objective-see/TaskExplorer
1
0
Fork 0
mirror of https://github.com/objective-see/TaskExplorer.git synced 2026-03-22 07:02:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

added DNS resolution for remote endpoints

Browse Source 
added DNS resolution into search
updated 'flagged' items view, to use new main text scheme
fixed bug in 'flagged' items view - where VT window wouldn't display
This commit is contained in:
Patrick Wardle
2016-02-27 16:41:13 -10:00
parent 5b3ca683dc
commit 9585a14eb4
9 changed files with 123 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AppDelegate.h
+13 -17
View File
@@ -6,28 +6,24 @@
// Copyright (c) 2015 Objective-See. All rights reserved.
//
#import "Binary.h"
#import "ItemBase.h"
#import "Filter.h"
#import "VirusTotal.h"
#import "TaskTableController.h"
#import "AboutWindowController.h"
#import "PrefsWindowController.h"
#import "FlaggedItems.h"
#import "ResultsWindowController.h"
#import "RequestRootWindowController.h"
#import "SearchWindowController.h"
#import "CustomTextField.h"
#import <Cocoa/Cocoa.h>
#import "Task.h"
#import "Filter.h"
#import "Binary.h"
#import "ItemBase.h"
#import "VirusTotal.h"
#import "TaskEnumerator.h"
#import "CustomTextField.h"
#import "TaskTableController.h"
#import "AboutWindowController.h"
#import "PrefsWindowController.h"
#import "SearchWindowController.h"
#import "ResultsWindowController.h"
#import "FlaggedItemWindowController.h"
#import "RequestRootWindowController.h"
#import <Cocoa/Cocoa.h>
@interface AppDelegate : NSObject <NSApplicationDelegate, NSWindowDelegate, NSTableViewDataSource, NSTableViewDelegate, NSMenuDelegate>
{
Filter.m
+11
View File
@@ -311,6 +311,17 @@ NSString * const BINARY_KEYWORDS[] = {@"#apple", @"#nonapple", @"#signed", @"#un
continue;
}
//check DNS name
if( (nil != item.remoteName) &&
(NSNotFound != [item.remoteName rangeOfString:filterText options:NSCaseInsensitiveSearch].location) )
{
//save match
[results addObject:item];
//next
continue;
}
}//all connections
}//sync
FlaggedItems.h → FlaggedItemWindowController.h
View File
FlaggedItems.m → FlaggedItemWindowController.m
+30 -5
View File
@@ -6,11 +6,11 @@
// Copyright (c) 2015 Objective-See. All rights reserved.
//
#import "AppDelegate.h"
#import "FlaggedItems.h"
#import "ItemView.h"
#import "KKRow.h"
#import "ItemView.h"
#import "Utilities.h"
#import "AppDelegate.h"
#import "FlaggedItemWindowController.h"
@interface FlaggedItems ()
@@ -200,8 +200,11 @@ bail:
// ->launch browser and browse to virus total's page
-(void)showVTInfo:(id)sender
{
//item
id item = nil;
//binary
Binary* item = nil;
Binary* binary = nil;
//row
NSInteger itemRow = 0;
@@ -221,8 +224,30 @@ bail:
//extract item for row
item = self.flaggedItems[itemRow];
//tasks
// ->grab binary
if(YES == [item isKindOfClass:[Task class]])
{
//get binary
binary = ((Task*)item).binary;
}
//binaries
// ->can use as is
else if(YES == [item isKindOfClass:[Binary class]])
{
//set
binary = item;
}
//sanity check
if(nil == binary)
{
//bail
goto bail;
}
//alloc/init info window
vtWindowController = [[VTInfoWindowController alloc] initWithItem:item];
vtWindowController = [[VTInfoWindowController alloc] initWithItem:binary];
//show it
[self.vtWindowController.windowController showWindow:self];
Items/Connection.h
+3
View File
@@ -26,6 +26,9 @@
//remote port
@property(nonatomic, retain)NSNumber* remotePort;
//remote name (url)
@property(nonatomic, retain)NSString* remoteName;
//socket type
@property(nonatomic, retain)NSString* type;
Items/Connection.m
+51 -22
View File
@@ -13,6 +13,7 @@
@implementation Connection
@synthesize endpoints;
@synthesize remoteName;
//init method
-(id)initWithParams:(NSDictionary*)params
@@ -52,8 +53,18 @@
//set icon
[self setConnectionIcon];
//resolve in background
//dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0), ^{
//resolve
[self addressesForHost];
//build/set connection string
[self setConnectionString];
//});
}
@@ -79,8 +90,28 @@
//set
self.icon = [NSImage imageNamed:@"connectedIcon"];
}
//wait related states
else if( (YES == [self.state isEqualToString:@"close/wait"]) ||
(YES == [self.state isEqualToString:@"in wait 1"]) ||
(YES == [self.state isEqualToString:@"closing"]) ||
(YES == [self.state isEqualToString:@"last act"]) ||
(YES == [self.state isEqualToString:@"fin wait 2"]) ||
(YES == [self.state isEqualToString:@"time wait"]) )
{
//set
self.icon = [NSImage imageNamed:@"closeWait"];
}
//closed
else if(YES == [self.state isEqualToString:@"closed"])
{
//set
self.icon = [NSImage imageNamed:@"closedIcon"];
}
//TODO: set other icon?
