objective-see/TaskExplorer
1
0
Fork 0
mirror of https://github.com/objective-see/TaskExplorer.git synced 2026-03-22 07:02:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

v 1.0.0 RC

Browse Source 
improved filtering (network connections etc)
 	improved UI (flagged files red in info window, centering components, etc)
	code cleanup (moved init XPC connection into AppDelegate, etc)
	error msgs now syslog'd
	extra sanity checks, etc
	fixed logic issue w/ refreshing & filtering
This commit is contained in:
Patrick Wardle
2015-08-01 12:46:24 -07:00
parent 5ad9582b6f
commit b41a9642a9
26 changed files with 478 additions and 575 deletions
Download Patch File Download Diff File Expand all files Collapse all files
3rdParty/OrderedDictionary.h
Vendored
-1
View File
@@ -36,7 +36,6 @@
- (void)insertObject:(id)anObject forKey:(id)aKey atIndex:(NSUInteger)anIndex;
- (id)keyAtIndex:(NSUInteger)anIndex;
- (NSUInteger)indexOfKey:(id)aKey;
-(void)reverse;
//sort
// ->by pid, name, etc
3rdParty/OrderedDictionary.m
Vendored
+4 -42
View File
@@ -101,12 +101,7 @@ NSString *DescriptionForObject(NSObject *object, id locale, NSUInteger indent)
return [array objectEnumerator];
}
/*
- (NSEnumerator *)reverseKeyEnumerator
{
return [array reverseObjectEnumerator];
}
*/
-(void)insertObject:(id)anObject forKey:(id)aKey atIndex:(NSUInteger)anIndex
{
@@ -139,19 +134,13 @@ bail:
return item;
}
//TODO: add sanity checks
//given an key
//given a key
// ->return its index
-(NSUInteger)indexOfKey:(id)aKey
{
return [array indexOfObject:aKey];
}
-(void)reverse
{
array = [[[array reverseObjectEnumerator] allObjects] mutableCopy];
}
//sort
// ->by pid, name, etc
-(void)sort:(NSUInteger)sortBy
@@ -159,13 +148,14 @@ bail:
//task sorted by name
NSArray* sortedTasks = nil;
//
//sort by pid
if(SORT_BY_PID == sortBy)
{
[array sortUsingComparator:^NSComparisonResult(id obj1, id obj2) {
return [obj1 compare:obj2];
}];
}
//sort by name
else if(SORT_BY_NAME == sortBy)
{
//get array of tasks, sorted by binary name
@@ -174,37 +164,9 @@ bail:
//extract sorted pids into array
array = [[sortedTasks valueForKey:@"pid"] mutableCopy];
}
return;
}
/*
- (NSString *)descriptionWithLocale:(id)locale indent:(NSUInteger)level
{
NSMutableString *indentString = [NSMutableString string];
NSUInteger i, count = level;
for (i = 0; i < count; i++)
{
[indentString appendFormat:@" "];
}
NSMutableString *description = [NSMutableString string];
[description appendFormat:@"%@{\n", indentString];
for (NSObject *key in self)
{
[description appendFormat:@"%@ %@ = %@;\n",
indentString,
DescriptionForObject(key, locale, level),
DescriptionForObject([self objectForKey:key], locale, level)];
}
[description appendFormat:@"%@}\n", indentString];
return description;
}
*/
@end
AppDelegate.h
+11
View File
@@ -138,6 +138,9 @@
//top constraint
@property(nonatomic, retain)NSLayoutConstraint* trailingConstraint;
//remote XPC interface
@property (nonatomic, retain) NSXPCConnection* xpcConnection;
//action for 'refresh' button
// ->query OS to refresh/reload all tasks
- (IBAction)refreshTasks:(id)sender;
@@ -145,6 +148,14 @@
/* METHODS */
//complete a few inits
// ->then invoke helper method to start enum'ing task (in bg thread)
-(void)go;
//init (setup) XPC connection
-(BOOL)initXPC;
- (IBAction)switchView:(id)sender;
//init tracking areas for buttons
AppDelegate.m
+176 -165
View File
@@ -9,18 +9,19 @@
#import "Exception.h"
#import "Utilities.h"
#import "AppDelegate.h"
#import "serviceInterface.h"
#import "TaskTableController.h"
#import "RequestRootWindowController.h"
#import "Task.h"
//TODO: add IPV6 :: as 0.0.0.0? (since we do this for IPV4 i think)
//TODO: filter out dup'd networks (airportd 0:0..) -not sure want to do this
//TODO: first time (w/ auth) dylibs don't show up?
//TODO: remove 'pref' from menu - or disable?
//TODO: path truncated in 'info' window (1password mini) - but weird when selected :/
// resize text manually? http://stackoverflow.com/questions/6519995/modifying-an-nstextfields-font-size-according-to-content-length
//TODO: filter out dup'd networks (airportd 0:0..) -not sure want to do this
//TODO: 'flagged' items button?
//TODO: add 'am i on main thread' guard and test
@implementation AppDelegate
@@ -46,6 +47,7 @@
@synthesize taskEnumerator;
@synthesize viewSelector;
@synthesize searchButton;
@synthesize xpcConnection;
//@synthesize taskScrollView;
@@ -71,23 +73,11 @@
// ->main entry point
-(void)applicationDidFinishLaunching:(NSNotification *)notification
{
//TODO: remove
[[NSUserDefaults standardUserDefaults] setBool:YES forKey:@"NSConstraintBasedLayoutVisualizeMutuallyExclusiveConstraints"];
//user defaults
//NSUserDefaults* defaults = nil;
//flag for first time
//BOOL isFirstRun = NO;
//first thing...
// ->install exception handlers!
//TODO: re-enable
//installExceptionHandlers();
//self.taskScrollView.wantsLayer = TRUE;
//self.taskScrollView.layer.cornerRadius = 20;
//init virus total object
virusTotalObj = [[VirusTotal alloc] init];
@@ -109,39 +99,17 @@
if(YES != [self isAuthenticated])
{
//display auth popup
// ->will kick off task emun on successful auth :)
// ->will invoke 'go' method on successful auth
[self askForRoot];
}
//go!
// ->setup tracking areas and begin thread that explores tasks
else
{
//init mouse-over areas
[self initTrackingAreas];
//go!
[self exploreTasks];
[self go];
}
/*
//load defaults
defaults = [NSUserDefaults standardUserDefaults];
//extact first run key
// ->nil means first time!
if(nil == [defaults objectForKey:PREF_FIRST_RUN])
{
//set flag
isFirstRun = YES;
//set flag persistently
[defaults setBool:NO forKey:PREF_FIRST_RUN];
//flush/save
[defaults synchronize];
}
*/
//set default top pane view to flat
self.taskViewFormat = FLAT_VIEW;
@@ -177,10 +145,95 @@
return;
}
//complete a few inits
// ->then invoke helper method to start enum'ing task (in bg thread)
-(void)go
{
//init XPC
if(YES != [self initXPC])
{
//bail
goto bail;
}
//init mouse-over areas
[self initTrackingAreas];
//go!
[self exploreTasks];
//bail
bail:
return;
}
//init (setup) XPC connection
-(BOOL)initXPC
{
//status
BOOL initialized = NO;
//alloc XPC connection
xpcConnection = [[NSXPCConnection alloc] initWithServiceName:@"com.objective-see.remoteTaskService"];
//sanity check
if(nil == self.xpcConnection)
{
//err msg
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to find/initialize XPC service");
//bail
goto bail;
}
//set remote object interface
self.xpcConnection.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(remoteTaskProto)];
//set classes
// ->arrays & strings are what is ok to vend
[self.xpcConnection.remoteObjectInterface
setClasses: [NSSet setWithObjects: [NSMutableArray class], [NSMutableDictionary class], [NSString class], nil]
forSelector: @selector(enumerateDylibs:withReply:)
argumentIndex: 0 // the first parameter
ofReply: YES // in the method itself.
];
//set classes
// ->arrays & strings are what is ok to vend
[self.xpcConnection.remoteObjectInterface
setClasses: [NSSet setWithObjects: [NSMutableArray class], [NSMutableDictionary class], [NSString class], nil]
forSelector: @selector(enumerateFiles:withReply:)
argumentIndex: 0 // the first parameter
ofReply: YES // in the method itself.
];
//set classes
// ->arrays & strings are what is ok to vend
[self.xpcConnection.remoteObjectInterface
setClasses: [NSSet setWithObjects: [NSMutableArray class], [NSMutableDictionary class], [NSString class], [NSNumber class], nil]
forSelector: @selector(enumerateNetwork:withReply:)
argumentIndex: 0 // the first parameter
ofReply: YES // in the method itself.
];
//resume
[self.xpcConnection resume];
//happy
initialized = YES;
//bail
bail:
return initialized;
}
//check if app is auth'd
// ->specifically, if XPC service is setuid
//TODO: error checking!?
