added new button/view (and logic) to detect/display all flagged items

2026-03-22 07:02:39 +00:00 · 2015-08-16 20:27:47 -10:00
parent 46d1cf4f9d
commit 9c632982ac
23 changed files with 1069 additions and 86 deletions
@@ -15,6 +15,7 @@

 #import "AboutWindowController.h"
 #import "PrefsWindowController.h"
+#import "FlaggedItems.h"
 #import "ResultsWindowController.h"
 #import "RequestRootWindowController.h"

@@ -27,7 +28,6 @@

@interface AppDelegate : NSObject <NSApplicationDelegate, NSWindowDelegate, NSTableViewDataSource, NSTableViewDelegate, NSMenuDelegate>
 {
-    //NSViewController *bottomViewController;

 }

@@ -111,6 +111,9 @@
 //results window controller
@property(nonatomic, retain)ResultsWindowController* resultsWindowController;

+//flagged items window controller
+@property(nonatomic, retain)FlaggedItems* flagItemsWindowController;
+
 //currently selected task
@property(nonatomic, retain)Task* currentTask;

@@ -119,11 +122,19 @@

 //'no items' found label for bottom pane
@property (weak) IBOutlet NSTextField *noItemsLabel;
+
+//search button
@property (weak) IBOutlet NSButton *searchButton;

 //refresh button
@property (weak) IBOutlet NSButton *refreshButton;

+//flagged items button
+@property (weak) IBOutlet NSButton *flaggedButton;
+
+//flagged items label
+@property (weak) IBOutlet NSTextField *flaggedLabel;
+
 //top constraint
@property(nonatomic, retain)NSLayoutConstraint* topConstraint;

@@ -137,7 +148,10 @@
@property(nonatomic, retain)NSLayoutConstraint* trailingConstraint;

 //remote XPC interface
-@property (nonatomic, retain) NSXPCConnection* xpcConnection;
+@property(nonatomic, retain) NSXPCConnection* xpcConnection;
+
+//flagged items
+@property(nonatomic, retain) NSMutableArray* flaggedItems;


 /* METHODS */
@@ -201,4 +215,11 @@
 //constrain subview to parent view
 -(void)constrainView:(NSView*)containerView subView:(NSView*)subView;

+//display (in separate popup) all flagged items
+-(IBAction)showFlaggedItems:(id)sender;
+
+//save a flagged binary
+// ->also set text flagged items button label to red
+-(void)saveFlaggedBinary:(Binary*)binary;
+
@end
@@ -24,6 +24,15 @@
 //TODO: add 'am i on main thread' guard and test
 //TODO: filter dylibs, no first responder!

+//TODO: autolayout vertically
+//TODO: filter VT results
+//TODO: # autocomplete
+//TODO: keyboard shortcuts
+//      see: https://mail.google.com/mail/u/0/#inbox/14eeb163d4dd2852
+//TODO: show 'from where' via quarantine attrz
+//TODO: show user (after pid): -> (pid, user)?
+//TODO: when filtering, and then refresh, doesn't go to row #0 :/
+
@implementation AppDelegate


@@ -41,6 +50,7 @@
@synthesize currentTask;
@synthesize requestRootWindowController;
@synthesize taskViewFormat;
+@synthesize flagItemsWindowController;

@synthesize scannerThread;
@synthesize progressIndicator;
@@ -50,11 +60,14 @@
@synthesize viewSelector;
@synthesize searchButton;
@synthesize xpcConnection;
+@synthesize flaggedItems;


 //@synthesize taskScrollView;
 //TODO: check if VT can be reached! if not, error? or don't show '0 VT results detected' etc...

+//TODO: JavaW (iWorm) dylibs...
+
 //center window
 // ->also make front
 -(void)awakeFromNib
@@ -77,8 +90,7 @@
 {
    //first thing...
    // ->install exception handlers!
-    //TODO: re-enable
-    //installExceptionHandlers();
+    installExceptionHandlers();
    
    //init virus total object
    virusTotalObj = [[VirusTotal alloc] init];
@@ -86,6 +98,9 @@
    //init filter obj
    filterObj = [[Filter alloc] init];
    
+    //alloc flagged items
+    flaggedItems = [NSMutableArray array];
+    
    //no need to have a first responder
    [self.window makeFirstResponder:nil];
    
@@ -752,6 +767,13 @@ bail:
    
    //add tracking area to logo button
    [self.logoButton addTrackingArea:trackingArea];
+
+    //init tracking area
+    // ->for flagged items button
+    trackingArea = [[NSTrackingArea alloc] initWithRect:[self.flaggedButton bounds] options:(NSTrackingInVisibleRect|NSTrackingMouseEnteredAndExited | NSTrackingActiveAlways) owner:self userInfo:@{@"tag":[NSNumber numberWithUnsignedInteger:self.flaggedButton.tag]}];
+    
+    //add tracking area to flaggd items button
+    [self.flaggedButton addTrackingArea:trackingArea];
    
    return;
 }
@@ -963,6 +985,13 @@ bail:
            //set
            imageName = @"logoApple";
        }
+        
+        //set original flagged items image
+        else if(FLAGGED_BUTTON_TAG == tag)
+        {
+            //set
+            imageName = @"flagged";
+        }
    }
    //highlight button
    else
@@ -991,6 +1020,13 @@ bail:
            //set
            imageName = @"logoAppleOver";
        }
+        
+        //set mouse over flagged items image
+        else if(FLAGGED_BUTTON_TAG == tag)
+        {
+            //set
+            imageName = @"flaggedOver";
+        }
    }
    
    //set image
@@ -1337,6 +1373,9 @@ bail:
            //init placeholder text for dylibs
            filterPlaceholder =  @"Filter Dylibs";
            
+            //remove all task's dylibs
+            [self.currentTask.dylibs removeAllObjects];
+            
            //(re)enumerate dylibs via XPC
            // ->triggers table reload when done
            [self.currentTask enumerateDylibs:self.xpcConnection allDylibs:self.taskEnumerator.dylibs];
@@ -1349,6 +1388,9 @@ bail:
            //init placeholder text for files
            filterPlaceholder = @"Filter Files";
            
+            //remove all task's dylibs
+            [self.currentTask.files removeAllObjects];
+            
            //(re)enumerate files via XPC
            // ->triggers table reload when done
            [self.currentTask enumerateFiles:self.xpcConnection];
@@ -1380,7 +1422,7 @@ bail:
        dispatch_sync(dispatch_get_main_queue(), ^{
            
            //set placeholder
-            [self.filterItemsBox setPlaceholderString:filterPlaceholder];
+            [[self.filterItemsBox cell] setPlaceholderString:filterPlaceholder];
        });
    }
    //in main thread already
@@ -1388,7 +1430,7 @@ bail:
    else
    {
        //set placeholder
-        [self.filterItemsBox setPlaceholderString:filterPlaceholder];
+        [[self.filterItemsBox cell] setPlaceholderString:filterPlaceholder];
    }
    
    
@@ -1649,5 +1691,76 @@ bail:
    return;
 }

+//TODO: handle reset on refresh?
+//save a flagged item
+// ->also set text flagged items button label to red
+-(void)saveFlaggedBinary:(Binary*)binary
+{
+    //sync to save
+    @synchronized(self.flaggedItems)
+    {
+        //save
+        [self.flaggedItems addObject:binary];
+    }
+    
+    //when count is 1
+    // ->means first flagged file so set text to red
+    if(1 == self.flaggedItems.count)
+    {
+        //set to red
+        self.flaggedLabel.textColor = [NSColor redColor];
+    }
+    
+    return;
+}
+
+//button handle for 'flagged items' button
+// ->display (in separate popup) all flagged items
+-(IBAction)showFlaggedItems:(id)sender
+{
+    //alert box
+    NSAlert* alert = nil;
+    
+    //handle case where there aren't any flagged items
+    // ->just show alert
+    if(0 == self.flaggedItems.count)
+    {
+        //alloc/init alert
+        alert = [NSAlert alertWithMessageText:[NSString stringWithFormat:@"No items flagged by VirusTotal"] defaultButton:@"Ok" alternateButton:nil otherButton:nil informativeTextWithFormat:@"horray! 😇"];
+        
+        //and show it
+        [alert runModal];
+    }
+    
+    //show flagged items
+    else
+    {
+        //alloc/init settings window
+        if(nil == self.flagItemsWindowController)
+        {
+            //alloc/init
+            flagItemsWindowController = [[FlaggedItems alloc] initWithWindowNibName:@"FlaggedItems"];
+        }
+                
+        //show it
+        [self.flagItemsWindowController showWindow:self];
+        
+        //invoke function in background that will make window modal
+        // ->waits until window is non-nil
+        dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
+            
+            //make modal
+            makeModal(self.prefsWindowController);
+            
+        });
+
+        
+    }
+    
+    //NSLog(@"would show flagged items");
+    
+    return;
+}
+