//YES: close-wait!!!
}
//set icon for UDP sockets
@@ -97,32 +128,23 @@
//resolve a remote IP address to nice DNS name
// ->uses address and port, which are passed to getaddrinfo
// note: get thread to call this, cuz it can be slow!!
// note: call from bg thread, cuz it can be slow due to DNS resolution(s)
-(void)addressesForHost
{
/*
struct addrinfo hints = {.ai_family=PF_UNSPEC;.ai_socktype=SOCK_STREAM;.ai_protocol=IPPROTO_TCP};
struct addrinfo *res;
int gai_error = getaddrinfo(host.UTF8String, port.stringValue.UTF8String, &hints, &res);
if (gai_error) {
if (outError) *outError = [NSError errorWithDomain:@"MyDomain" code:gai_error userInfo:@{NSLocalizedDescriptionKey:@(gai_strerror(gai_error))}];
return nil;
}
NSMutableArray *addresses = [NSMutableArray array];
struct addrinfo *ai = res;
do {
NSData *address = [NSData dataWithBytes:ai->ai_addr length:ai->ai_addrlen];
[addresses addObject:address];
} while (ai = ai->ai_next);
freeaddrinfo(res);
return [addresses copy];
*/
//host
NSHost* host = nil;
//init host
host = [NSHost hostWithAddress:self.remoteIPAddr];
//extract/save name
self.remoteName = host.name;
return;
}
//build nice string
//build printable connection string
-(void)setConnectionString
{
//add local addr/port to endpoint string
@@ -133,8 +155,15 @@
if( (nil != self.remoteIPAddr) &&
(nil != self.remotePort) )
{
//add remote endpoint
//add remote IP:port
[self.endpoints appendString:[NSString stringWithFormat:@" -> %@:%d", self.remoteIPAddr, [self.remotePort unsignedShortValue]]];
//add DNS name
if(nil != self.remoteName)
{
//add
[self.endpoints appendString:[NSString stringWithFormat:@" (%@)", self.remoteName]];
}
}
return;
TaskTableController.m
+9 -8
View File
@@ -607,32 +607,33 @@ bail:
{
//item
// ->task, dylib, file, etc
Binary* item = nil;
Binary* binary = nil;
//for top pane
// ->get task
// ->get binary from task
if(YES != self.isBottomPane)
{
//get task
item = [(Task*)[self taskForRow:sender] binary];
//get task's binary
binary = [(Task*)[self taskForRow:sender] binary];
}
//bottom pane
// ->straight assign
else
{
//get item
item = (Binary*)[self itemForRow:sender];
binary = (Binary*)[self itemForRow:sender];
}
//bail on nil items
if(nil == item)
//bail on nil binaries
if(nil == binary)
{
//bail
goto bail;
}
//alloc/init info window
vtWindowController = [[VTInfoWindowController alloc] initWithItem:item];
vtWindowController = [[VTInfoWindowController alloc] initWithItem:binary];
//show it
[self.vtWindowController.windowController showWindow:self];
UI/FlaggedItems.xib
+5 -16
View File
@@ -1,8 +1,8 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14F27" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="9532" systemVersion="15D21" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
<dependencies>
<deployment identifier="macosx"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="7706"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="9532"/>
</dependencies>
<objects>
<customObject id="-2" userLabel="File's Owner" customClass="FlaggedItems">
@@ -70,7 +70,7 @@
<imageCell key="cell" refusesFirstResponder="YES" alignment="left" imageScaling="proportionallyDown" image="unknown" id="e2z-Kq-Gr8"/>
