diff --git a/AppDelegate.m b/AppDelegate.m index 40adca5..3aa18c3 100755 --- a/AppDelegate.m +++ b/AppDelegate.m @@ -18,7 +18,9 @@ //TODO: filter out dup'd networks (airportd 0:0..) -not sure want to do this //TODO: autolayout vertically -//TODO: show 'from where' via quarantine attrz +//TODO: show 'from where' via quarantine attrz or database!! (simon email) +//TODO: detect as procs die via GCD (simon blog post) + @implementation AppDelegate diff --git a/Consts.h b/Consts.h index 0faaaf4..400ee6e 100644 --- a/Consts.h +++ b/Consts.h @@ -57,6 +57,9 @@ //path to LSOF #define LSOF @"/usr/sbin/lsof" +//path to vmmap32 +#define VMMAP_32 @"/usr/bin/vmmap32" + //path to vmmap #define VMMAP @"/usr/bin/vmmap" @@ -131,8 +134,6 @@ //id (tag) for path #define TABLE_ROW_PATH_LABEL 101 -//id (tag) for plist -#define TABLE_ROW_PID_LABEL 102 //id (tag) for 'virus total' button #define TABLE_ROW_VT_BUTTON 103 diff --git a/Filter.h b/Filter.h index 08eb15f..e94412a 100644 --- a/Filter.h +++ b/Filter.h @@ -35,6 +35,14 @@ // ->determine if binary is flagged by VT -(BOOL)isFlagged:(Binary*)item; +//keyword filter '#encrypted' +// ->determine if binary is encrypted +-(BOOL)isEncrypted:(Binary*)item; + +//keyword filter '#packed' +// ->determine if binary is packed +-(BOOL)isPacked:(Binary*)item; + //filter tasks -(void)filterTasks:(NSString*)filterText items:(NSMutableDictionary*)items results:(NSMutableArray*)results; diff --git a/Filter.m b/Filter.m index 6ae4363..499fbf2 100644 --- a/Filter.m +++ b/Filter.m @@ -13,7 +13,7 @@ #import "Connection.h" //binary filter keywords -NSString * const BINARY_KEYWORDS[] = {@"#apple", @"#nonapple", @"#signed", @"#unsigned", @"#flagged"}; +NSString * const BINARY_KEYWORDS[] = {@"#apple", @"#nonapple", @"#signed", @"#unsigned", @"#flagged", @"#encrypted", @"#packed"}; @implementation Filter @@ -384,6 +384,29 @@ NSString * const BINARY_KEYWORDS[] = {@"#apple", @"#nonapple", @"#signed", @"#un goto bail; } + //handle '#encrypted' + else if( (YES == [keyword isEqualToString:@"#encrypted"]) && + (YES == [self isEncrypted:binary]) ) + { + //happy + fulfills = YES; + + //bail + goto bail; + } + + //handle '#packed' + else if( (YES == [keyword isEqualToString:@"#packed"]) && + (YES == [self isPacked:binary]) ) + { + //happy + fulfills = YES; + + //bail + goto bail; + } + + //bail bail: @@ -463,4 +486,40 @@ bail: } +//keyword filter '#encrypted' +// ->determine if binary is encrypted +-(BOOL)isEncrypted:(Binary *)item +{ + //make sure item was parsed + if(nil == item.parser) + { + //parse + [item parse]; + + //save encrypted flag + item.isEncrypted = [item.parser.binaryInfo[KEY_IS_ENCRYPTED] boolValue]; + } + + //set flag + return item.isEncrypted; +} + +//keyword filter '#packed' +// ->determine if binary is packed +-(BOOL)isPacked:(Binary *)item +{ + //make sure item was parsed + if(nil == item.parser) + { + //parse + [item parse]; + + //save packed flag + item.isPacked = [item.parser.binaryInfo[KEY_IS_PACKED] boolValue]; + } + + //set flag + return item.isPacked; +} + @end diff --git a/ItemView.h b/ItemView.h index 4c32b43..12974dd 100644 --- a/ItemView.h +++ b/ItemView.h @@ -25,6 +25,7 @@ NSTableCellView* createFlaggedItemView(NSTableView* tableView, id owner, id item //create & customize global dylib/file view NSTableCellView* createLoadedItemView(NSTableView* tableView, id owner, id item); + //create & customize task view