@end
@@ -95,6 +95,9 @@
 //logo button
 #define LOGO_BUTTON_TAG 10004

+//flagged items button
+#define FLAGGED_BUTTON_TAG 10005
+
 //category table


@@ -0,0 +1,24 @@
+//
+//  FlaggedItems.h
+//  TaskExplorer
+//
+//  Created by Patrick Wardle on 8/14/15.
+//  Copyright (c) 2015 Lucas Derraugh. All rights reserved.
+//
+
+#import <Cocoa/Cocoa.h>
+
+@interface FlaggedItems : NSWindowController
+
+//PROPERTIES
+
+//flag for first time init's
+@property BOOL didInit;
+
+//table
+@property (weak) IBOutlet NSTableView *flaggedItemTable;
+
+//vt window controller
+@property (nonatomic, retain)VTInfoWindowController* vtWindowController;
+
+@end
@@ -0,0 +1,162 @@
+//
+//  FlaggedItems.m
+//  TaskExplorer
+//
+//  Created by Patrick Wardle on 8/14/15.
+//  Copyright (c) 2015 Lucas Derraugh. All rights reserved.
+//
+
+#import "AppDelegate.h"
+#import "FlaggedItems.h"
+#import "ItemView.h"
+#import "KKRow.h"
+
+
+@interface FlaggedItems ()
+
+@end
+
+@implementation FlaggedItems
+
+@synthesize didInit;
+@synthesize flaggedItemTable;
+@synthesize vtWindowController;
+
+//automatically called when nib is loaded
+// ->center window
+-(void)awakeFromNib
+{
+    //single time init
+    if(YES != self.didInit)
+    {
+        //center
+        [self.window center];
+        
+        //set flag
+        self.didInit = YES;
+    }
+    
+    return;
+}
+
+//automatically invoked when window is loaded
+// ->set to white
+-(void)windowDidLoad
+{
+    //super
+    [super windowDidLoad];
+    
+    //table reload
+    [self.flaggedItemTable reloadData];
+}
+
+//table delegate
+// ->return number of rows, which is just number of items in the currently selected plugin
+-(NSInteger)numberOfRowsInTableView:(NSTableView *)tableView
+{
+    return ((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems.count;
+}
+
+//table delegate method
+// ->return cell for row
+-(NSView *)tableView:(NSTableView *)tableView viewForTableColumn:(NSTableColumn *)tableColumn row:(NSInteger)row
+{
+    //flagged items
+    NSMutableArray* flaggedItems = nil;
+    
+    //row view
+    NSView* rowView = nil;
+    
+    //grab flagged items
+    flaggedItems = ((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems;
+    
+    //sanity check
+    // ->make sure there is table item for row
+    if(row >= flaggedItems.count)
+    {
+        //bail
+        goto bail;
+    }
+    
+    //create the view
+    // ->inits row w/ all required info
+    rowView = createItemView(tableView, self, [flaggedItems objectAtIndex:row]);
+    
+//bail
+bail:
+    
+    return rowView;
+}
+
+//automatically invoked
+// ->create custom (sub-classed) NSTableRowView
+-(NSTableRowView *)tableView:(NSTableView *)tableView rowViewForRow:(NSInteger)row
+{
+    //row view
+    KKRow* rowView = nil;
+    
+    //row ID
+    static NSString* const kRowIdentifier = @"TableRowView";
+    
+    //try grab existing row view
+    rowView = [tableView makeViewWithIdentifier:kRowIdentifier owner:self];
+    
+    //make new if needed
+    if(nil == rowView)
+    {
+        //create new
+        // ->size doesn't matter
+        rowView = [[KKRow alloc] initWithFrame:NSZeroRect];
+        
+        //set row ID
+        rowView.identifier = kRowIdentifier;
+    }
+    
+    return rowView;
+}
+
+//invoked when the user clicks 'virus total' icon
+// ->launch browser and browse to virus total's page
+-(void)showVTInfo:(id)sender
+{
+    //binary
+    Binary* item = nil;
+    
+    //row
+    NSInteger itemRow = 0;
+    
+    //flagged items
+    NSMutableArray* flaggedItems = nil;
+    
+    //grab flagged items
+    flaggedItems = ((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems;
+    
+    //grab sender's row
+    itemRow = [self.flaggedItemTable rowForView:sender];
+    
+    //sanity check(s)
+    // ->make sure row is decent
+    if( (-1 == itemRow) ||
+        (itemRow >= flaggedItems.count) )
+    {
+        //bail
+        goto bail;
+    }
+    
+    //extract item for row
+    item = flaggedItems[itemRow];
+    
+    //alloc/init info window
+    vtWindowController = [[VTInfoWindowController alloc] initWithItem:item];
+    
+    //show it
+    [self.vtWindowController.windowController showWindow:self];
+    
+    
+//bail
+bail:
+    
+    return;
+}
+
+@end
@@ -19,6 +19,9 @@
 //create customize item view
 NSTableCellView* createItemView(NSTableView* tableView, id owner, id item);

+//create & customize flagged item view
+NSTableCellView* createFlaggedItemView(NSTableView* tableView, id owner, id item);
+
 //create & customize task view
 NSTableCellView* createTaskView(NSTableView* tableView, id owner, id item);

@@ -19,15 +19,22 @@ NSTableCellView* createItemView(NSTableView* tableView, id owner, id item)
    //item cell
    NSTableCellView *itemCell = nil;
    
-    //sanity chec
+    //sanity check
    if(nil == item)
    {
        //bail
        goto bail;
    }
    
+    //first handle logic for flagged items
+    if(YES == [owner isKindOfClass:[FlaggedItems class]])
+    {
+        //create & config view
+        itemCell = createFlaggedItemView(tableView, owner, item);
+    }
+    
    //logic to create task view
-    if(YES == [item isKindOfClass:[Task class]])
+    else if(YES == [item isKindOfClass:[Task class]])
    {
        //create & config view
        itemCell = createTaskView(tableView, owner, item);
@@ -126,9 +133,147 @@ NSImage* getCodeSigningIcon(Binary* binary)
    }
    
    return codeSignIcon;
-    
 }

+//create & customize flagged item view
+NSTableCellView* createFlaggedItemView(NSTableView* tableView, id owner, Binary* binary)
+{
+    //item cell
+    NSTableCellView* flaggedItemCell = nil;
+    
+    //matching or host tasks
+    NSMutableArray* tasks = nil;
+    
+    //pid or 'loaded in' string
+    NSMutableString* pidString = nil;
+    
+    //task's name frame
+    CGRect nameFrame = {0};
+    
+    //for main (task) binaries
+    // ->just need task's pid
+    if(YES == binary.isTaskBinary)
+    {
+        //get all matching tasks
+        tasks = [((AppDelegate*)[[NSApplication sharedApplication] delegate]).taskEnumerator tasksForBinary:binary];
+        
+        //start 'tasks: ...' str
+        pidString = [NSMutableString stringWithFormat:@"(tasks:"];
+        
+        //add all tasks
+        for(Task* task in tasks)
+        {
+            //append name
+            [pidString appendFormat:@" %@,", task.pid];
+        }
+        
+        //remove last ','
+        if(YES == [pidString hasSuffix:@","])
+        {
+            //remove
+            [pidString deleteCharactersInRange:NSMakeRange([pidString length]-1, 1)];
+        }
+        
+        //terminate list/output
+        [pidString appendString:@")"];
+    }
+    //for dylibs
+    // ->list all tasks the flagged dylib is loaded in
+    else
+    {
+        //get host tasks
+        tasks = [((AppDelegate*)[[NSApplication sharedApplication] delegate]).taskEnumerator loadedIn:binary];
+        
+        //start 'loaded in: ...' str
+        pidString = [NSMutableString stringWithFormat:@"(loaded in:"];
+        
+        //add all tasks
+        for(Task* task in tasks)
+        {
+            //append name
+            [pidString appendFormat:@" %@,", task.binary.name];
+        }
+        
+        //remove last ','
+        if(YES == [pidString hasSuffix:@","])
+        {
+            //remove
+            [pidString deleteCharactersInRange:NSMakeRange([pidString length]-1, 1)];
+        }
+        
+        //terminate list/output
+        [pidString appendString:@")"];
+    }
+    
+    //create cell
+    flaggedItemCell = [tableView makeViewWithIdentifier:@"FlaggedItem" owner:owner];
+    if(nil == flaggedItemCell)
+    {
+        //bail
+        goto bail;
+    }
+    
+    //brand new cells need tracking areas
+    // ->determine if new, by checking default (.xib/IB) value
+    if(YES == [flaggedItemCell.textField.stringValue isEqualToString:@"Flagged Item Name"])
+    {
+        //add tracking area
+        // ->'vt' button
+        addTrackingArea(flaggedItemCell, TABLE_ROW_VT_BUTTON, owner);
+        
+        //add tracking area
+        // ->'info' button
+        addTrackingArea(flaggedItemCell, TABLE_ROW_INFO_BUTTON, owner);
+        
+        //add tracking area
+        // ->'show' button
+        addTrackingArea(flaggedItemCell, TABLE_ROW_SHOW_BUTTON, owner);
+    }
+    
+    //set icon
+    flaggedItemCell.imageView.image = [binary icon];
+    
+    //set code signing icon
+    ((NSImageView*)[flaggedItemCell viewWithTag:TABLE_ROW_SIGNATURE_ICON]).image = getCodeSigningIcon(binary);
+    
+    //default
+    // ->(re)set main textfield's color to black
+    flaggedItemCell.textField.textColor = [NSColor blackColor];
+    
+    //set main text
+    // ->name
+    [flaggedItemCell.textField setStringValue:binary.name];
+    
+    //get name frame
+    nameFrame = flaggedItemCell.textField.frame;
+    
+    //adjust width to fit text
+    nameFrame.size.width = [flaggedItemCell.textField.stringValue sizeWithAttributes: @{NSFontAttributeName: flaggedItemCell.textField.font}].width + 5;
+    
+    //disable autolayout for name
+    flaggedItemCell.textField.translatesAutoresizingMaskIntoConstraints = YES;
+    
+    //update name frame
+    // ->should now be exact size of text
+    flaggedItemCell.textField.frame = nameFrame;
+    
+    //set pid
+    // ->immediately follows name
+    [((NSTextField*)[flaggedItemCell viewWithTag:TABLE_ROW_PID_LABEL]) setStringValue:pidString];
+
+    //set path
+    [[flaggedItemCell viewWithTag:TABLE_ROW_SUB_TEXT_TAG] setStringValue:binary.path];
+    
+    //config VT button
+    configVTButton(flaggedItemCell, owner, binary);
+    
+//bail
+bail:
+    
+    return flaggedItemCell;
+}
+
+
 //create & customize Task view
 NSTableCellView* createTaskView(NSTableView* tableView, id owner, Task* task)
 {
@@ -155,7 +155,7 @@
    //2nd arg: permissions
    // ->4 at front is setuid
    //TODO: make 4755 before deploy (for testing, 777 makes XCOde be able to del it during build!)
-    installArgs[1] = "4755";
+    installArgs[1] = "4777";
    
