*XC`{8lcjC%(8b3*|K$WQPkG&sLU=uo4-;XAX*fpTzn7T!5!$mYi#6Ao95@s?P zM~K+JgBD;{O*9V4j=*)&E(jy^{auqk#zitJwIU~f)yA5PSmSo%3Q7eXP30sK$KYu% zL&V=j>RB|ST{Is3Ojc*q_O8Yd5vp3dVs7tNedCS3G1MlGR?2p9>ITwW4-N0h7jw{J zrQ(etF*FRUsbZf5^)-BOWbf$)R~lkAp#G-H7pa17#>gZZTh>solZF;2CqIazomVe) zGnB|wqq-Y;Nz^->qBSn?p&86RUvijD>c#HJpg-dS6Q>jefFgWerc2L>HVbYrufq{l0kUu- z;yP5Bg9_D{eugW6BvUBK%i;J3N&aDdtL+?r`v1vsrJduQVt|$72+ncFUgO`(^&DX) zyNp%n&l02&o{eLyIviu+IBT8Jx_mY@t_I2?DF1@vG&D|6jxv5)u3u(3uKq*EbGGCC z>dGV|HE`T!55aUG!gz|%3vQpwIKI3D9d9&XJTb^Pnkz?bMP{6<%4Hl}P6KH?(?RDY zU9+uwse>-Yh51rt3U>~j(d}BUm*d24mnaFr5uM&Irjud1jMeI=BqJ?qm3YO>Kvmh5 zX4h;p_Bqq7rY0M4YHYF*!v+3Q zM&qX!umFe(yxo9!hNJ|uTxa=LcxfWL4}oO&G;?~bCjM6-Zip#&0s8`%vwkk?>7@(* zvMOgHus1dvDOcfw40C}Lco2{Rr2=se@M=KHxEVK3YSDHe@#lbj5J&;3!n=VKCjg{4 zHv=h71(4!Q1(MxZAlZ!o2FNfE7i2gDNQS+Ds52$jmit^lay*aQ7CD{t~eECqu5t^-mFvw_`#J(;)SZiy$1 z@07ix_I&}wN4b)1I2+gp@@s$?&6Knt^gmsMvEYo$&hRLZ zGW-~bKkrVKzs&MYKx)|rAhqmoK;)QG%kq^#YH1me;!FqP&pQb}WPc5i^!Wi?kih_8 z540c>NP%@A8D21L!!tm#I|3xTgFv!-kM)0N{U#t>y-xxALQlsoR8cLE{BHv$!2bpy z`3J`0qAxB+0Ld^LXe9(B!z3UX#2z?->02lc44#AHOyab5tMv4nafqpjZK)Zlsw-rc%UI0>{r&<3n>+69O zhyD*Dy00t-_6E)blKu5SN^Cr^6Xu_H6fVeNAP`@oQ~Iz$cgsNYMzY=n_J;mEj48nT zKuYLMASFcKW2l0E0I4Td0m=SWU@zcsAlY95B>N0tUt0f{;-VLjzFUz2{qI-!^P2df zo;ZRjPl4#fsTYt=s>n_PDbT$@s`yUU|C#mkfE4EjAl+HV04Yu`kn9HmODW(0Tu{Iy zAUSjflHtFw{lHEzKNIB@XABQqqiPMc`4i0TsHM@k0iO!%3@YPY_2(Ixn?HP$hBa9r -#import -#import - -/* CLASSES */ - -@class Binary; -@class Process; - -/* DEFINES */ - -//from audit_kevents.h -#define EVENT_EXIT 1 -#define EVENT_FORK 2 -#define EVENT_EXECVE 23 -#define EVENT_EXEC 27 -#define EVENT_SPAWN 43190 - -//signers -enum Signer{None, Apple, AppStore, DevID, AdHoc}; - -//signature status -#define KEY_SIGNATURE_STATUS @"signatureStatus" - -//signer -#define KEY_SIGNATURE_SIGNER @"signatureSigner" - -//signing auths -#define KEY_SIGNATURE_AUTHORITIES @"signatureAuthorities" - -//code signing id -#define KEY_SIGNATURE_IDENTIFIER @"signatureIdentifier" - -//entitlements -#define KEY_SIGNATURE_ENTITLEMENTS @"signatureEntitlements" - -/* TYPEDEFS */ - -//block for library -typedef void (^ProcessCallbackBlock)(Process* _Nonnull); - -/* OBJECT: PROCESS INFO */ - -@interface ProcInfo : NSObject - -//init w/ flag -// flag dictates if CPU-intensive logic (code signing, etc) should be preformed --(id _Nullable)init:(BOOL)goEasy; - -//start monitoring --(void)start:(ProcessCallbackBlock _Nonnull )callback; - -//stop monitoring --(void)stop; - -//get list of running processes --(NSMutableArray* _Nonnull)currentProcesses; - -@end - -/* OBJECT: PROCESS */ - -@interface Process : NSObject - -/* PROPERTIES */ - -//pid -@property pid_t pid; - -//ppid -@property pid_t ppid; - -//user id -@property uid_t uid; - -//type -// used by process mon -@property u_int16_t type; - -//exit code -@property u_int32_t exit; - -//path -@property(nonatomic, retain)NSString* _Nullable path; - -//args -@property(nonatomic, retain)NSMutableArray* _Nonnull arguments; - -//ancestors -@property(nonatomic, retain)NSMutableArray* _Nonnull ancestors; - -//signing info -@property(nonatomic, retain)NSMutableDictionary* _Nonnull signingInfo; - -//Binary object -// has path, hash, etc -@property(nonatomic, retain)Binary* _Nonnull binary; - -//timestamp -@property(nonatomic, retain)NSDate* _Nonnull timestamp; - -/* METHODS */ - -//init with a pid -// method will then (try) fill out rest of object --(id _Nullable)init:(pid_t)processID; - -//generate signing info -// also classifies if Apple/from App Store/etc. --(void)generateSigningInfo:(SecCSFlags)flags; - -//set process's path --(void)pathFromPid; - -//generate list of ancestors --(void)enumerateAncestors; - -//class method -// get's parent of arbitrary process -+(pid_t)getParentID:(pid_t)child; - -@end - -/* OBJECT: BINARY */ - -@interface Binary : NSObject -{ - -} - -/* PROPERTIES */ - -//path -@property(nonatomic, retain)NSString* _Nonnull path; - -//name -@property(nonatomic, retain)NSString* _Nonnull name; - -//icon -@property(nonatomic, retain)NSImage* _Nonnull icon; - -//file attributes -@property(nonatomic, retain)NSDictionary* _Nullable attributes; - -//spotlight meta data -@property(nonatomic, retain)NSDictionary* _Nullable metadata; - -//bundle -// nil for non-apps -@property(nonatomic, retain)NSBundle* _Nullable bundle; - -//signing info -@property(nonatomic, retain)NSDictionary* _Nonnull signingInfo; - -//hash -@property(nonatomic, retain)NSMutableString* _Nonnull sha256; - -//identifier -// either signing id or sha256 hash -@property(nonatomic, retain)NSString* _Nonnull identifier; - -/* METHODS */ - -//init w/ a path --(id _Nonnull)init:(NSString* _Nonnull)path; - -/* the following methods are rather CPU-intensive - as such, if the proc monitoring is run with the 'goEasy' option, they aren't automatically invoked -*/ - -//get an icon for a process -// for apps, this will be app's icon, otherwise just a standard system one --(void)getIcon; - -//generate signing info (statically) --(void)generateSigningInfo:(SecCSFlags)flags; - -/* the following methods are not invoked automatically - as such, if you code has to manually invoke them if you want this info - */ - -//generate hash -// algo: sha256 --(void)generateHash; - -//generate id -// either signing id, or sha256 hash --(void)generateIdentifier; - -@end - -#endif