NSTableCellView* createTaskView(NSTableView* tableView, id owner, id item); @@ -40,6 +41,9 @@ NSTableCellView* createNetworkView(NSTableView* tableView, id owner, Connection* //add a tracking area to a view within the item view void addTrackingArea(NSTableCellView* itemView, NSUInteger subviewTag, id owner); +//build item + 'loaded in' string for dylibs, files, etc in search window +NSAttributedString* initLoadedInString(id item); + //set code signing image // ->either signed, unsigned, or unknown NSImage* getCodeSigningIcon(Binary* binary); diff --git a/ItemView.m b/ItemView.m index f359c71..6881c3e 100644 --- a/ItemView.m +++ b/ItemView.m @@ -153,58 +153,6 @@ NSTableCellView* createLoadedItemView(NSTableView* tableView, id owner, id item) //item cell NSTableCellView* loadedItemCell = nil; - //matching or host tasks - NSMutableArray* tasks = nil; - - //pid or 'loaded in' string - NSMutableString* loadedIn = nil; - - //task's name frame - CGRect nameFrame = {0}; - - //get host tasks - // ->works with dylibs or files - tasks = [((AppDelegate*)[[NSApplication sharedApplication] delegate]).taskEnumerator loadedIn:item]; - - //add dylib indicator - //-> '(dylib, loaded in: ... ' - if(YES == [item isKindOfClass:[Binary class]]) - { - //init - loadedIn = [NSMutableString stringWithFormat:@"(dylib, loaded in:"]; - } - //add file indicator - //-> '(file, loaded in: ... ' - else if(YES == [item isKindOfClass:[File class]]) - { - //init - loadedIn = [NSMutableString stringWithFormat:@"(file, loaded in:"]; - } - //add connection indicator - //-> '(connection, in: ... ' - else if(YES == [item isKindOfClass:[Connection class]]) - { - //init - loadedIn = [NSMutableString stringWithFormat:@"(connection, in:"]; - } - - //add all tasks - for(Task* task in tasks) - { - //append name - [loadedIn appendFormat:@" %@,", task.binary.name]; - } - - //remove last ',' - if(YES == [loadedIn hasSuffix:@","]) - { - //remove - [loadedIn deleteCharactersInRange:NSMakeRange([loadedIn length]-1, 1)]; - } - - //terminate list/output - [loadedIn appendString:@")"]; - //dylibs // ->create cell if(YES == [item isKindOfClass:[Binary class]]) @@ -268,39 +216,9 @@ NSTableCellView* createLoadedItemView(NSTableView* tableView, id owner, id item) //default // ->(re)set main textfield's color to black loadedItemCell.textField.textColor = [NSColor blackColor]; - - //dylibs/files - // ->main text is name - if( (YES == [item isKindOfClass:[Binary class]]) || - (YES == [item isKindOfClass:[File class]]) ) - { - //set name - [loadedItemCell.textField setStringValue:[item name]]; - } - //connections - // ->main text is endpoints string - else - { - //set endpoints string - [loadedItemCell.textField setStringValue:[item endpoints]]; - } - - //get name frame - nameFrame = loadedItemCell.textField.frame; - - //adjust width to fit text - nameFrame.size.width = [loadedItemCell.textField.stringValue sizeWithAttributes: @{NSFontAttributeName: loadedItemCell.textField.font}].width + 5; - - //disable autolayout for name - loadedItemCell.textField.translatesAutoresizingMaskIntoConstraints = YES; - - //update name frame - // ->should now be exact size of text - loadedItemCell.textField.frame = nameFrame; - - //set host task(s) string - // ->immediately follows name - [((NSTextField*)[loadedItemCell viewWithTag:TABLE_ROW_PID_LABEL]) setStringValue:loadedIn]; + + //set main text + loadedItemCell.textField.attributedStringValue = initLoadedInString(item); //dylibs/files // ->subtext is path @@ -346,18 +264,226 @@ bail: return loadedItemCell; } +//build binary string for main window +// ->format: binary name (pid: [encrypted|packed]) +NSAttributedString* initBinaryString(id item, BOOL isSearchWindow) +{ + //string for pid + NSMutableAttributedString* taskString = nil; + + //string attributes + NSDictionary* attributes = nil; + + //binary + Binary* binary = nil; + + //init task string + taskString = [[NSMutableAttributedString alloc] initWithString:@""]; + + //grab binary from task + if(YES == [item isKindOfClass:[Task class]]) + { + //grab + binary = ((Task*)item).binary; + } + //dylib + // ->just assign + else + { + //assign + binary = (Binary*)item; + } + + //add name + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:binary.name]]; + + //init color for pid + // ->light gray + attributes = [NSDictionary dictionaryWithObject:[NSColor lightGrayColor] forKey:NSForegroundColorAttributeName]; + + //search window + // ->only for tasks, since dylibs in search window are handled elsewhere ('loaded in') + if( (YES == isSearchWindow) && + (YES == [item isKindOfClass:[Task class]]) ) + { + //add pid + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:[NSString stringWithFormat:@" (task: %@", ((Task*)item).pid] attributes:attributes]]; + } + //normal window + // ->add encrypted/packed info... + else + { + //task + // ->add task's pid + if(YES == [item isKindOfClass:[Task class]]) + { + //add pid + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:[NSString stringWithFormat:@" (pid: %@", ((Task*)item).pid] attributes:attributes]]; + } + + //added encrypted or packed + if( (YES == binary.isEncrypted) || + (YES == binary.isPacked) ) + { + //init color for comma, etc + // ->light gray + attributes = [NSDictionary dictionaryWithObject:[NSColor lightGrayColor] forKey:NSForegroundColorAttributeName]; + + //tasks + //add comma string + if(YES == [item isKindOfClass:[Task class]]) + { + //close + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:@", " attributes:attributes]]; + } + //dylibs + // ->open parents + else + { + //open + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:@" (" attributes:attributes]]; + } + + //init color + // ->red + attributes = [NSDictionary dictionaryWithObject:[NSColor redColor] forKey:NSForegroundColorAttributeName]; + + //add 'encrypted' + if(YES == binary.isEncrypted) + { + //add + [taskString appendAttributedString:[[NSAttributedString alloc] initWithString:@"encrypted" attributes:attributes]]; + } + //add 'packed' + // ->can't be both...and encryption takes precedence + else + { + //add + [taskString appendAttributedString:[[NSAttributedString alloc] initWithString:@"packed" attributes:attributes]]; + } + + //dylib, need to close string here + // ->normally it doesn't have anything after... + if(YES != [item isKindOfClass:[Task class]]) + { + //init color for closing + attributes = [NSDictionary dictionaryWithObject:[NSColor lightGrayColor] forKey:NSForegroundColorAttributeName]; + + //close string + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:@")" attributes:attributes]]; + } + + }//encrypted or packed + } + + //task + // ->close string + if(YES == [item isKindOfClass:[Task class]]) + { + //init color for closing + // ->light gray + attributes = [NSDictionary dictionaryWithObject:[NSColor lightGrayColor] forKey:NSForegroundColorAttributeName]; + + //close string + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:@")" attributes:attributes]]; + } + + return taskString; +} + +//build item + 'loaded in...' string for dylibs, files, etc in search window +NSAttributedString* initLoadedInString(id item) +{ + //string for pid + NSMutableAttributedString* taskString = nil; + + //string attributes + NSDictionary* attributes = nil; + + //pid or 'loaded in' string + NSMutableString* loadedIn = nil; + + //matching or host tasks + NSMutableArray* tasks = nil; + + //init task string + taskString = [[NSMutableAttributedString alloc] initWithString:@""]; + + //get host tasks + // ->works with dylibs or files + tasks = [((AppDelegate*)[[NSApplication sharedApplication] delegate]).taskEnumerator loadedIn:item]; + + //dylibs/files + // ->add name + if( (YES == [item isKindOfClass:[Binary class]]) || + (YES == [item isKindOfClass:[File class]]) ) + { + //add name + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:[item name]]]; + } + //connections + // ->add endpoints + else + { + //set endpoints string + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:[item endpoints]]]; + } + + //init color for 'loaded in...' + // ->light gray + attributes = [NSDictionary dictionaryWithObject:[NSColor lightGrayColor] forKey:NSForegroundColorAttributeName]; + + //add dylib indicator + //-> '(dylib, loaded in: ... ' + if(YES == [item isKindOfClass:[Binary class]]) + { + //init + loadedIn = [NSMutableString stringWithFormat:@" (dylib, loaded in:"]; + } + //add file indicator + //-> '(file, loaded in: ... ' + else if(YES == [item isKindOfClass:[File class]]) + { + //init + loadedIn = [NSMutableString stringWithFormat:@" (file, loaded in:"]; + } + //add connection indicator + //-> '(connection, in: ... ' + else if(YES == [item isKindOfClass:[Connection class]]) + { + //init + loadedIn = [NSMutableString stringWithFormat:@" (connection, in:"]; + } + + //add all tasks + for(Task* task in tasks) + { + //append name + [loadedIn appendFormat:@" %@,", task.binary.name]; + } + + //remove last ',' + if(YES == [loadedIn hasSuffix:@","]) + { + //remove + [loadedIn deleteCharactersInRange:NSMakeRange([loadedIn length]-1, 1)]; + } + + //terminate list/output + [loadedIn appendString:@")"]; + + //add 'loaded in...' + [taskString appendAttributedString:[[NSMutableAttributedString alloc] initWithString:loadedIn attributes:attributes]]; + + return taskString; +} + //create & customize Task view NSTableCellView* createTaskView(NSTableView* tableView, id owner, Task* task) { //item cell NSTableCellView* taskCell = nil; - //task's name frame - CGRect nameFrame = {0}; - - //string for pid - NSString* pidString = nil; - //sanity check if(nil == task.binary) { @@ -402,40 +528,7 @@ NSTableCellView* createTaskView(NSTableView* tableView, id owner, Task* task) taskCell.textField.textColor = [NSColor blackColor]; //set main text - // ->name - [taskCell.textField setStringValue:task.binary.name]; - - //get name frame - nameFrame = taskCell.textField.frame; - - //adjust width to fit text - nameFrame.size.width = [taskCell.textField.stringValue sizeWithAttributes: @{NSFontAttributeName: taskCell.textField.font}].width + 5; - - //disable autolayout for name - taskCell.textField.translatesAutoresizingMaskIntoConstraints = YES; - - //update name frame - // ->should now be exact size of text - taskCell.textField.frame = nameFrame; - - //init pid string - // ->search mode, show 'task,' to differential between files, etc - if(YES ==[owner isKindOfClass:[SearchWindowController class]]) - { - //init - pidString = [NSString stringWithFormat:@"(task: %@)", task.pid]; - } - //otherwise - // ->just set pid - else - { - //init - pidString = [NSString stringWithFormat:@"(%@)", task.pid]; - } - - //set pid - // ->immediately follows name - [((NSTextField*)[taskCell viewWithTag:TABLE_ROW_PID_LABEL]) setStringValue:pidString]; + taskCell.textField.attributedStringValue = initBinaryString(task, [owner isKindOfClass:[SearchWindowController class]]); //set path [[taskCell viewWithTag:TABLE_ROW_SUB_TEXT_TAG] setStringValue:task.binary.path]; @@ -488,8 +581,8 @@ NSTableCellView* createDylibView(NSTableView* tableView, id owner, Binary* dylib dylibCell.textField.textColor = [NSColor blackColor]; //set main text - // ->name - [dylibCell.textField setStringValue:dylib.name]; + // ->final arg is flag indicating normal or search window + dylibCell.textField.attributedStringValue = initBinaryString(dylib, [owner isKindOfClass:[SearchWindowController class]]); //set path [[dylibCell viewWithTag:TABLE_ROW_SUB_TEXT_TAG] setStringValue:dylib.path]; diff --git a/Items/Binary.h b/Items/Binary.h index 87a2be9..f8b57db 100644 --- a/Items/Binary.h +++ b/Items/Binary.h @@ -6,9 +6,9 @@ // Copyright (c) 2015 Objective-See. All rights reserved. // +#import "MachO.h" #import "ItemBase.h" - #import #import @@ -37,6 +37,15 @@ //signing info @property(nonatomic, retain)NSDictionary* signingInfo; +//macho parser +@property(nonatomic, retain)MachO* parser; + +//encrypted flag +@property BOOL isEncrypted; + +//packed flag +@property BOOL isPacked; + /* VIRUS TOTAL INFO */ //dictionary returned by VT @@ -48,6 +57,9 @@ //init method -(id)initWithParams:(NSDictionary*)params; +//machO parse +-(BOOL)parse; + //get task's name // ->either from bundle or path's last component -(NSString*)getName; diff --git a/Items/Binary.m b/Items/Binary.m index 39caef9..d94d7ae 100644 --- a/Items/Binary.m +++ b/Items/Binary.m @@ -6,7 +6,6 @@ // Copyright (c) 2015 Objective-See. All rights reserved. // - #import "Binary.h" #import "Consts.h" #import "Utilities.h" @@ -19,7 +18,10 @@ @synthesize icon; @synthesize bundle; @synthesize hashes; +@synthesize parser; @synthesize vtInfo; +@synthesize isPacked; +@synthesize isEncrypted; @synthesize signingInfo; @synthesize isTaskBinary; @@ -55,6 +57,52 @@ bail: return self; } +//machO parse +-(BOOL)parse +{ + //flag + BOOL wasParsed = NO; + + //sync + @synchronized(self) + { + //alloc parser + if(nil == parser) + { + //alloc macho parser iVar + parser = [[MachO alloc] init]; + + //parse + if(YES != [self.parser parse:self.path]) + { + //unset parser + self.parser = nil; + + //bail + goto bail; + } + } + + //unset 'packed' flag for apple signed binaries + // ->as apple doesn't pack binaries, but packer algo has some false positives + if( (nil != [self.signingInfo objectForKey:KEY_SIGNING_IS_APPLE]) && + (YES == [self.signingInfo[KEY_SIGNING_IS_APPLE] boolValue]) ) + { + //unset + self.parser.binaryInfo[KEY_IS_PACKED] = NO; + } + + }//sync + + //happy + wasParsed = YES; + +//bail +bail: + + return wasParsed; +} + //get task's name // ->either from bundle or path's last component -(NSString*)getName @@ -175,7 +223,6 @@ bail: } - //format the signing info dictionary -(NSString*)formatSigningInfo { diff --git a/RequestRootWindowController.m b/RequestRootWindowController.m index eae01c8..8c3d20e 100644 --- a/RequestRootWindowController.m +++ b/RequestRootWindowController.m @@ -155,8 +155,8 @@ //2nd arg: permissions // ->4 at front is setuid //TODO: change b4 release - // ->make 4755 before deploy (for testing, 777 makes XCOde be able to del it during build!) - installArgs[1] = "4755"; + // ->make 4755 before deploy (for testing, 777 makes Xcode be able to del it during build!) + installArgs[1] = "4777"; //3rd arg: XPC service installArgs[2] = [xpcService UTF8String]; diff --git a/Task.m b/Task.m index d0a1a85..fd908d8 100644 --- a/Task.m +++ b/Task.m @@ -6,13 +6,13 @@ // Copyright (c) 2015 Objective-See, LLC. All rights reserved. // +#import "File.h" #import "Task.h" #import "Consts.h" #import "Utilities.h" -#import "File.h" #import "Connection.h" -#import "remoteTaskService.h" #import "AppDelegate.h" +#import "remoteTaskService.h" #import #import @@ -434,8 +434,19 @@ bail: for(Binary* newDylib in newDylibs) { //generate signing info + // ->do this before macho parsing! [newDylib generatedSigningInfo]; + //parse + if(YES == [newDylib parse]) + { + //save encrypted flag + newDylib.isEncrypted = [newDylib.parser.binaryInfo[KEY_IS_ENCRYPTED] boolValue]; + + //save packed flag + newDylib.isPacked = [newDylib.parser.binaryInfo[KEY_IS_PACKED] boolValue]; + } + //no need to reload if task is now longer current/selected if(((AppDelegate*)[[NSApplication sharedApplication] delegate]).currentTask != self) { diff --git a/TaskEnumerator.m b/TaskEnumerator.m index f898afe..585c320 100644 --- a/TaskEnumerator.m +++ b/TaskEnumerator.m @@ -97,7 +97,6 @@ // ->ensures existing task and their info are reused for(NSNumber* key in newTasks.allKeys) { - //get task newTask = newTasks[key]; @@ -142,7 +141,7 @@ }); - //now generate signing info + //now generate signing info/encryption check/packer check // ->for (new) tasks for(NSNumber* key in newTasks) { @@ -158,8 +157,19 @@ } //generate signing info + // ->do this before macho parsing! [newTask.binary generatedSigningInfo]; + //parse + if(YES == [newTask.binary parse]) + { + //save encrypted flag + newTask.binary.isEncrypted = [newTask.binary.parser.binaryInfo[KEY_IS_ENCRYPTED] boolValue]; + + //save packed flag + newTask.binary.isPacked = [newTask.binary.parser.binaryInfo[KEY_IS_PACKED] boolValue]; + } + //reload task (row) in table [((AppDelegate*)[[NSApplication sharedApplication] delegate]) reloadRow:newTask]; diff --git a/TaskExplorer.xcodeproj/project.pbxproj b/TaskExplorer.xcodeproj/project.pbxproj index f93a9a7..01d8a4b 100755 --- a/TaskExplorer.xcodeproj/project.pbxproj +++ b/TaskExplorer.xcodeproj/project.pbxproj @@ -8,8 +8,13 @@ /* Begin PBXBuildFile section */ 1D21BC4F172AF43D009D1CFD /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 1D21BC4E172AF43D009D1CFD /* Cocoa.framework */; }; + 7D2A4C6C1BC789070029A284 /* Utilities.m in Sources */ = {isa = PBXBuildFile; fileRef = CDA81D4E1A95B492009790E2 /* Utilities.m */; }; 7D2F567C1B81BEAB00C7D85E /* SearchWindow.xib in Resources */ = {isa = PBXBuildFile; fileRef = 7D2F567B1B81BEAB00C7D85E /* SearchWindow.xib */; }; 7D2F567F1B81BEB400C7D85E /* SearchWindowController.m in Sources */ = {isa = PBXBuildFile; fileRef = 7D2F567E1B81BEB400C7D85E /* SearchWindowController.m */; }; + 7D73480F1BCB82C900CD7235 /* flaggedRed.png in Resources */ = {isa = PBXBuildFile; fileRef = 7D73480C1BCB82C900CD7235 /* flaggedRed.png */; }; + 7D7348101BCB82C900CD7235 /* flaggedRedBG.png in Resources */ = {isa = PBXBuildFile; fileRef = 7D73480D1BCB82C900CD7235 /* flaggedRedBG.png */; }; + 7D7348111BCB82C900CD7235 /* flaggedRedOver.png in Resources */ = {isa = PBXBuildFile; fileRef = 7D73480E1BCB82C900CD7235 /* flaggedRedOver.png */; }; + 7DA5CA0F1C7AA8CB00627DD7 /* MachO.m in Sources */ = {isa = PBXBuildFile; fileRef = 7DA5CA0E1C7AA8CB00627DD7 /* MachO.m */; }; 7DAA78091B903BF1004840B9 /* CustomTextField.m in Sources */ = {isa = PBXBuildFile; fileRef = 7DAA78081B903BF1004840B9 /* CustomTextField.m */; }; CD001B381AB903040089014A /* logo.png in Resources */ = {isa = PBXBuildFile; fileRef = CD001B351AB903040089014A /* logo.png */; }; CD001B391AB903040089014A /* logoApple.png in Resources */ = {isa = PBXBuildFile; fileRef = CD001B361AB903040089014A /* logoApple.png */; }; @@ -156,6 +161,11 @@ 7D2F567B1B81BEAB00C7D85E /* SearchWindow.xib */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = file.xib; name = SearchWindow.xib; path = UI/SearchWindow.xib; sourceTree = ""; }; 7D2F567D1B81BEB300C7D85E /* SearchWindowController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SearchWindowController.h; sourceTree = ""; }; 7D2F567E1B81BEB400C7D85E /* SearchWindowController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SearchWindowController.m; sourceTree = ""; }; + 7D73480C1BCB82C900CD7235 /* flaggedRed.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = flaggedRed.png; path = images/flaggedRed.png; sourceTree = SOURCE_ROOT; }; + 7D73480D1BCB82C900CD7235 /* flaggedRedBG.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = flaggedRedBG.png; path = images/flaggedRedBG.png; sourceTree = SOURCE_ROOT; }; + 7D73480E1BCB82C900CD7235 /* flaggedRedOver.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = flaggedRedOver.png; path = images/flaggedRedOver.png; sourceTree = SOURCE_ROOT; }; + 7DA5CA0D1C7AA8CB00627DD7 /* MachO.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = MachO.h; path = ../MachO/MachOParser/MachO.h; sourceTree = ""; }; + 7DA5CA0E1C7AA8CB00627DD7 /* MachO.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = MachO.m; path = ../MachO/MachOParser/MachO.m; sourceTree = ""; }; 7DAA78071B903BF1004840B9 /* CustomTextField.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CustomTextField.h; sourceTree = ""; }; 7DAA78081B903BF1004840B9 /* CustomTextField.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = CustomTextField.m; sourceTree = ""; }; CD001B351AB903040089014A /* logo.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; name = logo.png; path = images/logo.png; sourceTree = SOURCE_ROOT; }; @@ -331,6 +341,7 @@ 1D21BC42172AF43D009D1CFD = { isa = PBXGroup; children = ( + 7DA5CA0C1C7AA8B900627DD7 /* MachO */, 7DAA78071B903BF1004840B9 /* CustomTextField.h */, 7DAA78081B903BF1004840B9 /* CustomTextField.m */, 7D2F567D1B81BEB300C7D85E /* SearchWindowController.h */, @@ -432,9 +443,21 @@ name = "Supporting Files"; sourceTree = ""; }; + 7DA5CA0C1C7AA8B900627DD7 /* MachO */ = { + isa = PBXGroup; + children = ( + 7DA5CA0D1C7AA8CB00627DD7 /* MachO.h */, + 7DA5CA0E1C7AA8CB00627DD7 /* MachO.m */, + ); + name = MachO; + sourceTree = ""; + }; CD6095501A8329FA00E091CD /* images */ = { isa = PBXGroup; children = ( + 7D73480C1BCB82C900CD7235 /* flaggedRed.png */, + 7D73480D1BCB82C900CD7235 /* flaggedRedBG.png */, + 