-(BOOL)isAuthenticated
{
//flag
@@ -195,9 +248,29 @@
//get path to XPC service
xpcService = getPath2XPC();
//sanity check
if(nil == xpcService)
{
//err msg
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to get path to XPC service");
//bail
goto bail;
}
//get XPC services' attributes
fileAttributes = [[NSFileManager defaultManager] attributesOfItemAtPath:xpcService error:nil];
//sanity check
if(nil == fileAttributes)
{
//err msg
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to file attributes for XPC service");
//bail
goto bail;
}
//check if (fully) auth'd
// ->owned by r00t & SETUID
if( (0 == [fileAttributes[NSFileOwnerAccountID] unsignedLongValue]) &&
@@ -206,6 +279,9 @@
//set flag
isAuthenticated = YES;
}
//bail
bail:
return isAuthenticated;
}
@@ -426,6 +502,9 @@ bail:
//tag
NSUInteger segmentTag = 0;
//not found msg
NSString* noItemsMsg = nil;
//get segment tag
segmentTag = [[self.bottomPaneBtn selectedCell] tagForSegment:[self.bottomPaneBtn selectedSegment]];
@@ -456,7 +535,7 @@ bail:
self.bottomViewController.tableItems = self.currentTask.dylibs;
//if there is none
self.noItemsLabel.stringValue = @"no dylibs found";
noItemsMsg = @"no dylibs found";
break;
@@ -467,7 +546,7 @@ bail:
self.bottomViewController.tableItems = self.currentTask.files;
//if there is none
self.noItemsLabel.stringValue = @"no files found";
noItemsMsg = @"no files found";
break;
@@ -478,7 +557,7 @@ bail:
self.bottomViewController.tableItems = self.currentTask.connections;
//if there is none
self.noItemsLabel.stringValue = @"no network connections found";
noItemsMsg = @"no network connections found";
break;
@@ -486,8 +565,13 @@ bail:
break;
}
//execute on current thread
if(YES == [NSThread isMainThread])
{
//set not found label
self.noItemsLabel.stringValue = noItemsMsg;
//finalize
[self finalizeBottomReload];
}
else
@@ -496,7 +580,12 @@ bail:
// ->in main UI thread
dispatch_async(dispatch_get_main_queue(), ^{
//set not found label
self.noItemsLabel.stringValue = noItemsMsg;
//finalize
[self finalizeBottomReload];
});
}
@@ -550,10 +639,14 @@ bail:
// ->use all tasks
if(YES != self.taskTableController.isFiltered)
{
//TODO: sync? YESSS!!!!
//sync
@synchronized(self.taskEnumerator.tasks)
{
//get tasks
tasks = self.taskEnumerator.tasks;
//reload each row w/ new VT info
for(NSNumber* taskPid in tasks)
{
//extract task
@@ -566,11 +659,18 @@ bail:
[self reloadRow:task];
}
}
}//sync
}
//when filtered
// ->use filtered items
else
{
//sync
@synchronized(self.taskTableController.filteredItems)
{
//filtered items
for(Task* task in self.taskTableController.filteredItems)
{
@@ -581,13 +681,14 @@ bail:
[self reloadRow:task];
}
}
}//sync
}
}//top pane
//bottom pane
// ->can just invoke 'reloadRow' method (which has logic to handle filtering, ignoring 'not found' items, etc.
// ->can just invoke 'reloadRow' method (which has logic to handle filtering, ignoring 'not found' items, etc.)
else
{
//reload
@@ -708,9 +809,8 @@ bail:
return;
}
//TODO: don't think we need to sort by pid, since tree view, just uses kids!!!
//sort tasks
// ->either name (flat view) or pid (tree view)
// ->just by name (for flat view)
-(void)sortTasksForView:(OrderedDictionary*)tasks;
{
//sort tasks
@@ -720,13 +820,6 @@ bail:
//sort
[tasks sort:SORT_BY_NAME];
}
//sort tasks
// ->tree view, sort by pid
else
{
//sort
[tasks sort:SORT_BY_PID];
}
return;
}
@@ -746,7 +839,6 @@ bail:
dispatch_async(dispatch_get_main_queue(), ^{
//refresh
//[self.taskTableController refresh];
[(id)self.taskTableController refresh];
});
@@ -756,7 +848,6 @@ bail:
// ->just refresh
else
{
//TODO: currentViewCont?!?
//refresh
[(id)self.taskTableController refresh];
}
@@ -764,85 +855,6 @@ bail:
return;
}
/*
//callback method, invoked by virus total when plugin's items have been processed
// ->reload table if plugin matches active plugin
-(void)itemsProcessed:(PluginBase*)plugin
{
//if there are any flagged items
// ->reload category table (to trigger title turning red)
if(0 != plugin.flaggedItems.count)
{
//execute on main (UI) thread
dispatch_sync(dispatch_get_main_queue(), ^{
//reload category table
[self.categoryTableController customReload];
});
}
//check if active plugin matches
if(plugin == self.selectedPlugin)
{
//execute on main (UI) thread
dispatch_sync(dispatch_get_main_queue(), ^{
//scroll to top of item table
[self.taskTableController scrollToTop];
//reload item table
[self.taskTableController.itemTableView reloadData];
});
}
return;
}
*/
/*
//update a single row
-(void)itemProcessed:(File*)fileObj rowIndex:(NSUInteger)rowIndex
{
//reload category table (on main thread)
// ->ensures correct title color (red, or reset)
dispatch_sync(dispatch_get_main_queue(), ^{
//reload category table
[self.categoryTableController customReload];
});
//check if active plugin matches
if(fileObj.plugin == self.selectedPlugin)
{
//execute on main (UI) thread
dispatch_sync(dispatch_get_main_queue(), ^{
//start table updates
[self.taskTableController.itemTableView beginUpdates];
//update
[self.taskTableController.itemTableView reloadDataForRowIndexes:[NSIndexSet indexSetWithIndex:rowIndex] columnIndexes:[NSIndexSet indexSetWithIndex:0]];
//end table updates
[self.taskTableController.itemTableView endUpdates];
});
}
return;
}
*/
//callback when user has updated prefs
// ->reload table, etc
-(void)applyPreferences
@@ -1064,8 +1076,10 @@ bail:
//start JSON
[output appendString:@"{\"tasks:\":["];
//TODO: sync taskEnumerator.tasks!! since user can click 'refresh' etc?
//sync
@synchronized(self.taskEnumerator.tasks)
{
//get tasks
for(NSNumber* taskPid in self.taskEnumerator.tasks)
{
@@ -1073,6 +1087,8 @@ bail:
[output appendFormat:@"{%@},", [self.taskEnumerator.tasks[taskPid] toJSON]];
}
}//sync
//remove last ','
if(YES == [output hasSuffix:@","])
{
@@ -1088,7 +1104,7 @@ bail:
if(YES != [output writeToURL:[panel URL] atomically:NO encoding:NSUTF8StringEncoding error:&error])
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: saving output to %@ failed with %@", [panel URL], error);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: saving output to %s failed with %s", [[panel URL] fileSystemRepresentation], [[error description] UTF8String]);
//init popup w/ error msg
saveResultPopup = [NSAlert alertWithMessageText:@"ERROR: failed to save output" defaultButton:@"Ok" alternateButton:nil otherButton:nil informativeTextWithFormat:@"details: %@", error];
@@ -1117,11 +1133,11 @@ bail:
//automatically invoked when user clicks 'search' button
// ->perform global search
//TODO: implement
//TODO: implement (in next version)
- (IBAction)search:(id)sender
{
//'unimplemented' msg
__block NSAlert* errorPopup = nil;
NSAlert* errorPopup = nil;
//init popup w/ msg
errorPopup = [NSAlert alertWithMessageText:@"sorry, 'global search' not yet implemented" defaultButton:@"Ok" alternateButton:nil otherButton:nil informativeTextWithFormat:@"...should be in next version :)"];
@@ -1267,7 +1283,6 @@ bail:
//(automatically) invoked on segmented button click or (manually) on task (top pane) switch
// ->change input (for pane) & then refresh it
//TODO: make xpcConnection appDelegate iVar
-(IBAction)selectBottomPaneContent:(id)sender
{
//tag
@@ -1296,21 +1311,6 @@ bail:
//get segment tag
segmentTag = [[self.bottomPaneBtn selectedCell] tagForSegment:[self.bottomPaneBtn selectedSegment]];
/*
//for dylibs
// ->don't want to re-enum if initial enumerations is still occuring
if( (DYLIBS_VIEW == segmentTag) &&
(YES != [self.taskEnumerator shouldEnumDylibs]) &&
(0 != self.currentTask.dylibs.count) )
{
//just reload pane
[self reloadBottomPane:self.currentTask itemView:segmentTag];
//bail
goto bail;
}
*/
//always hide 'no items' label
self.noItemsLabel.hidden = YES;
@@ -1354,7 +1354,7 @@ bail:
//(re)enumerate dylibs via XPC
// ->triggers table reload when done
[self.currentTask enumerateDylibs:self.taskEnumerator.xpcConnection allDylibs:self.taskEnumerator.dylibs];
[self.currentTask enumerateDylibs:self.xpcConnection allDylibs:self.taskEnumerator.dylibs];
break;
@@ -1366,7 +1366,7 @@ bail:
//(re)enumerate files via XPC
// ->triggers table reload when done
[self.currentTask enumerateFiles:self.taskEnumerator.xpcConnection];
[self.currentTask enumerateFiles:self.xpcConnection];
break;
@@ -1378,7 +1378,7 @@ bail:
//(re)enumerate network connections via XPC
// ->triggers table reload when done
[self.currentTask enumerateNetworking:self.taskEnumerator.xpcConnection];
[self.currentTask enumerateNetworking:self.xpcConnection];
break;
@@ -1571,7 +1571,6 @@ bail:
}
//action for 'refresh' button
// ->query OS to refresh/reload all tasks
-(IBAction)refreshTasks:(id)sender
@@ -1581,6 +1580,18 @@ bail:
//select top row
[self.taskTableController.itemView selectRowIndexes:[NSIndexSet indexSetWithIndex:0] byExtendingSelection:NO];
//TODO: don't reset filtered items?