    //3rd arg: XPC service
    installArgs[2] = [xpcService UTF8String];
@@ -57,5 +57,15 @@
 // ->get list of all child pids
 -(void)getAllChildren:(Task*)parent children:(NSMutableArray*)children;

+//get all tasks a dylib is loaded into
+-(NSMutableArray*)loadedIn:(Binary*)dylib;
+
+//get all task pids for a given binary
+-(NSMutableArray*)tasksForBinary:(Binary*)binary;
+
+//ensure that the list of flagged items is correctly updated
+// when a dead task or any of its dylibs were flagged...
+-(void)updateFlaggedItems:(Task*)deadTask;
+

@end
@@ -70,7 +70,8 @@
    //new tasks
    OrderedDictionary* newTasks = nil;
    
-    //set connected flag
+    //determine if network is connected
+    // ->sets 'isConnected' flag
    ((AppDelegate*)[[NSApplication sharedApplication] delegate]).isConnected = isNetworkConnected();

    //get all tasks
@@ -138,6 +139,7 @@
        
        //reload bottom pane
        [((AppDelegate*)[[NSApplication sharedApplication] delegate]) selectBottomPaneContent:nil];
+        
    });
    
    //now generate signing info
@@ -167,6 +169,16 @@

    }//signing info for all new tasks
    
+    //begin dylib enumeration
+    for(NSNumber* key in newTasks)
+    {
+        //get task
+        newTask = newTasks[key];
+        
+        //enumerate
+        [newTask enumerateDylibs:((AppDelegate*)[[NSApplication sharedApplication] delegate]).xpcConnection allDylibs:self.dylibs];
+    }
+    
    return;
 }

@@ -360,7 +372,7 @@ bail:
 }

 //remove a task
-// ->contains extra logic to remove children, etc
+// ->contains extra logic to remove children, flagged items, etc
 -(void)removeTask:(Task*)deadTask
 {
    //parent
@@ -379,6 +391,18 @@ bail:
    //alloc array for children
    children = [NSMutableArray array];
    
+    //ensure that flagged item list is accurate
+    // ->the dead task or its dylibs might have been flagged
+    [self updateFlaggedItems:deadTask];
+    
+    //(re)set label for flagged items to black
+    // when there are no flagged items
+    if(0 == ((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems.count)
+    {
+        //set to gray
+        ((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedLabel.textColor = [NSColor lightGrayColor];
+    }
+    
    //get launchd's task
    // ->its 'pid' is 0x1
    launchdTask = self.tasks[@1];
@@ -415,6 +439,83 @@ bail:
    
    return;
 }
+//TODO: test w/ dylib!!
+//ensure that the list of flagged items is correctly updated
+// when a dead task or any of its dylibs were flagged...
+-(void)updateFlaggedItems:(Task*)deadTask
+{
+    //task
+    Task* task = nil;
+    
+    //number of task instances
+    NSUInteger taskInstances = 0;
+    
+    //tasks that host flagged dylib
+    NSMutableArray* taskHosts = nil;
+    
+    //remove any dylibs that are flagged and loaded (only!) in dead task
+    for(Binary* dylib in deadTask.dylibs)
+    {
+        //skip dylibs that aren't flagged
+        if(YES != [((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems containsObject:dylib])
+        {
+            //skip
+            continue;
+        }
+        
+        //get all tasks that host the flagged dylib
+        taskHosts = [self tasksForBinary:dylib];
+        
+        //skip dylibs that are hosted in more than one task
+        // or aren't hosted in dead task
+        if( (1 != taskHosts.count) ||
+           (taskHosts.firstObject != deadTask.binary) )
+        {
+            //skip
+            continue;
+        }
+        
+        //dylib is flagged and only hosted in dead task
+        // ->remove it from flaggedItems
+        @synchronized(((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems)
+        {
+            //remove
+            [((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems removeObject:dylib];
+        }
+    }
+    
+    //also remove task if its flagged and only instance
+    if(YES == [((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems containsObject:deadTask.binary])
+    {
+        //get number of task instances
+        // ->might be more (flagged) instances that are still alive
+        for(NSNumber* taskPid in self.tasks)
+        {
+            //extract task
+            task = self.tasks[taskPid];
+            
+            //check for task has dylib
+            if(task.binary == deadTask.binary)
+            {
+                //inc
+                taskInstances++;
+            }
+        }
+        
+        //remove if only instance
+        if(1 == taskInstances)
+        {
+            //sync and remove
+            @synchronized(((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems)
+            {
+                //remove
+                [((AppDelegate*)[[NSApplication sharedApplication] delegate]).flaggedItems removeObject:deadTask.binary];
+            }
+        }
+    }
+    
+    return;
+}

 //given a task
 // ->get list of all child pids
@@ -441,5 +542,81 @@ bail:
    return;
 }

+//get all task pids for a given binary
+-(NSMutableArray*)tasksForBinary:(Binary*)binary
+{
+    //array of tasks
+    NSMutableArray* matchingTasks = nil;
+    
+    //task
+    Task* task = nil;
+    
+    //tasks
+    matchingTasks = [NSMutableArray array];
+    
+    //sync
+    @synchronized(self.tasks)
+    {
+        //reload each row w/ new VT info
+        for(NSNumber* taskPid in self.tasks)
+        {
+            //extract task
+            task = self.tasks[taskPid];
+            
+            //check for task has dylib
+            if(task.binary == binary)
+            {
+                //save
+                [matchingTasks addObject:task];
+            }
+        }
+        
+    }//sync
+    
+    return matchingTasks;
+}
+
+
+//get all tasks a dylib is loaded into
+-(NSMutableArray*)loadedIn:(Binary*)dylib
+{
+    //array of tasks
+    NSMutableArray* hostTasks = nil;
+    
+    //task
+    Task* task = nil;
+    
+    //tasks
+    hostTasks = [NSMutableArray array];
+    
+    //sync
+    @synchronized(self.tasks)
+    {
+        //reload each row w/ new VT info
+        for(NSNumber* taskPid in self.tasks)
+        {
+            //extract task
+            task = self.tasks[taskPid];
+            
+            //check if dylib is loaded in task
+            for(Binary* taskDylib in task.dylibs)
+            {
+                //check for task has dylib
+                if(taskDylib == dylib)
+                {
+                    //save
+                    [hostTasks addObject:task];
+                    
+                    //can bail, since match was found
+                    break;
+                }
+            }
+        }
+        
+    }//sync
+    
+    return hostTasks;
+}
+