</imageView>
<textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="SI4-HT-3LO">
<rect key="frame" x="46" y="20" width="225" height="19"/>
<rect key="frame" x="46" y="20" width="1108" height="19"/>
<textFieldCell key="cell" lineBreakMode="truncatingTail" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Name" id="t89-gZ-pCr">
<font key="font" size="13" name="Menlo-Regular"/>
<color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -160,26 +160,15 @@
<color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
</textFieldCell>
</textField>
<textField horizontalHuggingPriority="251" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" tag="102" translatesAutoresizingMaskIntoConstraints="NO" id="HUg-RC-ApX">
<rect key="frame" x="264" y="20" width="868" height="18"/>
<constraints>
<constraint firstAttribute="height" constant="18" id="p2j-Rg-UCM"/>
</constraints>
<textFieldCell key="cell" lineBreakMode="truncatingTail" sendsActionOnEndEditing="YES" title="pid" id="g8r-Fj-UsA">
<font key="font" size="13" name="Menlo-Regular"/>
<color key="textColor" white="0.49295236009999999" alpha="0.84999999999999998" colorSpace="calibratedWhite"/>
<color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
</textFieldCell>
</textField>
</subviews>
<constraints>
<constraint firstItem="Ska-cO-ibK" firstAttribute="leading" secondItem="JeV-w6-lMk" secondAttribute="trailing" constant="17" id="CYN-Mk-OYX"/>
<constraint firstItem="SXe-Gt-BE8" firstAttribute="leading" secondItem="SI4-HT-3LO" secondAttribute="trailing" constant="3" id="Jjj-bX-vFS"/>
<constraint firstItem="4pP-3r-LmH" firstAttribute="leading" secondItem="LL3-Mq-2hG" secondAttribute="leading" constant="4" id="Lwa-4l-9kr"/>
<constraint firstAttribute="trailing" secondItem="HUg-RC-ApX" secondAttribute="trailing" constant="171" id="Vgm-3I-yka"/>
<constraint firstItem="CXT-MY-otd" firstAttribute="leading" secondItem="lSO-MV-z6s" secondAttribute="trailing" constant="8" id="ZSp-vP-YLC"/>
<constraint firstItem="JeV-w6-lMk" firstAttribute="leading" secondItem="CXT-MY-otd" secondAttribute="trailing" constant="11" id="e7R-yR-yTc"/>
<constraint firstItem="4pP-3r-LmH" firstAttribute="top" secondItem="LL3-Mq-2hG" secondAttribute="top" constant="7" id="efk-9Z-3l9"/>
<constraint firstItem="HUg-RC-ApX" firstAttribute="leading" secondItem="SI4-HT-3LO" secondAttribute="trailing" constant="5" id="gw8-gc-Vur"/>
<constraint firstItem="SI4-HT-3LO" firstAttribute="leading" secondItem="9M9-hz-Wz2" secondAttribute="trailing" constant="4" id="jjF-Zg-bgc"/>
<constraint firstAttribute="trailing" secondItem="Ska-cO-ibK" secondAttribute="trailing" constant="20" id="kvw-nk-f5L"/>
<constraint firstItem="LPP-Mp-jbS" firstAttribute="leading" secondItem="lIr-8u-JaJ" secondAttribute="trailing" constant="22" id="ngn-Iy-gr1"/>
<constraint firstItem="lSO-MV-z6s" firstAttribute="leading" secondItem="4pP-3r-LmH" secondAttribute="trailing" constant="2" id="sil-ah-ybv"/>
remoteTaskService/remoteTaskService.m
+1 -1
View File
@@ -568,7 +568,7 @@ bail:
//number of handle
int numberOfProcFDs = 0;
//socket handle struct
//socket info struct
struct socket_fdinfo socketInfo = {0};
//socket local addr