// ...will require some smart filtering :/
//unset filter flag
self.taskTableController.isFiltered = NO;
//remove all filtered items
[self.taskTableController.filteredItems removeAllObjects];
//reset filter box
self.filterTasksBox.stringValue = @"";
//scroll to top
[self.taskTableController scrollToTop];
Filter.m
+40 -21
View File
@@ -176,39 +176,58 @@ NSString * const KEYWORDS[] = {@"#apple", @"#nonapple", @"#signed", @"#unsigned"
}
//filter network connections
//TODO: match on state, etc?
//TODO: make format of range seach/check/continue
//TODO: match on family/connection type
-(void)filterConnections:(NSString*)filterText items:(NSMutableArray*)items results:(NSMutableArray*)results
{
//local IP addr range
NSRange localIPRange = {0};
//local port range
NSRange localPortRange = {0};
//TODO: add remote ip/port, state, proto, family?
//first reset filter'd items
[results removeAllObjects];
//iterate over all tasks
for(Connection* item in items)
{
//init name range
localIPRange = [item.localIPAddr rangeOfString:filterText options:NSCaseInsensitiveSearch];
//init path range
localPortRange = [[NSString stringWithFormat:@"%d", [item.localPort unsignedShortValue]] rangeOfString:filterText options:NSCaseInsensitiveSearch];
//check for match
if( (NSNotFound != localIPRange.location) ||
(NSNotFound != localPortRange.location) )
//check local ip
if(NSNotFound != [item.localIPAddr rangeOfString:filterText options:NSCaseInsensitiveSearch].location)
{
//save match
[results addObject:item];
//next
continue;
}
}//all items
//check local port
if(NSNotFound != [[NSString stringWithFormat:@"%d", [item.localPort unsignedShortValue]] rangeOfString:filterText options:NSCaseInsensitiveSearch].location)
{
//save match
[results addObject:item];
//next
continue;
}
//check remote ip
if( (nil != item.remoteIPAddr) &&
(NSNotFound != [item.remoteIPAddr rangeOfString:filterText options:NSCaseInsensitiveSearch].location) )
{
//save match
[results addObject:item];
//next
continue;
}
//check remote port
if( (nil != item.remoteIPAddr) &&
(NSNotFound != [[NSString stringWithFormat:@"%d", [item.remotePort unsignedShortValue]] rangeOfString:filterText options:NSCaseInsensitiveSearch].location) )
{
//save match
[results addObject:item];
//next
continue;
}
}//all connections
return;
}
@@ -346,7 +365,7 @@ bail:
BOOL isFlagged = NO;
//check
//TODO: query VT if needed?
// ->note: assumes that VT query has already completed...
if( (nil != item.vtInfo) &&
(0 != [item.vtInfo[VT_RESULTS_POSITIVES] unsignedIntegerValue]) )
{
InfoWindowController.m
+19 -25
View File
@@ -119,6 +119,15 @@
//set name
[self.name setStringValue:[self valueForStringItem:task.binary.name default:@"unknown"]];
//flagged items
// ->make name red!
if( (nil != task.binary.vtInfo) &&
(0 != [task.binary.vtInfo[VT_RESULTS_POSITIVES] unsignedIntegerValue]) )
{
//red
self.name.textColor = [NSColor redColor];
}
//set command line
// ->done just in time (first time)
if(nil == task.arguments)
@@ -129,18 +138,6 @@
//set args
[self.arguments setStringValue:[self valueForStringItem:[task.arguments componentsJoinedByString:@""] default:@"no arguments"]];
//TODO:enable
/*
//flagged files
// ->make name red!
if( (nil != ((File*)self.itemObj).vtInfo) &&
(0 != [((File*)self.itemObj).vtInfo[VT_RESULTS_POSITIVES] unsignedIntegerValue]) )
{
//set color (light red)
self.name.textColor = [NSColor redColor];
}
*/
//set path
[self.path setStringValue:[self valueForStringItem:task.binary.path default:@"unknown"]];
@@ -174,10 +171,10 @@
[self.sign setStringValue:[self valueForStringItem:[task.binary formatSigningInfo] default:@"not signed"]];
}
//handle binaries
//handle binaries (dylibs)
else if(YES == [self.itemObj isKindOfClass:[Binary class]])
{
//type cast
//cast as binary/dylib
dylib = (Binary*)self.itemObj;
//set icon
@@ -186,17 +183,14 @@
//set name
[self.name setStringValue:[self valueForStringItem:dylib.name default:@"unknown"]];
//TODO: enable?!
/*
//flagged files
// ->make name red!
if( (nil != ((File*)self.itemObj).vtInfo) &&
(0 != [((File*)self.itemObj).vtInfo[VT_RESULTS_POSITIVES] unsignedIntegerValue]) )
{
//set color (light red)
self.name.textColor = [NSColor redColor];
}
*/
//flagged items
// ->make name red!
if( (nil != dylib.vtInfo) &&
(0 != [dylib.vtInfo[VT_RESULTS_POSITIVES] unsignedIntegerValue]) )
{
//red
self.name.textColor = [NSColor redColor];
}
//set path
[self.path setStringValue:[self valueForStringItem:dylib.path default:@"unknown"]];
Items/Connection.m
-1
View File
@@ -19,7 +19,6 @@
{
//super
//self = [super initWithParams:params];
//TODO: think about this - Connection doesn't share any baseItem stuffz
self = [super init];
if(nil != self)
{
Items/File.m
+3 -4
View File
@@ -5,13 +5,13 @@
// Created by Patrick Wardle on 2/19/15.
// Copyright (c) 2015 Objective-See. All rights reserved.
//
#import "File.h"
#import "Consts.h"
#import "Utilities.h"
#import "AppDelegate.h"
#import <syslog.h>
@implementation File
@synthesize type;
@@ -26,11 +26,10 @@
if(self)
{
//always skip not-existent paths
// ->also get set a directory flag at the same time ;)
if(YES != [[NSFileManager defaultManager] fileExistsAtPath:params[KEY_RESULT_PATH]])
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: %@ not found", params[KEY_RESULT_PATH]);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: %s not found", [params[KEY_RESULT_PATH] UTF8String]);
//set self to nil
self = nil;
RequestRootWindowController.m
+9 -6
View File
@@ -9,9 +9,10 @@
#import "Utilities.h"
#import "AppDelegate.h"
#import "RequestRootWindowController.h"
#import <syslog.h>
@implementation RequestRootWindowController
@@ -123,7 +124,7 @@
if(errAuthorizationSuccess != osStatus)
{
//err msg
NSLog(@"ERROR: AuthorizationCreate() failed with %d", osStatus);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: AuthorizationCreate() failed with %d", osStatus);
//bail
goto bail;
@@ -134,7 +135,7 @@
if(errAuthorizationSuccess != osStatus)
{
//err msg
NSLog(@"ERROR: AuthorizationExecuteWithPrivileges() failed with %d", osStatus);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: AuthorizationExecuteWithPrivileges() failed with %d", osStatus);
//set result msg
[self.statusMsg setStringValue: [NSString stringWithFormat:@"error: failed with %d", osStatus]];
@@ -169,7 +170,7 @@
if(errAuthorizationSuccess != osStatus)
{
//err msg
NSLog(@"ERROR: AuthorizationExecuteWithPrivileges() failed with %d", osStatus);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: AuthorizationExecuteWithPrivileges() failed with %d", osStatus);
//set result msg
[self.statusMsg setStringValue: [NSString stringWithFormat:@"error: failed with %d", osStatus]];
@@ -187,9 +188,11 @@
//no exit
self.shouldExit = NO;
//start enumerating tasks
[((AppDelegate*)[[NSApplication sharedApplication] delegate]) exploreTasks];
//call back into app delegate
// ->kick off task enum, etc
[((AppDelegate*)[[NSApplication sharedApplication] delegate]) go];
//bail
bail:
Task.h
-3
View File
@@ -77,8 +77,6 @@ struct dyld_image_info_32 {
//get command-line args
-(void)getArguments;
-(void)generateBinaryInfo;
//enumerate all dylibs
// ->new ones are added to 'existingDylibs' (global) dictionary
-(void)enumerateDylibs:(NSXPCConnection*)xpcConnection allDylibs:(NSMutableDictionary*)allDylibs;
@@ -90,7 +88,6 @@ struct dyld_image_info_32 {
-(void)enumerateNetworking:(NSXPCConnection*)xpcConnection;
//convert self to JSON string
// TODO: add dylibs, files, networking
-(NSString*)toJSON;
@end
Task.m
+15 -26
View File
@@ -32,22 +32,16 @@
@synthesize pid;
@synthesize uid;
//@synthesize icon;
//@synthesize name;
//@synthesize path;
@synthesize ppid;
@synthesize files;
@synthesize binary;
//@synthesize bundle;
@synthesize dylibs;
@synthesize children;
@synthesize arguments;
@synthesize connections;
//TODO: make sure we only check signature of binary once!!!