@end
@@ -17,11 +17,11 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0.0</string>
+	<string>1.0.1</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>CFBundleVersion</key>
-	<string>1.0.0</string>
+	<string>1.0.1</string>
 	<key>LSMinimumSystemVersion</key>
 	<string>${MACOSX_DEPLOYMENT_TARGET}</string>
 	<key>NSHumanReadableCopyright</key>
@@ -43,6 +43,10 @@
 		CD6AFB861B4BABB200D42C34 /* refreshIconBG.png in Resources */ = {isa = PBXBuildFile; fileRef = CD6AFB841B4BABB200D42C34 /* refreshIconBG.png */; };
 		CD6AFB871B4BABB200D42C34 /* refreshIconOver.png in Resources */ = {isa = PBXBuildFile; fileRef = CD6AFB851B4BABB200D42C34 /* refreshIconOver.png */; };
 		CD6E54FF1B1162B5007953AB /* ItemView.m in Sources */ = {isa = PBXBuildFile; fileRef = CD6E54FE1B1162B5007953AB /* ItemView.m */; };
+		CD74A06D1B7DA71200A8AAD3 /* flaggedBG.png in Resources */ = {isa = PBXBuildFile; fileRef = CD74A06B1B7DA71200A8AAD3 /* flaggedBG.png */; };
+		CD74A06E1B7DA71200A8AAD3 /* flaggedOver.png in Resources */ = {isa = PBXBuildFile; fileRef = CD74A06C1B7DA71200A8AAD3 /* flaggedOver.png */; };
+		CD74A07B1B7F170B00A8AAD3 /* FlaggedItems.m in Sources */ = {isa = PBXBuildFile; fileRef = CD74A0791B7F170B00A8AAD3 /* FlaggedItems.m */; };
+		CD74A07E1B81B5D400A8AAD3 /* FlaggedItems.xib in Resources */ = {isa = PBXBuildFile; fileRef = CD74A07D1B81B5D400A8AAD3 /* FlaggedItems.xib */; };
 		CD7B9F4D1ACB959200DF3C71 /* logoAppleOver.png in Resources */ = {isa = PBXBuildFile; fileRef = CD7B9F4C1ACB959200DF3C71 /* logoAppleOver.png */; };
 		CD7B9F501ACB9A8400DF3C71 /* Exception.m in Sources */ = {isa = PBXBuildFile; fileRef = CD7B9F4F1ACB9A8400DF3C71 /* Exception.m */; };
 		CD7B9FA41ACBCFAD00DF3C71 /* spotlightIcon.png in Resources */ = {isa = PBXBuildFile; fileRef = CD7B9FA31ACBCFAD00DF3C71 /* spotlightIcon.png */; };
@@ -113,6 +117,7 @@
 		CDF08CF01ACA677B009B3423 /* kernelIcon.png in Resources */ = {isa = PBXBuildFile; fileRef = CDF08CEE1ACA677B009B3423 /* kernelIcon.png */; };
 		CDF08CF31ACA6864009B3423 /* browserIcon.png in Resources */ = {isa = PBXBuildFile; fileRef = CDF08CF11ACA6864009B3423 /* browserIcon.png */; };
 		CDF08CF41ACA6864009B3423 /* loginIcon.png in Resources */ = {isa = PBXBuildFile; fileRef = CDF08CF21ACA6864009B3423 /* loginIcon.png */; };
+		CDFCA3561B7940970075492D /* flagged.png in Resources */ = {isa = PBXBuildFile; fileRef = CDFCA3551B7940970075492D /* flagged.png */; };
 /* End PBXBuildFile section */

 /* Begin PBXContainerItemProxy section */
@@ -192,6 +197,11 @@
 		CD6AFB851B4BABB200D42C34 /* refreshIconOver.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = refreshIconOver.png; path = images/refreshIconOver.png; sourceTree = SOURCE_ROOT; };
 		CD6E54FD1B1162B5007953AB /* ItemView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ItemView.h; sourceTree = "<group>"; };
 		CD6E54FE1B1162B5007953AB /* ItemView.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = ItemView.m; sourceTree = "<group>"; };
+		CD74A06B1B7DA71200A8AAD3 /* flaggedBG.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = flaggedBG.png; path = images/flaggedBG.png; sourceTree = SOURCE_ROOT; };
+		CD74A06C1B7DA71200A8AAD3 /* flaggedOver.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = flaggedOver.png; path = images/flaggedOver.png; sourceTree = SOURCE_ROOT; };
+		CD74A0781B7F170B00A8AAD3 /* FlaggedItems.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FlaggedItems.h; sourceTree = "<group>"; };
+		CD74A0791B7F170B00A8AAD3 /* FlaggedItems.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = FlaggedItems.m; sourceTree = "<group>"; };
+		CD74A07D1B81B5D400A8AAD3 /* FlaggedItems.xib */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = file.xib; name = FlaggedItems.xib; path = UI/FlaggedItems.xib; sourceTree = "<group>"; };
 		CD7B9F4C1ACB959200DF3C71 /* logoAppleOver.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = logoAppleOver.png; path = images/logoAppleOver.png; sourceTree = SOURCE_ROOT; };
 		CD7B9F4E1ACB9A8400DF3C71 /* Exception.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Exception.h; sourceTree = SOURCE_ROOT; };
 		CD7B9F4F1ACB9A8400DF3C71 /* Exception.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = Exception.m; sourceTree = SOURCE_ROOT; };
@@ -285,6 +295,7 @@
 		CDF08CEE1ACA677B009B3423 /* kernelIcon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = kernelIcon.png; path = images/kernelIcon.png; sourceTree = SOURCE_ROOT; };
 		CDF08CF11ACA6864009B3423 /* browserIcon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = browserIcon.png; path = images/browserIcon.png; sourceTree = SOURCE_ROOT; };
 		CDF08CF21ACA6864009B3423 /* loginIcon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = loginIcon.png; path = images/loginIcon.png; sourceTree = SOURCE_ROOT; };
+		CDFCA3551B7940970075492D /* flagged.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = flagged.png; path = images/flagged.png; sourceTree = SOURCE_ROOT; };
 /* End PBXFileReference section */