//init w/ a pid + path
// note: time consuming init's are done in '' method
// note: time consuming init's are done in other methods
-(id)initWithPID:(NSNumber*)taskPID andPath:(NSString*)taskPath
{
//existing binaries
@@ -61,7 +55,6 @@
self = [super init];
if(nil != self)
{
//TODO: sync? or always access w/ direct var
//grab existings binaries
existingBinaries = ((AppDelegate*)[[NSApplication sharedApplication] delegate]).taskEnumerator.executables;
@@ -118,8 +111,12 @@
// ->this will process in background
[((AppDelegate*)[[NSApplication sharedApplication] delegate]).taskEnumerator.binaryQueue enqueue:self.binary];
//add it to 'global' list
existingBinaries[taskPath] = self.binary;
//sync
@synchronized(existingBinaries)
{
//add it to 'global' list
existingBinaries[taskPath] = self.binary;
}
}
}//init self
@@ -130,15 +127,6 @@ bail:
return self;
}
//
-(void)generateBinaryInfo
{
//create main binary
//self.binary = [[Binary alloc] initWithParams:@{KEY_RESULT_PATH:self.path}];
return;
}
//get command-line args
-(void)getArguments
{
@@ -310,7 +298,6 @@ bail:
{
//free
free(processArgs);
}
return;
@@ -524,9 +511,12 @@ bail:
//generate detailed info
[newFile generateDetailedInfo];
//TODO: sync!
//save into global list
[((AppDelegate*)[[NSApplication sharedApplication] delegate]).taskEnumerator.files setObject:newFile forKey:filePath];
//sync
@synchronized(((AppDelegate*)[[NSApplication sharedApplication] delegate]).taskEnumerator.files)
{
//save into global list
[((AppDelegate*)[[NSApplication sharedApplication] delegate]).taskEnumerator.files setObject:newFile forKey:filePath];
}
}
}];
@@ -542,7 +532,8 @@ bail:
//remove any existing enum'd networking sockets/connections
[self.connections removeAllObjects];
NSLog(@"invoking XPC to enumer networking");
//dbg msg
//NSLog(@"invoking XPC to enumer networking");
//invoke XPC service (running as r00t)
// ->will enumerate network sockets/connections, then invoke reply block so can save into iVar
@@ -565,10 +556,8 @@ bail:
}
}
////TODO: on main thead?
//reload bottom pane
[((AppDelegate*)[[NSApplication sharedApplication] delegate]) reloadBottomPane:self itemView:NETWORKING_VIEW];
}];
return;
TaskEnumerator.h
-11
View File
@@ -19,9 +19,6 @@
/* PROPERTIES */
//flag indicating first scan is complete
//@property BOOL firstScanComplete;
//all tasks objects
@property(nonatomic, retain)OrderedDictionary* tasks;
@@ -34,10 +31,6 @@
//all dylibs
@property(nonatomic, retain)NSMutableDictionary* dylibs;
//remote XPC interface
//TODO: weak OK?
@property (nonatomic, retain) NSXPCConnection* xpcConnection;
//queue
// ->contains binaries that should be processed
@property (nonatomic, retain) Queue* binaryQueue;
@@ -56,10 +49,6 @@
// ->ensures order of parent's (by pid), is preserved
-(void)generateAncestries:(OrderedDictionary*)newTasks;
//determine if dylibs should be (re)enumerated
// ->generally yes, unless the first enumeration (of all tasks) is not complete
//-(BOOL)shouldEnumDylibs;
//remove a task
// ->contain extra logic to remove children, etc
-(void)removeTask:(Task*)task;
TaskEnumerator.m
+22 -49
View File
@@ -14,9 +14,10 @@
#import "AppDelegate.h"
#import "Utilities.h"
#import "TaskEnumerator.h"
#import "serviceInterface.h"
#include <signal.h>
#include <unistd.h>
#import <syslog.h>
#import <signal.h>
#import <unistd.h>
@@ -29,9 +30,8 @@
@synthesize dylibs;
@synthesize binaryQueue;
@synthesize executables;
@synthesize xpcConnection;
//@synthesize firstScanComplete;
//init
-(id)init
@@ -49,42 +49,6 @@
//alloc dylibs dictionary
dylibs = [NSMutableDictionary dictionary];
//alloc XPC connection
xpcConnection = [[NSXPCConnection alloc] initWithServiceName:@"com.objective-see.remoteTaskService"];
//set remote object interface
self.xpcConnection.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(remoteTaskProto)];
//set classes
// ->arrays & strings are what is ok to vend
[self.xpcConnection.remoteObjectInterface
setClasses: [NSSet setWithObjects: [NSMutableArray class], [NSMutableDictionary class], [NSString class], nil]
forSelector: @selector(enumerateDylibs:withReply:)
argumentIndex: 0 // the first parameter
ofReply: YES // in the method itself.
];
//set classes
// ->arrays & strings are what is ok to vend
[self.xpcConnection.remoteObjectInterface
setClasses: [NSSet setWithObjects: [NSMutableArray class], [NSMutableDictionary class], [NSString class], nil]
forSelector: @selector(enumerateFiles:withReply:)
argumentIndex: 0 // the first parameter
ofReply: YES // in the method itself.
];
//set classes
// ->arrays & strings are what is ok to vend
[self.xpcConnection.remoteObjectInterface
setClasses: [NSSet setWithObjects: [NSMutableArray class], [NSMutableDictionary class], [NSString class], [NSNumber class], nil]
forSelector: @selector(enumerateNetwork:withReply:)
argumentIndex: 0 // the first parameter
ofReply: YES // in the method itself.
];
//resume
[self.xpcConnection resume];
//init binary processing queue
binaryQueue = [[Queue alloc] init];
@@ -96,7 +60,7 @@
//enumerate all tasks
// ->calls back into app delegate to update task (top) table when pau
// TOOD: call every x # of seconds?
// TODO: call every x # of seconds?
-(void)enumerateTasks
{
//(new) task item
@@ -150,10 +114,14 @@
continue;
}
//TODO: sync?
//sync
@synchronized(self.tasks)
{
//add new task
[self.tasks setObject:newTask forKey:newTask.pid];
}//sync
}//add new tasks
@@ -243,7 +211,7 @@
if(status < 0)
{
//err
NSLog(@"OBJECTIVE-SEE ERROR: proc_listpids() failed with %d", status);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: proc_listpids() failed with %d", status);
//bail
goto bail;
@@ -313,11 +281,8 @@ bail:
return allTasks;
}
//TODO: remove!
//insert tasks into appropriate parent
// ->ensures order of parent's (by pid), is preserved
//TODO: what about parentless procs!? (e.g. malware?)