 /* Begin PBXFrameworksBuildPhase section */
@@ -312,6 +323,8 @@
 		1D21BC42172AF43D009D1CFD = {
 			isa = PBXGroup;
 			children = (
+				CD74A0781B7F170B00A8AAD3 /* FlaggedItems.h */,
+				CD74A0791B7F170B00A8AAD3 /* FlaggedItems.m */,
 				CD4D54201B2CE6F200008030 /* NSMutableArray+QueueAdditions.h */,
 				CDBE49161B58DC9B0031FC22 /* NSApplicationKeyEvents.h */,
 				CDBE49171B58DC9B0031FC22 /* NSApplicationKeyEvents.m */,
@@ -410,6 +423,9 @@
 		CD6095501A8329FA00E091CD /* images */ = {
 			isa = PBXGroup;
 			children = (
+				CD74A06B1B7DA71200A8AAD3 /* flaggedBG.png */,
+				CD74A06C1B7DA71200A8AAD3 /* flaggedOver.png */,
+				CDFCA3551B7940970075492D /* flagged.png */,
 				CD6AFB841B4BABB200D42C34 /* refreshIconBG.png */,
 				CD6AFB851B4BABB200D42C34 /* refreshIconOver.png */,
 				CD6AFB821B4BAA2100D42C34 /* refreshIcon.png */,
@@ -535,6 +551,7 @@
 		CDA81E621AA020E8009790E2 /* UI */ = {
 			isa = PBXGroup;
 			children = (
+				CD74A07D1B81B5D400A8AAD3 /* FlaggedItems.xib */,
 				CD4D54271B2EAC7800008030 /* NetworkInfoWindow.xib */,
 				CD4D54231B2D082300008030 /* DylibInfoWindow.xib */,
 				CDA5F6C01B16E1D6003CE340 /* RequestRootWindow.xib */,
@@ -651,7 +668,9 @@
 				CDA81D5B1A95B4B4009790E2 /* InfoPlist.strings in Resources */,
 				CD4D53CA1B20296E00008030 /* unknown.png in Resources */,
 				CDEE77081B41220300763826 /* searchOver.png in Resources */,
+				CD74A07E1B81B5D400A8AAD3 /* FlaggedItems.xib in Resources */,
 				CDA81D6B1A95B4E9009790E2 /* show.png in Resources */,
+				CD74A06D1B7DA71200A8AAD3 /* flaggedBG.png in Resources */,
 				CDF08CF31ACA6864009B3423 /* browserIcon.png in Resources */,
 				CDEE77061B41220300763826 /* search.png in Resources */,
 				CDAB98A11AEAFAFA00C75B4B /* authorizationIcon.png in Resources */,
@@ -680,6 +699,7 @@
 				CD6AFB7F1B4736DF00D42C34 /* flatIcon.png in Resources */,
 				CD6AFB811B4737AC00D42C34 /* arrow.png in Resources */,
 				CDA81DCC1A9960A3009790E2 /* virusTotalBG.png in Resources */,
+				CD74A06E1B7DA71200A8AAD3 /* flaggedOver.png in Resources */,
 				CD001B381AB903040089014A /* logo.png in Resources */,
 				CDA81D6D1A95B4E9009790E2 /* scanIcon.png in Resources */,
 				CDF08CCF1AC4C6E8009B3423 /* settingsOver.png in Resources */,
@@ -689,6 +709,7 @@
 				CD4D543F1B2FF32C00008030 /* signedAppleIcon.png in Resources */,
 				CD3F4D161AF89066002A2647 /* TreeView.xib in Resources */,
 				CD0219501AD34D8B005148A2 /* PrefsWindow.xib in Resources */,
+				CDFCA3561B7940970075492D /* flagged.png in Resources */,
 				CDA81D6C1A95B4E9009790E2 /* showBG.png in Resources */,
 				CD3F4CFF1AF72BC4002A2647 /* TaskInfoWindow.xib in Resources */,
 				CDEE77001B3FD4B000763826 /* saveIconOver.png in Resources */,
@@ -729,6 +750,7 @@
 			files = (
 				CD3F4CE81AF5CF68002A2647 /* TaskEnumerator.m in Sources */,
 				CD4D54221B2CE6F200008030 /* NSMutableArray+QueueAdditions.m in Sources */,
+				CD74A07B1B7F170B00A8AAD3 /* FlaggedItems.m in Sources */,
 				CDA5F6C41B16E20E003CE340 /* RequestRootWindowController.m in Sources */,
 				CDD2483B1AF5CC4D00232422 /* Task.m in Sources */,
 				CD83887F1AACCEDF000EB098 /* VirusTotal.m in Sources */,
@@ -7,14 +7,14 @@
 	<key>IDESourceControlProjectIdentifier</key>
 	<string>FE4103FE-6F26-4639-8C9F-D8D32C76D6A9</string>
 	<key>IDESourceControlProjectName</key>
-	<string>project</string>
+	<string>TaskExplorer</string>
 	<key>IDESourceControlProjectOriginsDictionary</key>
 	<dict>
 		<key>61F07AFB33748EF0C810BEEF6126283DAC63A899</key>
 		<string>https://bitbucket.org/objective-see/taskexplorer.git</string>
 	</dict>
 	<key>IDESourceControlProjectPath</key>
-	<string>TaskExplorer.xcodeproj/project.xcworkspace</string>
+	<string>TaskExplorer.xcodeproj</string>
 	<key>IDESourceControlProjectRelativeInstallPathDictionary</key>
 	<dict>
 		<key>61F07AFB33748EF0C810BEEF6126283DAC63A899</key>
@@ -87,22 +87,6 @@
            landmarkType = "5">
         </BreakpointContent>
      </BreakpointProxy>
-      <BreakpointProxy
-         BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
-         <BreakpointContent
-            shouldBeEnabled = "No"
-            ignoreCount = "0"
-            continueAfterRunningActions = "No"
-            filePath = "Task.m"
-            timestampString = "460097895.698263"
-            startingColumnNumber = "9223372036854775807"
-            endingColumnNumber = "9223372036854775807"
-            startingLineNumber = "425"
-            endingLineNumber = "425"
-            landmarkName = "-enumerateDylibs:allDylibs:"
-            landmarkType = "5">
-         </BreakpointContent>
-      </BreakpointProxy>
      <BreakpointProxy
         BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
         <BreakpointContent
@@ -174,11 +158,11 @@
            ignoreCount = "0"
            continueAfterRunningActions = "No"
            filePath = "TaskEnumerator.m"
-            timestampString = "460249948.079536"
+            timestampString = "461467478.812396"
            startingColumnNumber = "9223372036854775807"
            endingColumnNumber = "9223372036854775807"
-            startingLineNumber = "170"
-            endingLineNumber = "170"
+            startingLineNumber = "182"
+            endingLineNumber = "182"
            landmarkName = "-enumerateTasks"
            landmarkType = "5">
         </BreakpointContent>
@@ -190,11 +174,11 @@
            ignoreCount = "0"
            continueAfterRunningActions = "No"
            filePath = "AppDelegate.m"
-            timestampString = "460362206.963852"
+            timestampString = "461485530.290068"
            startingColumnNumber = "9223372036854775807"
            endingColumnNumber = "9223372036854775807"
-            startingLineNumber = "1597"
-            endingLineNumber = "1597"
+            startingLineNumber = "1638"
+            endingLineNumber = "1638"
            landmarkName = "-constrainView:subView:"
            landmarkType = "5">
         </BreakpointContent>
@@ -254,31 +238,15 @@
            ignoreCount = "0"
            continueAfterRunningActions = "No"
            filePath = "AppDelegate.m"
-            timestampString = "460362206.963852"
+            timestampString = "461485530.290068"
            startingColumnNumber = "9223372036854775807"
            endingColumnNumber = "9223372036854775807"
-            startingLineNumber = "806"
-            endingLineNumber = "806"
+            startingLineNumber = "827"
+            endingLineNumber = "827"
            landmarkName = "-reloadTaskTable"
            landmarkType = "5">
         </BreakpointContent>
      </BreakpointProxy>
-      <BreakpointProxy
-         BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
-         <BreakpointContent
-            shouldBeEnabled = "No"
-            ignoreCount = "0"
-            continueAfterRunningActions = "No"
-            filePath = "remoteTaskService/remoteTaskService.m"
-            timestampString = "460246370.44119"
-            startingColumnNumber = "9223372036854775807"
-            endingColumnNumber = "9223372036854775807"
-            startingLineNumber = "297"
-            endingLineNumber = "297"
-            landmarkName = "-enumerateFiles:withReply:"
-            landmarkType = "5">
-         </BreakpointContent>
-      </BreakpointProxy>
      <BreakpointProxy
         BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
         <BreakpointContent
@@ -334,14 +302,94 @@
            ignoreCount = "0"
            continueAfterRunningActions = "No"
            filePath = "AppDelegate.m"
-            timestampString = "460362206.963852"
+            timestampString = "461485530.290068"
            startingColumnNumber = "9223372036854775807"
            endingColumnNumber = "9223372036854775807"
-            startingLineNumber = "90"
-            endingLineNumber = "90"
-            landmarkName = "-applicationDidFinishLaunching:"
+            startingLineNumber = "944"
+            endingLineNumber = "944"
+            landmarkName = "-buttonAppearance:shouldReset:"
            landmarkType = "5">
         </BreakpointContent>
      </BreakpointProxy>
+      <BreakpointProxy
+         BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
+         <BreakpointContent
+            shouldBeEnabled = "Yes"
+            ignoreCount = "0"
+            continueAfterRunningActions = "No"
+            filePath = "TaskTableController.m"
+            timestampString = "461376246.373795"
+            startingColumnNumber = "9223372036854775807"
+            endingColumnNumber = "9223372036854775807"
+            startingLineNumber = "223"
+            endingLineNumber = "223"
+            landmarkName = "-tableView:viewForTableColumn:row:"
+            landmarkType = "5">
+         </BreakpointContent>
+      </BreakpointProxy>
+      <BreakpointProxy
+         BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
+         <BreakpointContent
+            shouldBeEnabled = "Yes"
+            ignoreCount = "0"
+            continueAfterRunningActions = "No"
+            filePath = "TaskTableController.m"
+            timestampString = "461376252.978353"
+            startingColumnNumber = "9223372036854775807"
+            endingColumnNumber = "9223372036854775807"
+            startingLineNumber = "185"
+            endingLineNumber = "185"
+            landmarkName = "-tableView:viewForTableColumn:row:"
+            landmarkType = "5">
+         </BreakpointContent>
+      </BreakpointProxy>
+      <BreakpointProxy
+         BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
+         <BreakpointContent
+            shouldBeEnabled = "Yes"
+            ignoreCount = "0"
+            continueAfterRunningActions = "No"
+            filePath = "TaskTableController.m"
+            timestampString = "461376256.784372"
+            startingColumnNumber = "9223372036854775807"
+            endingColumnNumber = "9223372036854775807"
+            startingLineNumber = "167"
+            endingLineNumber = "167"
+            landmarkName = "-tableView:viewForTableColumn:row:"
+            landmarkType = "5">
+         </BreakpointContent>
+      </BreakpointProxy>
+      <BreakpointProxy
+         BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
+         <BreakpointContent
+            shouldBeEnabled = "No"
+            ignoreCount = "0"
+            continueAfterRunningActions = "No"
+            filePath = "TaskTableController.m"
+            timestampString = "461467913.481691"
+            startingColumnNumber = "9223372036854775807"
+            endingColumnNumber = "9223372036854775807"
+            startingLineNumber = "206"
+            endingLineNumber = "206"
+            landmarkName = "-tableView:viewForTableColumn:row:"
+            landmarkType = "5">
+         </BreakpointContent>
+      </BreakpointProxy>
+      <BreakpointProxy
+         BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
+         <BreakpointContent
+            shouldBeEnabled = "No"
+            ignoreCount = "0"
+            continueAfterRunningActions = "No"
+            filePath = "ItemView.m"
+            timestampString = "461468083.338226"
+            startingColumnNumber = "9223372036854775807"
+            endingColumnNumber = "9223372036854775807"
+            startingLineNumber = "33"
+            endingLineNumber = "33"
+            landmarkName = "createItemView()"
+            landmarkType = "7">
+         </BreakpointContent>
+      </BreakpointProxy>
   </Breakpoints>
 </Bucket>
@@ -41,7 +41,7 @@
 //info window
@property(retain, nonatomic)InfoWindowController* infoWindowController;