//TODO: what about dead-parents, 'desktop helper'
-(void)generateAncestries:(OrderedDictionary*)newTasks
{
//task
@@ -353,12 +318,20 @@ bail:
//get task
task = newTasks[key];
//ignore tasks that have died
if(YES != isAlive([task.pid intValue]))
{
//next
continue;
}
//get parent
parent = newTasks[task.ppid];
//when parent is nil
//when parent is nil or dead
// ->default to launchd (pid 0x1)
if(nil == parent)
if( (nil == parent) ||
(YES != isAlive([task.pid intValue])) )
{
//default
parent = self.tasks[@1];
TaskExplorer.xcodeproj/xcuserdata/patrick.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist
+71 -103
View File
@@ -46,11 +46,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "VirusTotal.m"
timestampString = "457651407.339698"
timestampString = "459880884.303039"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "121"
endingLineNumber = "121"
startingLineNumber = "123"
endingLineNumber = "123"
landmarkName = "-addItem:"
landmarkType = "5">
</BreakpointContent>
@@ -62,27 +62,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "Task.m"
timestampString = "458643111.392416"
timestampString = "460097895.698263"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "345"
endingLineNumber = "345"
landmarkName = "-enumerateDylibs:allDylibs:"
landmarkType = "5">
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
shouldBeEnabled = "No"
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "Task.m"
timestampString = "458643111.392416"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "321"
endingLineNumber = "321"
startingLineNumber = "332"
endingLineNumber = "332"
landmarkName = "-enumerateDylibs:allDylibs:"
landmarkType = "5">
</BreakpointContent>
@@ -103,22 +87,6 @@
landmarkType = "5">
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
shouldBeEnabled = "No"
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "Filter.m"
timestampString = "457848671.809721"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "181"
endingLineNumber = "181"
landmarkName = "-filterConnections:items:results:"
landmarkType = "5">
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
@@ -142,11 +110,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "Items/File.m"
timestampString = "458808803.275061"
timestampString = "459880884.303039"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "61"
endingLineNumber = "61"
startingLineNumber = "60"
endingLineNumber = "60"
landmarkName = "-setFileType"
landmarkType = "5">
</BreakpointContent>
@@ -158,11 +126,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "Task.m"
timestampString = "458643111.392416"
timestampString = "460097895.698263"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "438"
endingLineNumber = "438"
startingLineNumber = "425"
endingLineNumber = "425"
landmarkName = "-enumerateDylibs:allDylibs:"
landmarkType = "5">
</BreakpointContent>
@@ -174,11 +142,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "VirusTotal.m"
timestampString = "457651407.339698"
timestampString = "459880884.303039"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "112"
endingLineNumber = "112"
startingLineNumber = "114"
endingLineNumber = "114"
landmarkName = "-addItem:"
landmarkType = "5">
</BreakpointContent>
@@ -190,11 +158,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "RequestRootWindowController.m"
timestampString = "457652630.623627"
timestampString = "459880884.303039"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "24"
endingLineNumber = "24"
startingLineNumber = "25"
endingLineNumber = "25"
landmarkName = "-awakeFromNib"
landmarkType = "5">
</BreakpointContent>
@@ -222,11 +190,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "Filter.m"
timestampString = "457848671.809721"
timestampString = "460097193.779482"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "217"
endingLineNumber = "217"
startingLineNumber = "236"
endingLineNumber = "236"
landmarkName = "-binaryFulfillsKeyword:binary:"
landmarkType = "5">
</BreakpointContent>
@@ -238,31 +206,15 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "Filter.m"
timestampString = "457943064.104332"
timestampString = "460097193.779482"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "343"
endingLineNumber = "343"
startingLineNumber = "362"
endingLineNumber = "362"
landmarkName = "-isFlagged:"
landmarkType = "5">
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
shouldBeEnabled = "Yes"
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "RequestRootWindowController.m"
timestampString = "458624862.374598"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "134"
endingLineNumber = "134"
landmarkName = "-authenticate:"
landmarkType = "5">
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
@@ -270,11 +222,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "TaskEnumerator.m"
timestampString = "458803386.948431"
timestampString = "459880884.303039"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "201"
endingLineNumber = "201"
startingLineNumber = "169"
endingLineNumber = "169"
landmarkName = "-enumerateTasks"
landmarkType = "5">
</BreakpointContent>
@@ -286,31 +238,15 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "TaskEnumerator.m"
timestampString = "458803386.948431"
timestampString = "459880884.303039"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "156"
endingLineNumber = "156"
startingLineNumber = "123"
endingLineNumber = "123"
landmarkName = "-enumerateTasks"
landmarkType = "5">
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
shouldBeEnabled = "No"
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "TaskEnumerator.m"
timestampString = "458803385.744793"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "364"
endingLineNumber = "364"
landmarkName = "-generateAncestries:"
landmarkType = "5">
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
@@ -318,11 +254,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "AppDelegate.m"
timestampString = "459044729.674192"
timestampString = "460150711.336469"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "1598"
endingLineNumber = "1598"
startingLineNumber = "1691"
endingLineNumber = "1691"
landmarkName = "-constrainView:subView:"
landmarkType = "5">
</BreakpointContent>
@@ -334,11 +270,11 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "AppDelegate.m"
timestampString = "459044856.502796"
timestampString = "460150711.336469"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "259"
endingLineNumber = "259"
startingLineNumber = "338"
endingLineNumber = "338"
landmarkName = "@implementation AppDelegate"
landmarkType = "3">
</BreakpointContent>
@@ -350,14 +286,46 @@
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "TaskTableController.m"
timestampString = "459048374.675901"
timestampString = "459840842.999072"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "882"
endingLineNumber = "882"
startingLineNumber = "868"
endingLineNumber = "868"
landmarkName = "-outlineView:rowViewForItem:"
landmarkType = "5">
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
shouldBeEnabled = "Yes"
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "remoteTaskService/remoteTaskService.m"
timestampString = "460135710.183022"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "736"
endingLineNumber = "736"
landmarkName = "socketState2String()"
landmarkType = "7">
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
shouldBeEnabled = "No"
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "remoteTaskService/remoteTaskService.m"
timestampString = "460098075.239358"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "521"
endingLineNumber = "521"
landmarkName = "-enumerateNetwork:withReply:"
landmarkType = "5">
</BreakpointContent>
</BreakpointProxy>
</Breakpoints>
</Bucket>
TaskTableController.m
+6 -20
View File
@@ -25,8 +25,6 @@
#import <AppKit/AppKit.h>
//TODO: need to do some sync or logic to handle swaps -otherwise crashes!!!
@implementation TaskTableController
@synthesize itemView;
@@ -520,8 +518,6 @@ bail:
return;
}
//TODO: make sure this works for outline view!!!
//grab a task at a row
-(Task*)taskForRow:(id)sender
{
@@ -566,19 +562,9 @@ bail:
//get row that's about to be selected
rowView = [self.itemView viewAtColumn:0 row:taskRow makeIfNecessary:YES];
//TODO: need this?
//when not filtered, use all tasks
//if(YES != isFiltered)
//{
//extract task
// ->pid of task is view's id :)
task = tasks[[NSNumber numberWithInteger:(rowView.tag - PID_TAG_DELTA)]];
//}
//when filtered, use filtered items
//else
//{
// task = self.filteredItems[
//}
//extract task
// ->pid of task is view's id :)
task = tasks[[NSNumber numberWithInteger:(rowView.tag - PID_TAG_DELTA)]];
//bail
bail:
@@ -837,9 +823,9 @@ bail:
}
//TODO: combine logic -
//TODO: when combine, use pid of task is view's id - to lookup task :)
- (void)outlineViewSelectionDidChange:(NSNotification *)notification
//automatically ccalled when row is selected in outline view
// ->invoke helper function to handle selection
-(void)outlineViewSelectionDidChange:(NSNotification *)notification
{
//handle selection
[self handleRowSelection];
UI/FileInfoWindow.xib
+2 -2
View File
@@ -1,5 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14D136" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14E46" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
<dependencies>
<deployment identifier="macosx"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="7706"/>
@@ -36,7 +36,7 @@
</textField>
<textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="dY9-WD-WAf">
<rect key="frame" x="75" y="124" width="553" height="34"/>
<textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" title="Item Path" id="MfU-Jb-agl">
<textFieldCell key="cell" truncatesLastVisibleLine="YES" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Item Path" id="MfU-Jb-agl">
<font key="font" size="11" name="Menlo-Regular"/>
<color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
<color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
UI/FlatView.xib
+7 -6
View File
@@ -48,11 +48,11 @@
<rect key="frame" x="1" y="1" width="1301" height="40"/>
<autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
<subviews>
<imageView ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="cG6-PF-La2">
<rect key="frame" x="5" y="9" width="26" height="23"/>
<imageView misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="cG6-PF-La2">
<rect key="frame" x="1" y="7" width="25" height="25"/>
<constraints>
<constraint firstAttribute="height" constant="20" id="9B3-Dt-CCW"/>
<constraint firstAttribute="width" constant="20" id="XhL-Yo-1xA"/>
<constraint firstAttribute="height" constant="25" id="9B3-Dt-CCW"/>
<constraint firstAttribute="width" constant="25" id="XhL-Yo-1xA"/>
</constraints>
<imageCell key="cell" refusesFirstResponder="YES" alignment="left" imageScaling="proportionallyDown" image="NSActionTemplate" id="0cD-OF-kgr"/>
</imageView>
@@ -169,11 +169,12 @@
</textField>
</subviews>
<constraints>
<constraint firstItem="cG6-PF-La2" firstAttribute="top" secondItem="sdY-t5-tbW" secondAttribute="top" constant="7" id="5Ro-94-5jo"/>
<constraint firstItem="Nky-Qb-S7Z" firstAttribute="leading" secondItem="ryD-lC-8IR" secondAttribute="trailing" constant="8" id="7Og-f1-rQH"/>
<constraint firstItem="cG6-PF-La2" firstAttribute="leading" secondItem="sdY-t5-tbW" secondAttribute="leading" constant="8" id="7ms-dD-as0"/>
<constraint firstItem="cG6-PF-La2" firstAttribute="leading" secondItem="sdY-t5-tbW" secondAttribute="leading" constant="4" id="7ms-dD-as0"/>
<constraint firstItem="MqO-G8-w9L" firstAttribute="leading" secondItem="aPz-9H-xyy" secondAttribute="trailing" constant="11" id="AYq-NQ-9ty"/>
<constraint firstItem="Y4J-KD-8iy" firstAttribute="leading" secondItem="eBe-7K-OiH" secondAttribute="trailing" constant="22" id="AeK-oE-FOW"/>
<constraint firstItem="miW-QO-gna" firstAttribute="leading" secondItem="cG6-PF-La2" secondAttribute="trailing" constant="8" id="J3y-8b-F3q"/>
<constraint firstItem="miW-QO-gna" firstAttribute="leading" secondItem="cG6-PF-La2" secondAttribute="trailing" constant="2" id="J3y-8b-F3q"/>
<constraint firstItem="aPz-9H-xyy" firstAttribute="leading" secondItem="miW-QO-gna" secondAttribute="trailing" constant="8" id="Uzg-uC-v3U"/>
<constraint firstItem="gpF-bM-EQR" firstAttribute="leading" secondItem="MqO-G8-w9L" secondAttribute="trailing" constant="17" id="YUh-1b-zZn"/>
<constraint firstAttribute="trailing" secondItem="gpF-bM-EQR" secondAttribute="trailing" constant="20" id="ZwL-8K-oUV"/>
UI/NetworkInfoWindow.xib
+1 -6
View File
@@ -1,5 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14D136" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14E46" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
<dependencies>
<deployment identifier="macosx"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="7706"/>
@@ -8,16 +8,11 @@
<customObject id="-2" userLabel="File's Owner" customClass="InfoWindowController">
<connections>
<outlet property="connection" destination="NA2-2e-4hN" id="XMN-mp-7hv"/>
<outlet property="date" destination="Wbv-SK-w53" id="Li5-qD-Hxq"/>
<outlet property="family" destination="Wbv-SK-w53" id="Ed4-yA-B9v"/>
<outlet property="hashes" destination="GQc-va-MLN" id="ta6-6g-dzh"/>
<outlet property="icon" destination="l8H-S3-g8O" id="BO7-3z-ZLM"/>
<outlet property="name" destination="NA2-2e-4hN" id="0Lg-xP-m03"/>
<outlet property="plist" destination="vm8-PU-Bu0" id="9mC-ha-tfK"/>
<outlet property="protocol" destination="hLU-fi-qXH" id="tyd-MH-eeo"/>
<outlet property="size" destination="hLU-fi-qXH" id="wZf-h4-BKf"/>
<outlet property="state" destination="vm8-PU-Bu0" id="7w4-tn-ItA"/>
<outlet property="status" destination="vm8-PU-Bu0" id="nbA-pd-Eha"/>
<outlet property="type" destination="GQc-va-MLN" id="l7V-wT-132"/>
<outlet property="window" destination="F0z-JX-Cv5" id="gIp-Ho-8D9"/>
</connections>
UI/TaskInfoWindow.xib
+2 -2
View File
@@ -1,5 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14D136" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14E46" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
<dependencies>
<deployment identifier="macosx"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="7706"/>
@@ -38,7 +38,7 @@
</textField>
<textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="dY9-WD-WAf">
<rect key="frame" x="75" y="182" width="553" height="34"/>
<textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" title="Item Path" id="MfU-Jb-agl">
<textFieldCell key="cell" truncatesLastVisibleLine="YES" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Item Path" id="MfU-Jb-agl">
<font key="font" size="11" name="Menlo-Regular"/>
<color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
<color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
UI/TreeView.xib
+7 -6
View File
@@ -48,11 +48,11 @@
<rect key="frame" x="1" y="43" width="1323" height="40"/>
<autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
<subviews>
<imageView ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="0MH-nf-7QQ">
<rect key="frame" x="5" y="9" width="26" height="23"/>
<imageView misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="0MH-nf-7QQ">
<rect key="frame" x="5" y="9" width="25" height="25"/>
<constraints>
<constraint firstAttribute="height" constant="20" id="H6L-AG-feD"/>
<constraint firstAttribute="width" constant="20" id="ga9-0m-fXA"/>
<constraint firstAttribute="height" constant="25" id="H6L-AG-feD"/>
<constraint firstAttribute="width" constant="25" id="ga9-0m-fXA"/>
</constraints>
<imageCell key="cell" refusesFirstResponder="YES" alignment="left" imageScaling="proportionallyDown" image="NSActionTemplate" id="f0H-dZ-zgU"/>
</imageView>
@@ -172,13 +172,14 @@
<constraint firstAttribute="trailing" secondItem="TmP-0K-QL5" secondAttribute="trailing" constant="20" id="0bt-Nx-vbM"/>
<constraint firstItem="nqZ-Aq-OkZ" firstAttribute="leading" secondItem="GDK-Bv-5jW" secondAttribute="trailing" constant="8" id="5yT-0e-n5j"/>
<constraint firstItem="2ct-ht-5c2" firstAttribute="leading" secondItem="mDy-ep-li0" secondAttribute="trailing" constant="22" id="9gD-bt-2Vv"/>
<constraint firstItem="GDK-Bv-5jW" firstAttribute="leading" secondItem="0MH-nf-7QQ" secondAttribute="trailing" constant="8" id="HOi-bL-Int"/>
<constraint firstItem="GDK-Bv-5jW" firstAttribute="leading" secondItem="0MH-nf-7QQ" secondAttribute="trailing" constant="2" id="HOi-bL-Int"/>
<constraint firstItem="mDy-ep-li0" firstAttribute="leading" secondItem="Bla-ft-Ebs" secondAttribute="trailing" constant="22" id="ROe-3J-TzR"/>
<constraint firstItem="Gwh-Pi-Cr8" firstAttribute="leading" secondItem="1Zt-oA-mKx" secondAttribute="trailing" constant="8" id="g0l-EE-VzB"/>
<constraint firstItem="VXc-BM-7cb" firstAttribute="leading" secondItem="nqZ-Aq-OkZ" secondAttribute="trailing" constant="11" id="jvP-fF-CXE"/>
<constraint firstAttribute="trailing" secondItem="2ct-ht-5c2" secondAttribute="trailing" constant="20" id="mnd-fE-dNh"/>
<constraint firstItem="TmP-0K-QL5" firstAttribute="leading" secondItem="VXc-BM-7cb" secondAttribute="trailing" constant="17" id="r5M-1N-uEu"/>
<constraint firstItem="0MH-nf-7QQ" firstAttribute="leading" secondItem="cj0-rp-Uha" secondAttribute="leading" constant="8" id="x6f-e1-y92"/>
<constraint firstItem="0MH-nf-7QQ" firstAttribute="top" secondItem="cj0-rp-Uha" secondAttribute="top" constant="8" id="x2F-4g-SxS"/>
<constraint firstItem="0MH-nf-7QQ" firstAttribute="leading" secondItem="cj0-rp-Uha" secondAttribute="leading" constant="4" id="x6f-e1-y92"/>
</constraints>
<connections>
<outlet property="imageView" destination="0MH-nf-7QQ" id="sAM-br-vYx"/>
Utilities.m
+13 -11
View File
@@ -11,6 +11,7 @@
#import <signal.h>
#import <unistd.h>
#import <syslog.h>
#import <libproc.h>
#import <sys/sysctl.h>
#import <Security/Security.h>
@@ -126,7 +127,7 @@ NSDictionary* extractSigningInfo(NSString* path)
if(STATUS_SUCCESS != status)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: SecStaticCodeCreateWithPath() failed on %@ with %d", path, status);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: SecStaticCodeCreateWithPath() failed on %s with %d", [path UTF8String], status);
//bail
goto bail;
@@ -149,7 +150,7 @@ NSDictionary* extractSigningInfo(NSString* path)
if(STATUS_SUCCESS != status)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: SecCodeCopySigningInformation() failed on %@ with %d", path, status);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: SecCodeCopySigningInformation() failed on %s with %d", [path UTF8String], status);
//bail
goto bail;
@@ -158,9 +159,13 @@ NSDictionary* extractSigningInfo(NSString* path)
//determine if binary is signed by Apple
signingStatus[KEY_SIGNING_IS_APPLE] = [NSNumber numberWithBool:isApple(path)];
}
//TODO: bail, unsigned?
//error
// ->not signed, or something else, so no need to check cert's names
else
{
//bail
goto bail;
}
//init array for certificate names
signingStatus[KEY_SIGNING_AUTHORITIES] = [NSMutableArray array];
@@ -245,7 +250,7 @@ BOOL isApple(NSString* path)
if(STATUS_SUCCESS != status)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: SecStaticCodeCreateWithPath() failed on %@ with %d", path, status);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: SecStaticCodeCreateWithPath() failed on %s with %d", [path UTF8String], status);
//bail
goto bail;
@@ -258,7 +263,7 @@ BOOL isApple(NSString* path)
(requirementRef == NULL) )
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: SecRequirementCreateWithString() failed on %@ with %d", path, status);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: SecRequirementCreateWithString() failed on %s with %d", [path UTF8String], status);
//bail
goto bail;
@@ -409,8 +414,7 @@ NSDictionary* hashFile(NSString* filePath)
if(nil == (fileContents = [NSData dataWithContentsOfFile:filePath]))
{
//err msg
//TODO: re-enable
//NSLog(@"OBJECTIVE-SEE ERROR: couldn't load %@ to hash", filePath);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: couldn't load %s to hash", [filePath UTF8String]);
//bail
goto bail;
@@ -694,8 +698,6 @@ BOOL isAlive(pid_t targetPID)
}
//NSLog(@"killing %d: %d/%d", targetPID, result, errno);
return isAlive;
}
VirusTotal.m
+14 -12
View File
@@ -12,6 +12,8 @@
#import "VirusTotal.h"
#import "AppDelegate.h"
#import <syslog.h>
@implementation VirusTotal
@synthesize items;
@@ -439,7 +441,7 @@
if(nil == postData)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: failed to convert request %@ to JSON", postData);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to convert request %s to JSON", [[postData description] UTF8String]);
//bail
goto bail;
@@ -472,11 +474,11 @@
//sanity check(s)
if( (nil == vtData) ||
(nil != error) ||
(200 != (long)[(NSHTTPURLResponse *)httpResponse statusCode]) )
(nil != error) ||
(200 != (long)[(NSHTTPURLResponse *)httpResponse statusCode]) )
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: failed to query VirusTotal (%@, %@)", error, httpResponse);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to query VirusTotal (%s, %s)", [[error description] UTF8String], [[httpResponse description] UTF8String]);
//bail
goto bail;
@@ -493,7 +495,7 @@
@catch (NSException *exception)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: converting response %@ to JSON threw %@", vtData, exception);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: converting response %s to JSON threw %s", [[vtData description] UTF8String], [[exception description] UTF8String]);
//bail
goto bail;
@@ -503,7 +505,7 @@
if(nil == results)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: failed to convert response %@ to JSON", vtData);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to convert response %s to JSON", [[vtData description] UTF8String]);
//bail
goto bail;
@@ -578,7 +580,7 @@ bail:
if(nil == fileContents)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: failed to load %@ into memory for submission", item.path);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to load %s into memory for submission", [item.path UTF8String]);
//bail
goto bail;
@@ -618,7 +620,7 @@ bail:
(200 != (long)[(NSHTTPURLResponse *)httpResponse statusCode]) )
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: failed to query VirusTotal (%@, %@)", error, httpResponse);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to query VirusTotal (%s, %s)", [[error description] UTF8String], [[httpResponse description] UTF8String]);
//bail
goto bail;
@@ -635,7 +637,7 @@ bail:
@catch (NSException *exception)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: converting response %@ to JSON threw %@", vtData, exception);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: converting response %s to JSON threw %s", [[vtData description] UTF8String], [[exception description] UTF8String]);
//bail
goto bail;
@@ -645,7 +647,7 @@ bail:
if(nil == results)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: failed to convert response %@ to JSON", vtData);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to convert response %s to JSON", [[vtData description] UTF8String]);
//bail
goto bail;
@@ -683,13 +685,12 @@ bail:
if(nil == result)
{
//err msg
NSLog(@"OBJECTIVE-SEE ERROR: failed to re-scan %@", item.name);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: failed to re-scan %s", [item.name UTF8String]);
//bail
goto bail;
}
//bail
bail:
@@ -726,6 +727,7 @@ bail:
//TODO: do something with detections!?