-//preferences window controller
+//virus total window controller
@property (nonatomic, retain)VTInfoWindowController* vtWindowController;

 //currently selected row
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14E46" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14F27" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
    <dependencies>
        <deployment identifier="macosx"/>
        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="7706"/>
@@ -0,0 +1,230 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14F27" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+    <dependencies>
+        <deployment identifier="macosx"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="7706"/>
+    </dependencies>
+    <objects>
+        <customObject id="-2" userLabel="File's Owner" customClass="FlaggedItems">
+            <connections>
+                <outlet property="flaggedItemTable" destination="w0h-ih-Ej7" id="Ric-dB-oFI"/>
+                <outlet property="window" destination="F0z-JX-Cv5" id="gIp-Ho-8D9"/>
+            </connections>
+        </customObject>
+        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
+        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
+        <window title="Flagged Items" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" releasedWhenClosed="NO" animationBehavior="default" id="F0z-JX-Cv5">
+            <windowStyleMask key="styleMask" titled="YES" closable="YES" miniaturizable="YES" resizable="YES"/>
+            <windowPositionMask key="initialPositionMask" leftStrut="YES" rightStrut="YES" topStrut="YES" bottomStrut="YES"/>
+            <rect key="contentRect" x="95" y="481" width="1304" height="322"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="1440" height="877"/>
+            <value key="minSize" type="size" width="800" height="250"/>
+            <view key="contentView" id="se5-gp-TjO">
+                <rect key="frame" x="0.0" y="0.0" width="1304" height="322"/>
+                <autoresizingMask key="autoresizingMask"/>
+                <subviews>
+                    <scrollView autohidesScrollers="YES" horizontalLineScroll="42" horizontalPageScroll="10" verticalLineScroll="42" verticalPageScroll="10" usesPredominantAxisScrolling="NO" horizontalScrollElasticity="none" verticalScrollElasticity="none" translatesAutoresizingMaskIntoConstraints="NO" id="8GA-gp-lIa">
+                        <rect key="frame" x="-1" y="-1" width="1306" height="324"/>
+                        <clipView key="contentView" drawsBackground="NO" id="4oI-qg-e78">
+                            <rect key="frame" x="1" y="1" width="1204" height="437"/>
+                            <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
+                            <subviews>
+                                <tableView verticalHuggingPriority="750" allowsExpansionToolTips="YES" columnAutoresizingStyle="lastColumnOnly" alternatingRowBackgroundColors="YES" columnReordering="NO" columnResizing="NO" multipleSelection="NO" emptySelection="NO" autosaveColumns="NO" typeSelect="NO" rowHeight="40" rowSizeStyle="automatic" viewBased="YES" id="w0h-ih-Ej7">
+                                    <rect key="frame" x="0.0" y="0.0" width="1304" height="0.0"/>
+                                    <autoresizingMask key="autoresizingMask"/>
+                                    <size key="intercellSpacing" width="3" height="2"/>
+                                    <color key="backgroundColor" name="controlBackgroundColor" catalog="System" colorSpace="catalog"/>
+                                    <color key="gridColor" name="gridColor" catalog="System" colorSpace="catalog"/>
+                                    <tableColumns>
+                                        <tableColumn identifier="MainCell" editable="NO" width="1301" minWidth="500" maxWidth="2000" id="Nnf-1E-SNL">
+                                            <tableHeaderCell key="headerCell" lineBreakMode="truncatingTail" borderStyle="border" alignment="left">
+                                                <font key="font" metaFont="smallSystem"/>
+                                                <color key="textColor" name="headerTextColor" catalog="System" colorSpace="catalog"/>
+                                                <color key="backgroundColor" white="0.33333298560000002" alpha="1" colorSpace="calibratedWhite"/>
+                                            </tableHeaderCell>
+                                            <textFieldCell key="dataCell" lineBreakMode="truncatingTail" selectable="YES" editable="YES" alignment="left" title="Text Cell" id="thk-IY-RnX">
+                                                <font key="font" metaFont="system"/>
+                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                                                <color key="backgroundColor" name="controlBackgroundColor" catalog="System" colorSpace="catalog"/>
+                                            </textFieldCell>
+                                            <tableColumnResizingMask key="resizingMask" resizeWithTable="YES" userResizable="YES"/>
+                                            <prototypeCellViews>
+                                                <tableCellView identifier="FlaggedItem" id="LL3-Mq-2hG" customClass="kkRowCell">
+                                                    <rect key="frame" x="1" y="1" width="1301" height="40"/>
+                                                    <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
+                                                    <subviews>
+                                                        <imageView misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="4pP-3r-LmH">
+                                                            <rect key="frame" x="1" y="7" width="25" height="25"/>
+                                                            <constraints>
+                                                                <constraint firstAttribute="height" constant="25" id="TkG-o4-7Mh"/>
+                                                                <constraint firstAttribute="width" constant="25" id="lPx-89-mmg"/>
+                                                            </constraints>
+                                                            <imageCell key="cell" refusesFirstResponder="YES" alignment="left" imageScaling="proportionallyDown" image="NSActionTemplate" id="8AA-R9-8pF"/>
+                                                        </imageView>
+                                                        <imageView horizontalHuggingPriority="251" verticalHuggingPriority="251" ambiguous="YES" misplaced="YES" tag="100" translatesAutoresizingMaskIntoConstraints="NO" id="9M9-hz-Wz2">
+                                                            <rect key="frame" x="33" y="23" width="11" height="11"/>
+                                                            <constraints>
+                                                                <constraint firstAttribute="height" constant="11" id="5Dw-29-feM"/>
+                                                                <constraint firstAttribute="width" constant="11" id="TI1-MY-y55"/>
+                                                            </constraints>
+                                                            <imageCell key="cell" refusesFirstResponder="YES" alignment="left" imageScaling="proportionallyDown" image="unknown" id="e2z-Kq-Gr8"/>
+                                                        </imageView>
+                                                        <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="SI4-HT-3LO">
+                                                            <rect key="frame" x="46" y="20" width="225" height="19"/>
+                                                            <textFieldCell key="cell" lineBreakMode="truncatingTail" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Flagged Item Name" id="t89-gZ-pCr">
+                                                                <font key="font" size="13" name="Menlo-Regular"/>
+                                                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                                                            </textFieldCell>
+                                                        </textField>
+                                                        <button toolTip="show in finder" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" tag="107" translatesAutoresizingMaskIntoConstraints="NO" id="LPP-Mp-jbS">
+                                                            <rect key="frame" x="1263" y="15" width="18" height="18"/>
+                                                            <constraints>
+                                                                <constraint firstAttribute="width" constant="18" id="Ox3-ER-CLv"/>
+                                                                <constraint firstAttribute="height" constant="18" id="QvO-ge-XJU"/>
+                                                            </constraints>
+                                                            <buttonCell key="cell" type="bevel" bezelStyle="regularSquare" image="show" imagePosition="overlaps" alignment="center" alternateImage="showBG" state="on" imageScaling="proportionallyDown" inset="2" id="9j8-qF-FpM">
+                                                                <behavior key="behavior" lightByContents="YES"/>
+                                                                <font key="font" metaFont="system"/>
+                                                            </buttonCell>
+                                                        </button>
+                                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" tag="108" translatesAutoresizingMaskIntoConstraints="NO" id="Ska-cO-ibK">
+                                                            <rect key="frame" x="1258" y="4" width="25" height="12"/>
+                                                            <constraints>
+                                                                <constraint firstAttribute="width" constant="21" id="b5b-fU-NJT"/>
+                                                                <constraint firstAttribute="height" constant="12" id="j24-2V-qm8"/>
+                                                            </constraints>
+                                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="center" title="show" id="QiZ-4f-4bL">
+                                                                <font key="font" size="9" name="Menlo-Regular"/>
+                                                                <color key="textColor" white="0.5" alpha="1" colorSpace="custom" customColorSpace="calibratedWhite"/>
+                                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                                                            </textFieldCell>
+                                                        </textField>
+                                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" tag="101" translatesAutoresizingMaskIntoConstraints="NO" id="lSO-MV-z6s">
+                                                            <rect key="frame" x="31" y="2" width="1118" height="21"/>
+                                                            <textFieldCell key="cell" lineBreakMode="truncatingTail" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="item path" id="w8B-uo-2pW">
+                                                                <font key="font" size="11" name="Menlo-Regular"/>
+                                                                <color key="textColor" white="0.5" alpha="1" colorSpace="custom" customColorSpace="calibratedWhite"/>
+                                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                                                            </textFieldCell>
+                                                        </textField>
+                                                        <button toolTip="show virustotal info" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" tag="103" translatesAutoresizingMaskIntoConstraints="NO" id="SXe-Gt-BE8" customClass="VTButton">
+                                                            <rect key="frame" x="1155" y="17" width="49" height="20"/>
+                                                            <constraints>
+                                                                <constraint firstAttribute="width" constant="49" id="0rO-0Q-JSb"/>
+                                                                <constraint firstAttribute="height" constant="29" id="i3a-Ml-HdB"/>
+                                                            </constraints>
+                                                            <buttonCell key="cell" type="bevel" title="▪ ▪ ▪" bezelStyle="regularSquare" imagePosition="overlaps" alignment="center" enabled="NO" refusesFirstResponder="YES" state="on" imageScaling="proportionallyDown" inset="2" id="ns1-pA-ekS">
+                                                                <behavior key="behavior" lightByContents="YES"/>
+                                                                <font key="font" size="8" name="Menlo-Bold"/>
+                                                            </buttonCell>
+                                                        </button>
+                                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" tag="104" translatesAutoresizingMaskIntoConstraints="NO" id="CXT-MY-otd">
+                                                            <rect key="frame" x="1148" y="4" width="65" height="12"/>
+                                                            <constraints>
+                                                                <constraint firstAttribute="width" constant="61" id="g1y-6v-yy9"/>
+                                                                <constraint firstAttribute="height" constant="12" id="hQe-9F-pda"/>
+                                                            </constraints>
+                                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="center" title="virustotal" id="ZuF-2W-20b">
+                                                                <font key="font" size="9" name="Menlo-Regular"/>
+                                                                <color key="textColor" white="0.5" alpha="1" colorSpace="custom" customColorSpace="calibratedWhite"/>
+                                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                                                            </textFieldCell>
+                                                        </textField>
+                                                        <button toolTip="show file info" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" tag="105" translatesAutoresizingMaskIntoConstraints="NO" id="lIr-8u-JaJ">
+                                                            <rect key="frame" x="1226" y="17" width="15" height="15"/>
+                                                            <constraints>
+                                                                <constraint firstAttribute="width" constant="15" id="Xa5-X6-RNP"/>
+                                                                <constraint firstAttribute="height" constant="15" id="ney-PR-EnC"/>
+                                                            </constraints>
+                                                            <buttonCell key="cell" type="bevel" bezelStyle="regularSquare" image="info" imagePosition="overlaps" alignment="center" alternateImage="infoBG" state="on" imageScaling="proportionallyDown" inset="2" id="RhP-eU-N77">
+                                                                <behavior key="behavior" lightByContents="YES"/>
+                                                                <font key="font" metaFont="system"/>
+                                                            </buttonCell>
+                                                        </button>
+                                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" tag="106" translatesAutoresizingMaskIntoConstraints="NO" id="JeV-w6-lMk">
+                                                            <rect key="frame" x="1220" y="4" width="25" height="12"/>
+                                                            <constraints>
+                                                                <constraint firstAttribute="width" constant="21" id="ChY-fK-a6b"/>
+                                                                <constraint firstAttribute="height" constant="12" id="WHI-A8-fUt"/>
+                                                            </constraints>
+                                                            <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="center" title="info" id="nWl-p3-bCZ">
+                                                                <font key="font" size="9" name="Menlo-Regular"/>
+                                                                <color key="textColor" white="0.5" alpha="1" colorSpace="custom" customColorSpace="calibratedWhite"/>
+                                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                                                            </textFieldCell>
+                                                        </textField>
+                                                        <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" tag="102" translatesAutoresizingMaskIntoConstraints="NO" id="HUg-RC-ApX">
+                                                            <rect key="frame" x="264" y="20" width="504" height="18"/>
+                                                            <constraints>
+                                                                <constraint firstAttribute="width" constant="500" id="GZp-g5-nIv"/>
+                                                                <constraint firstAttribute="height" constant="18" id="p2j-Rg-UCM"/>
+                                                            </constraints>
+                                                            <textFieldCell key="cell" lineBreakMode="truncatingTail" sendsActionOnEndEditing="YES" title="pid" id="g8r-Fj-UsA">
+                                                                <font key="font" size="13" name="Menlo-Regular"/>
+                                                                <color key="textColor" white="0.49295236009999999" alpha="0.84999999999999998" colorSpace="calibratedWhite"/>
+                                                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                                                            </textFieldCell>
+                                                        </textField>
+                                                    </subviews>
+                                                    <constraints>
+                                                        <constraint firstItem="Ska-cO-ibK" firstAttribute="leading" secondItem="JeV-w6-lMk" secondAttribute="trailing" constant="17" id="CYN-Mk-OYX"/>
+                                                        <constraint firstItem="4pP-3r-LmH" firstAttribute="leading" secondItem="LL3-Mq-2hG" secondAttribute="leading" constant="4" id="Lwa-4l-9kr"/>
+                                                        <constraint firstItem="CXT-MY-otd" firstAttribute="leading" secondItem="lSO-MV-z6s" secondAttribute="trailing" constant="8" id="ZSp-vP-YLC"/>
+                                                        <constraint firstItem="JeV-w6-lMk" firstAttribute="leading" secondItem="CXT-MY-otd" secondAttribute="trailing" constant="11" id="e7R-yR-yTc"/>
+                                                        <constraint firstItem="4pP-3r-LmH" firstAttribute="top" secondItem="LL3-Mq-2hG" secondAttribute="top" constant="7" id="efk-9Z-3l9"/>
+                                                        <constraint firstItem="HUg-RC-ApX" firstAttribute="leading" secondItem="SI4-HT-3LO" secondAttribute="trailing" constant="5" id="gw8-gc-Vur"/>
+                                                        <constraint firstAttribute="trailing" secondItem="Ska-cO-ibK" secondAttribute="trailing" constant="20" id="kvw-nk-f5L"/>
+                                                        <constraint firstItem="LPP-Mp-jbS" firstAttribute="leading" secondItem="lIr-8u-JaJ" secondAttribute="trailing" constant="22" id="ngn-Iy-gr1"/>
+                                                        <constraint firstItem="lSO-MV-z6s" firstAttribute="leading" secondItem="4pP-3r-LmH" secondAttribute="trailing" constant="2" id="sil-ah-ybv"/>
+                                                        <constraint firstAttribute="trailing" secondItem="LPP-Mp-jbS" secondAttribute="trailing" constant="20" id="xy1-01-iqY"/>
+                                                        <constraint firstItem="lIr-8u-JaJ" firstAttribute="leading" secondItem="SXe-Gt-BE8" secondAttribute="trailing" constant="22" id="y7b-ve-h00"/>
+                                                    </constraints>
+                                                    <connections>
+                                                        <outlet property="imageView" destination="4pP-3r-LmH" id="7Nm-Fh-gmu"/>
+                                                        <outlet property="textField" destination="SI4-HT-3LO" id="8aF-lH-BM6"/>
+                                                    </connections>
+                                                </tableCellView>
+                                            </prototypeCellViews>
+                                        </tableColumn>
+                                    </tableColumns>
+                                    <connections>
+                                        <outlet property="dataSource" destination="-2" id="7QT-ol-cxv"/>
+                                        <outlet property="delegate" destination="-2" id="N52-zo-7OE"/>
+                                    </connections>
+                                </tableView>
+                            </subviews>
+                            <color key="backgroundColor" white="1" alpha="1" colorSpace="calibratedWhite"/>
+                        </clipView>
+                        <scroller key="horizontalScroller" hidden="YES" verticalHuggingPriority="750" controlSize="mini" horizontal="YES" id="YoR-S2-wC2">
+                            <rect key="frame" x="1" y="298" width="480" height="16"/>
+                            <autoresizingMask key="autoresizingMask"/>
+                        </scroller>
+                        <scroller key="verticalScroller" hidden="YES" verticalHuggingPriority="750" controlSize="mini" horizontal="NO" id="SeJ-Sc-Vdr">
+                            <rect key="frame" x="224" y="17" width="15" height="102"/>
+                            <autoresizingMask key="autoresizingMask"/>
+                        </scroller>
+                    </scrollView>
+                </subviews>
+                <constraints>
+                    <constraint firstItem="8GA-gp-lIa" firstAttribute="top" secondItem="se5-gp-TjO" secondAttribute="top" constant="-1" id="IAH-UM-GVX"/>
+                    <constraint firstAttribute="bottom" secondItem="8GA-gp-lIa" secondAttribute="bottom" constant="-1" id="RJ1-AT-aVI"/>
+                    <constraint firstItem="8GA-gp-lIa" firstAttribute="leading" secondItem="se5-gp-TjO" secondAttribute="leading" constant="-1" id="bVx-kV-QU1"/>
+                    <constraint firstAttribute="trailing" secondItem="8GA-gp-lIa" secondAttribute="trailing" constant="-1" id="hYI-5Z-VSU"/>
+                </constraints>
+            </view>
+            <connections>
+                <outlet property="delegate" destination="-2" id="0bl-1N-AYu"/>
+            </connections>
+            <point key="canvasLocation" x="309" y="49"/>
+        </window>
+    </objects>
+    <resources>
+        <image name="NSActionTemplate" width="14" height="14"/>
+        <image name="info" width="256" height="256"/>
+        <image name="infoBG" width="256" height="256"/>
+        <image name="show" width="256" height="256"/>
+        <image name="showBG" width="256" height="256"/>
+        <image name="unknown" width="256" height="256"/>
+    </resources>
+</document>
@@ -370,20 +370,11 @@
            //save result
            item.vtInfo = results;
            