// ->blinking button, user's can click to see 'flagged items' popup
//if(0 != [result[VT_RESULTS_POSITIVES] unsignedIntegerValue])
}
en.lproj/MainMenu.xib
+43 -37
View File
@@ -2,8 +2,9 @@
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="7706" systemVersion="14E46" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
<dependencies>
<deployment identifier="macosx"/>
<development version="5000" identifier="xcode"/>
<development version="6000" identifier="xcode"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="7706"/>
<capability name="Alignment constraints with different attributes" minToolsVersion="5.1"/>
</dependencies>
<objects>
<customObject id="-2" userLabel="File's Owner" customClass="NSApplication">
@@ -24,7 +25,7 @@
<action selector="about:" target="494" id="1Av-a0-4RW"/>
</connections>
</menuItem>
<menuItem title="Preferences" tag="1" id="Cd7-Xq-jnw">
<menuItem title="Preferences" tag="1" hidden="YES" id="Cd7-Xq-jnw">
<modifierMask key="keyEquivalentModifierMask"/>
<connections>
<action selector="showPreferences:" target="494" id="h1a-NR-0PY"/>
@@ -45,41 +46,27 @@
</menu>
<window allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" releasedWhenClosed="NO" showsToolbarButton="NO" animationBehavior="default" id="371">
<windowStyleMask key="styleMask" titled="YES" closable="YES" miniaturizable="YES" resizable="YES" unifiedTitleAndToolbar="YES"/>
<rect key="contentRect" x="0.0" y="0.0" width="1353" height="675"/>
<rect key="contentRect" x="0.0" y="0.0" width="1353" height="665"/>
<rect key="screenRect" x="0.0" y="0.0" width="1440" height="877"/>
<value key="minSize" type="size" width="1000" height="660"/>
<value key="maxSize" type="size" width="2000" height="660"/>
<view key="contentView" id="372">
<rect key="frame" x="0.0" y="-8" width="1353" height="675"/>
<rect key="frame" x="0.0" y="5" width="1353" height="665"/>
<autoresizingMask key="autoresizingMask"/>
<subviews>
<progressIndicator hidden="YES" horizontalHuggingPriority="750" verticalHuggingPriority="750" fixedFrame="YES" maxValue="100" bezeled="NO" indeterminate="YES" style="spinning" translatesAutoresizingMaskIntoConstraints="NO" id="839">
<rect key="frame" x="1157" y="-121" width="32" height="32"/>
<rect key="frame" x="1157" y="-131" width="32" height="32"/>
</progressIndicator>
<textField hidden="YES" horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="745">
<rect key="frame" x="869" y="-112" width="268" height="18"/>
<rect key="frame" x="869" y="-122" width="268" height="18"/>
<textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="status..." id="748">
<font key="font" size="13" name="Menlo-Regular"/>
<color key="textColor" red="0.20000000000000001" green="0.67450980392156867" blue="1" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
<color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
</textFieldCell>
</textField>
<searchField wantsLayer="YES" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="bNA-gy-9Ta">
<rect key="frame" x="1143" y="350" width="175" height="22"/>
<constraints>
<constraint firstAttribute="height" constant="22" id="1yR-lY-9om"/>
</constraints>
<searchFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" borderStyle="bezel" placeholderString="Filter Dylibs" usesSingleLineMode="YES" bezelStyle="round" id="bct-8m-iWd">
<font key="font" size="11" name="Menlo-Regular"/>
<color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
<color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
</searchFieldCell>
<connections>
<outlet property="delegate" destination="494" id="4ig-0K-Oup"/>
</connections>
</searchField>
<button ambiguous="YES" misplaced="YES" tag="10003" translatesAutoresizingMaskIntoConstraints="NO" id="gSG-Nq-plb">
<rect key="frame" x="108" y="30" width="32" height="25"/>
<rect key="frame" x="108" y="20" width="32" height="25"/>
<constraints>
<constraint firstAttribute="width" constant="32" id="XGt-s5-weq"/>
<constraint firstAttribute="height" constant="25" id="wlR-bC-Msz"/>
@@ -93,7 +80,7 @@
</connections>
</button>
<textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="FRk-Fk-n4f">
<rect key="frame" x="106" y="10" width="38" height="17"/>
<rect key="frame" x="106" y="0.0" width="38" height="17"/>
<textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="center" title="save" id="qeM-6t-Rz6">
<font key="font" size="9" name="Menlo-Regular"/>
<color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
@@ -101,7 +88,7 @@
</textFieldCell>
</textField>
<button ambiguous="YES" misplaced="YES" tag="10002" translatesAutoresizingMaskIntoConstraints="NO" id="UiZ-UI-inM">
<rect key="frame" x="62" y="30" width="32" height="25"/>
<rect key="frame" x="62" y="20" width="32" height="25"/>
<constraints>
<constraint firstAttribute="width" constant="32" id="OtG-JF-PVX"/>
<constraint firstAttribute="height" constant="25" id="Suo-pl-wcf"/>
@@ -115,7 +102,7 @@
</connections>
</button>
<textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="MHi-Fa-fbk">
<rect key="frame" x="59" y="10" width="38" height="17"/>
<rect key="frame" x="59" y="0.0" width="38" height="17"/>
<textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="center" title="search" id="tF8-E0-l1A">
<font key="font" size="9" name="Menlo-Regular"/>
<color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
@@ -123,7 +110,7 @@
</textFieldCell>
</textField>
<textField horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="msk-iH-gVd">
<rect key="frame" x="8" y="10" width="46" height="17"/>
<rect key="frame" x="8" y="0.0" width="46" height="17"/>
<textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="center" title="refresh" id="C2m-Hn-7EE">
<font key="font" size="9" name="Menlo-Regular"/>
<color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
@@ -131,15 +118,15 @@
</textFieldCell>
</textField>
<customView ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="TNF-7q-Loy" userLabel="Top Pane">
<rect key="frame" x="-1" y="394" width="1353" height="281"/>
<rect key="frame" x="-1" y="368" width="1353" height="295"/>
</customView>
<customView ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="E4M-PF-VD0" userLabel="Bottom Pane">
<rect key="frame" x="-1" y="60" width="1353" height="281"/>
<rect key="frame" x="-1" y="50" width="1353" height="281"/>
<subviews>
<progressIndicator horizontalHuggingPriority="750" verticalHuggingPriority="750" fixedFrame="YES" maxValue="100" bezeled="NO" indeterminate="YES" style="spinning" translatesAutoresizingMaskIntoConstraints="NO" id="LMT-Bu-FAk">
<progressIndicator horizontalHuggingPriority="750" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" maxValue="100" bezeled="NO" indeterminate="YES" style="spinning" translatesAutoresizingMaskIntoConstraints="NO" id="LMT-Bu-FAk">
<rect key="frame" x="660" y="124" width="32" height="32"/>
</progressIndicator>
<textField hidden="YES" horizontalHuggingPriority="251" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kIC-ZZ-ldy">
<textField hidden="YES" horizontalHuggingPriority="251" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kIC-ZZ-ldy">
<rect key="frame" x="541" y="211" width="271" height="18"/>
<textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" allowsUndo="NO" sendsActionOnEndEditing="YES" alignment="center" title="no items found" id="LO4-i6-1es">
<font key="font" size="13" name="Menlo-Regular"/>
@@ -148,9 +135,13 @@
</textFieldCell>
</textField>
</subviews>