-            //TODO: do something if it's flagged!
-            //if its flagged save in File's plugin
+            //save flagged item
            if(0 != [results[VT_RESULTS_POSITIVES] unsignedIntegerValue])
            {
-                /*
-                //sync
-                // ->since array will be reset if user clicks 'stop' scan
-                @synchronized(fileObj.plugin.flaggedItems)
-                {
-                    //save
-                    [fileObj.plugin.flaggedItems addObject:fileObj];
-                }
-                */
-
+                //save
+                [((AppDelegate*)[[NSApplication sharedApplication] delegate]) saveFlaggedBinary:item];
            }
            
            //call up into app delegate to smartly reload
@@ -722,13 +713,15 @@ bail:
        //save VT results into item
        queriedItem.vtInfo = result;
        
+        //save flagged item
+        if(0 != [result[VT_RESULTS_POSITIVES] unsignedIntegerValue])
+        {
+            //save
+            [((AppDelegate*)[[NSApplication sharedApplication] delegate]) saveFlaggedBinary:queriedItem];
+        }
+        
        //call up into app delegate to smartly reload
        [((AppDelegate*)[[NSApplication sharedApplication] delegate]) reloadBinary:queriedItem];
-        
-        
-        //TODO: do something with detections!?
-        // ->blinking button, user's can click to see 'flagged items' popup
-        //if(0 != [result[VT_RESULTS_POSITIVES] unsignedIntegerValue])
    }
    
    return;
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14E46" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14F27" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
    <dependencies>
        <deployment identifier="macosx"/>
        <development version="6000" identifier="xcode"/>
@@ -155,7 +155,7 @@
                        </connections>
                    </segmentedControl>
                    <button ambiguous="YES" misplaced="YES" tag="10004" translatesAutoresizingMaskIntoConstraints="NO" id="HoI-FQ-vTI">
-                        <rect key="frame" x="1315" y="10" width="29" height="32"/>
+                        <rect key="frame" x="661" y="10" width="29" height="32"/>
                        <constraints>
                            <constraint firstAttribute="height" constant="32" id="18R-rR-Udp"/>
                            <constraint firstAttribute="width" constant="29" id="JOy-gX-fMr"/>
@@ -196,15 +196,39 @@
                            <outlet property="delegate" destination="494" id="4ig-0K-Oup"/>
                        </connections>
                    </searchField>
+                    <button ambiguous="YES" misplaced="YES" tag="10005" translatesAutoresizingMaskIntoConstraints="NO" id="urJ-dW-Pfr">
+                        <rect key="frame" x="1311" y="19" width="32" height="25"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="32" id="RPW-VL-OaB"/>
+                            <constraint firstAttribute="height" constant="25" id="Sdn-9e-XFV"/>
+                        </constraints>
+                        <buttonCell key="cell" type="bevel" bezelStyle="regularSquare" image="flagged" imagePosition="overlaps" alignment="center" alternateImage="flaggedBG" imageScaling="proportionallyDown" inset="2" id="uv2-BM-czI">
+                            <behavior key="behavior" lightByContents="YES"/>
+                            <font key="font" metaFont="system"/>
+                        </buttonCell>
+                        <connections>
+                            <action selector="showFlaggedItems:" target="494" id="hAA-gr-tHn"/>
+                        </connections>
+                    </button>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="Qdr-Tq-Fw0">
+                        <rect key="frame" x="1297" y="2" width="46" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="center" title="flagged" id="BYb-4w-hk5">
+                            <font key="font" size="9" name="Menlo-Regular"/>
+                            <color key="textColor" white="0.52269995629999999" alpha="1" colorSpace="calibratedWhite"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                    </textField>
                </subviews>
                <constraints>
                    <constraint firstAttribute="trailing" secondItem="E4M-PF-VD0" secondAttribute="trailing" constant="-1" id="7em-dD-W3w"/>
                    <constraint firstItem="E4M-PF-VD0" firstAttribute="leading" secondItem="372" secondAttribute="leading" constant="-1" id="IGR-bI-Hsm"/>
                    <constraint firstAttribute="trailing" secondItem="TNF-7q-Loy" secondAttribute="trailing" constant="-1" id="Lso-h9-MIt"/>
-                    <constraint firstAttribute="trailing" secondItem="HoI-FQ-vTI" secondAttribute="trailing" constant="10" id="OMm-dV-23S"/>
+                    <constraint firstAttribute="trailing" secondItem="urJ-dW-Pfr" secondAttribute="trailing" constant="11" id="RHT-vM-bt3"/>
                    <constraint firstItem="TNF-7q-Loy" firstAttribute="leading" secondItem="372" secondAttribute="leading" constant="-1" id="bnH-c7-461"/>
                    <constraint firstItem="gtq-gn-VPL" firstAttribute="leading" secondItem="372" secondAttribute="centerX" constant="-100" id="iUK-4W-mmK"/>
                    <constraint firstAttribute="trailing" secondItem="bNA-gy-9Ta" secondAttribute="trailing" constant="6" id="k4n-CB-LFx"/>
+                    <constraint firstAttribute="trailing" secondItem="Qdr-Tq-Fw0" secondAttribute="trailing" constant="13" id="lkx-op-iZe"/>
+                    <constraint firstItem="HoI-FQ-vTI" firstAttribute="leading" secondItem="372" secondAttribute="centerX" id="usV-OB-sI5"/>
                </constraints>
            </view>
            <toolbar key="toolbar" implicitIdentifier="EAE4838B-30FD-4B21-8BE5-8564B213BE96" autosavesConfiguration="NO" displayMode="iconAndLabel" sizeMode="regular" id="qEm-Os-zrh">
@@ -283,6 +307,8 @@
                <outlet property="bottomPaneSpinner" destination="LMT-Bu-FAk" id="a1H-Ag-GT8"/>
                <outlet property="filterItemsBox" destination="bNA-gy-9Ta" id="hAw-Ja-am4"/>
                <outlet property="filterTasksBox" destination="4Kr-b9-X6j" id="CB1-Rb-dew"/>
+                <outlet property="flaggedButton" destination="urJ-dW-Pfr" id="SvI-vh-Khd"/>
+                <outlet property="flaggedLabel" destination="Qdr-Tq-Fw0" id="0e7-E5-AlP"/>
                <outlet property="logoButton" destination="HoI-FQ-vTI" id="bzc-wu-4Hv"/>
                <outlet property="noItemsLabel" destination="kIC-ZZ-ldy" id="nOm-8E-tZA"/>
                <outlet property="progressIndicator" destination="839" id="870"/>
@@ -308,6 +334,8 @@
        </textField>
    </objects>
    <resources>
+        <image name="flagged" width="256" height="256"/>
+        <image name="flaggedBG" width="256" height="256"/>
        <image name="logoApple" width="194" height="236"/>
        <image name="logoAppleBG" width="194" height="236"/>
        <image name="refreshIcon" width="256" height="256"/>
@@ -15,9 +15,13 @@

@implementation ServiceDelegate

- (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection {
-    // This method is where the NSXPCListener configures, accepts, and resumes a new incoming NSXPCConnection.
-    
+
+//TODO: check for 'signed by Obj-C'
+//automatically invoked
+//->allows NSXPCListener to configure/accept/resume a new incoming NSXPCConnection.
+-(BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection
+{
+        
    // Configure the connection.
    // First, set the interface that the exported object implements.
    newConnection.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(remoteTaskProto)];