<constraints>
<constraint firstItem="LMT-Bu-FAk" firstAttribute="leading" secondItem="E4M-PF-VD0" secondAttribute="centerX" constant="-5" id="9rN-kn-Kch"/>
<constraint firstItem="kIC-ZZ-ldy" firstAttribute="leading" secondItem="E4M-PF-VD0" secondAttribute="centerX" constant="-120" id="KMj-fD-TVd"/>
</constraints>
</customView>
<segmentedControl verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="gtq-gn-VPL">
<rect key="frame" x="565" y="352" width="223" height="24"/>
<segmentedControl verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="gtq-gn-VPL">
<rect key="frame" x="565" y="337" width="223" height="24"/>
<segmentedCell key="cell" borderStyle="border" alignment="left" style="rounded" trackingMode="selectOne" id="DHY-0u-YD7">
<font key="font" metaFont="system"/>
<segments>
@@ -164,7 +155,7 @@
</connections>
</segmentedControl>
<button ambiguous="YES" misplaced="YES" tag="10004" translatesAutoresizingMaskIntoConstraints="NO" id="HoI-FQ-vTI">
<rect key="frame" x="1314" y="20" width="29" height="32"/>
<rect key="frame" x="1314" y="10" width="29" height="32"/>
<constraints>
<constraint firstAttribute="height" constant="32" id="18R-rR-Udp"/>
<constraint firstAttribute="width" constant="29" id="JOy-gX-fMr"/>
@@ -178,7 +169,7 @@
</connections>
</button>
<button ambiguous="YES" misplaced="YES" tag="10001" translatesAutoresizingMaskIntoConstraints="NO" id="hum-Mj-cDd">
<rect key="frame" x="20" y="30" width="32" height="25"/>
<rect key="frame" x="20" y="20" width="32" height="25"/>
<constraints>
<constraint firstAttribute="width" constant="32" id="ZaY-KC-vcE"/>
<constraint firstAttribute="height" constant="25" id="dEM-O0-dda"/>
@@ -191,14 +182,29 @@
<action selector="refreshTasks:" target="494" id="QvB-ix-GUl"/>
</connections>
</button>
<searchField wantsLayer="YES" verticalHuggingPriority="750" ambiguous="YES" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="bNA-gy-9Ta">
<rect key="frame" x="1168" y="338" width="175" height="22"/>
<constraints>
<constraint firstAttribute="height" constant="22" id="1yR-lY-9om"/>
</constraints>
<searchFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" editable="YES" borderStyle="bezel" placeholderString="Filter Dylibs" usesSingleLineMode="YES" bezelStyle="round" id="bct-8m-iWd">
<font key="font" size="11" name="Menlo-Regular"/>
<color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
<color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
</searchFieldCell>
<connections>
<outlet property="delegate" destination="494" id="4ig-0K-Oup"/>
</connections>
</searchField>
</subviews>
<constraints>
<constraint firstAttribute="trailing" secondItem="bNA-gy-9Ta" secondAttribute="trailing" constant="12" id="5N8-Ye-mhe"/>
<constraint firstAttribute="trailing" secondItem="E4M-PF-VD0" secondAttribute="trailing" constant="1" id="7em-dD-W3w"/>
<constraint firstAttribute="trailing" secondItem="E4M-PF-VD0" secondAttribute="trailing" constant="-1" id="7em-dD-W3w"/>
<constraint firstItem="E4M-PF-VD0" firstAttribute="leading" secondItem="372" secondAttribute="leading" constant="-1" id="IGR-bI-Hsm"/>
<constraint firstAttribute="trailing" secondItem="TNF-7q-Loy" secondAttribute="trailing" constant="1" id="Lso-h9-MIt"/>
<constraint firstAttribute="trailing" secondItem="TNF-7q-Loy" secondAttribute="trailing" constant="-1" id="Lso-h9-MIt"/>
<constraint firstAttribute="trailing" secondItem="HoI-FQ-vTI" secondAttribute="trailing" constant="10" id="OMm-dV-23S"/>
<constraint firstItem="TNF-7q-Loy" firstAttribute="leading" secondItem="372" secondAttribute="leading" constant="-1" id="bnH-c7-461"/>
<constraint firstItem="gtq-gn-VPL" firstAttribute="leading" secondItem="372" secondAttribute="centerX" constant="-100" id="iUK-4W-mmK"/>
<constraint firstAttribute="trailing" secondItem="bNA-gy-9Ta" secondAttribute="trailing" constant="6" id="k4n-CB-LFx"/>
</constraints>
</view>
<toolbar key="toolbar" implicitIdentifier="EAE4838B-30FD-4B21-8BE5-8564B213BE96" autosavesConfiguration="NO" displayMode="iconAndLabel" sizeMode="regular" id="qEm-Os-zrh">
@@ -268,7 +274,7 @@
<toolbarItem reference="y4u-t8-Acq"/>
</defaultToolbarItems>
</toolbar>
<point key="canvasLocation" x="662.5" y="347.5"/>
<point key="canvasLocation" x="662.5" y="342.5"/>
</window>
<customObject id="494" customClass="AppDelegate">
<connections>
kkRowCell.m
-5
View File
@@ -16,10 +16,6 @@
//draw method
- (void)drawRect:(NSRect)dirtyRect
{
//TODO: bef0re/after/unneeded?
//super
[super drawRect:dirtyRect];
//draw custom color
if(nil != self.color)
{
@@ -31,7 +27,6 @@
}
}
//set background color
// ->always light!
- (void)setBackgroundStyle:(NSBackgroundStyle)backgroundStyle
main.m
+1 -2
View File
@@ -1,6 +1,6 @@
//
// main.m
// KnockKnock
// TaskExplorer
//
// Created by Patrick Wardle
// Copyright (c) 2015 Objective-See. All rights reserved.
@@ -9,7 +9,6 @@
#import <Cocoa/Cocoa.h>
//TODO: add [tableView beginUpdates];
int main(int argc, char *argv[])
{
return NSApplicationMain(argc, (const char **)argv);
remoteTaskService/remoteTaskService.m
+12 -9
View File
@@ -3,10 +3,8 @@
// remoteTaskService
//
// Created by Patrick Wardle on 5/27/15.
// Copyright (c) 2015 Lucas Derraugh. All rights reserved.
// Copyright (c) 2015 Patrick Wardle. All rights reserved.
//
//TODO: make sure task is still active (maybe in client, b4 calling this?!
#import "remoteTaskService.h"
#import "Consts.h"
@@ -23,7 +21,7 @@
#import <arpa/inet.h>
#import <netinet/tcp_fsm.h>
#import <netdb.h>
#import <syslog.h>
static const char *socketFamilies[] =
@@ -78,7 +76,8 @@ struct dyld_image_info_32 {
@implementation remoteTaskService
+ (remoteTaskService *)defaultService {
+(remoteTaskService *)defaultService
{
static dispatch_once_t onceToken;
static remoteTaskService *shared;
dispatch_once(&onceToken, ^{
@@ -145,7 +144,7 @@ struct dyld_image_info_32 {
if(KERN_SUCCESS != status)
{
//err msg
NSLog(@"ERROR: task_for_pid() failed w/ %d", status);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: task_for_pid() failed w/ %d", status);
//bail
goto bail;
@@ -171,7 +170,7 @@ struct dyld_image_info_32 {
if(KERN_SUCCESS != status)
{
//err msg
NSLog(@"ERROR: mach_vm_read() failed w/ %d", status);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: mach_vm_read() failed w/ %d", status);
//bail
goto bail;
@@ -206,7 +205,7 @@ struct dyld_image_info_32 {
if(KERN_SUCCESS != status)
{
//err msg
NSLog(@"ERROR: mach_vm_read() failed w/ %d", status);
syslog(LOG_ERR, "OBJECTIVE-SEE ERROR: mach_vm_read() failed w/ %d", status);
//bail
goto bail;
@@ -243,6 +242,8 @@ struct dyld_image_info_32 {
//remotely read into dylib's path!
// ->seems to always fail for first image, which is base executable...
status = mach_vm_read(remoteTask, (vm_address_t)remoteReadAddr, PATH_MAX, (vm_offset_t*)&dylibPath, &dpBytesRead);
//sanity check
if( (KERN_SUCCESS != status) ||
(NULL == dylibPath) )
{
@@ -262,7 +263,6 @@ struct dyld_image_info_32 {
//dealloc
mach_vm_deallocate(mach_task_self(), (vm_offset_t)dylibPath, dpBytesRead);
}//for all dyld_image_info_32/dyld_image_info structs
//bail
@@ -546,6 +546,9 @@ bail:
//get local ip addr
inet_ntop(AF_INET6, &socketInfo.psi.soi_proto.pri_tcp.tcpsi_ini.insi_laddr.ina_6, localIPAddr, sizeof(localIPAddr));
//TODO: ::1 -> 'loopback' or 0:0:0:0:0:0:0:1
// or ::0, 'unspecified' (see: https://en.wikipedia.org/wiki/IPv6_address)
//add local ip addr
socket[KEY_LOCAL_ADDR] = [NSString stringWithUTF8String:localIPAddr];