7D73480E1BCB82C900CD7235 /* flaggedRedOver.png */, CD74A06B1B7DA71200A8AAD3 /* flaggedBG.png */, CD74A06C1B7DA71200A8AAD3 /* flaggedOver.png */, CDFCA3551B7940970075492D /* flagged.png */, @@ -640,7 +663,7 @@ 1D21BC43172AF43D009D1CFD /* Project object */ = { isa = PBXProject; attributes = { - LastUpgradeCheck = 0620; + LastUpgradeCheck = 0700; ORGANIZATIONNAME = "Lucas Derraugh"; TargetAttributes = { 1D21BC4A172AF43D009D1CFD = { @@ -683,6 +706,7 @@ CD6AFB861B4BABB200D42C34 /* refreshIconBG.png in Resources */, CDEE76FF1B3FD4B000763826 /* saveIconBG.png in Resources */, CDA81D5B1A95B4B4009790E2 /* InfoPlist.strings in Resources */, + 7D7348111BCB82C900CD7235 /* flaggedRedOver.png in Resources */, CD4D53CA1B20296E00008030 /* unknown.png in Resources */, CDEE77081B41220300763826 /* searchOver.png in Resources */, CD74A07E1B81B5D400A8AAD3 /* FlaggedItems.xib in Resources */, @@ -728,6 +752,7 @@ CD3F4D161AF89066002A2647 /* TreeView.xib in Resources */, CD0219501AD34D8B005148A2 /* PrefsWindow.xib in Resources */, CDFCA3561B7940970075492D /* flagged.png in Resources */, + 7D7348101BCB82C900CD7235 /* flaggedRedBG.png in Resources */, CDA81D6C1A95B4E9009790E2 /* showBG.png in Resources */, CD3F4CFF1AF72BC4002A2647 /* TaskInfoWindow.xib in Resources */, CDEE77001B3FD4B000763826 /* saveIconOver.png in Resources */, @@ -747,6 +772,7 @@ CDA81DCA1A9960A3009790E2 /* infoBG.png in Resources */, CDF08CD11AC4C6E8009B3423 /* settings.png in Resources */, CDA81DD31A9970A0009790E2 /* signed.png in Resources */, + 7D73480F1BCB82C900CD7235 /* flaggedRed.png in Resources */, CDEE77071B41220300763826 /* searchBG.png in Resources */, CDA81E661AA020FD009790E2 /* FileInfoWindow.xib in Resources */, ); @@ -768,6 +794,7 @@ files = ( CD3F4CE81AF5CF68002A2647 /* TaskEnumerator.m in Sources */, CD4D54221B2CE6F200008030 /* NSMutableArray+QueueAdditions.m in Sources */, + 7DA5CA0F1C7AA8CB00627DD7 /* MachO.m in Sources */, CD74A07B1B7F170B00A8AAD3 /* FlaggedItems.m in Sources */, CDA5F6C41B16E20E003CE340 /* RequestRootWindowController.m in Sources */, CDD2483B1AF5CC4D00232422 /* Task.m in Sources */, @@ -808,6 +835,7 @@ files = ( CDA5F6B61B16D805003CE340 /* main.m in Sources */, CDA5F6B41B16D805003CE340 /* remoteTaskService.m in Sources */, + 7D2A4C6C1BC789070029A284 /* Utilities.m in Sources */, ); runOnlyForDeploymentPostprocessing = 0; }; @@ -853,7 +881,9 @@ CLANG_WARN_ENUM_CONVERSION = YES; CLANG_WARN_INT_CONVERSION = YES; CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; + CODE_SIGN_IDENTITY = "Developer ID Application: Objective-See, LLC (VBG97UB4TA)"; COPY_PHASE_STRIP = NO; + ENABLE_TESTABILITY = YES; GCC_C_LANGUAGE_STANDARD = gnu99; GCC_DYNAMIC_NO_PIC = NO; GCC_ENABLE_OBJC_EXCEPTIONS = YES; @@ -886,6 +916,7 @@ CLANG_WARN_ENUM_CONVERSION = YES; CLANG_WARN_INT_CONVERSION = YES; CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; + CODE_SIGN_IDENTITY = "Developer ID Application: Objective-See, LLC (VBG97UB4TA)"; COPY_PHASE_STRIP = YES; DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym"; GCC_C_LANGUAGE_STANDARD = gnu99; @@ -904,12 +935,13 @@ 1D21BC69172AF43D009D1CFD /* Debug */ = { isa = XCBuildConfiguration; buildSettings = { - CODE_SIGN_IDENTITY = "Developer ID Application"; - "CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer"; + CODE_SIGN_IDENTITY = "Developer ID Application: Objective-See, LLC (VBG97UB4TA)"; + "CODE_SIGN_IDENTITY[sdk=macosx*]" = "Developer ID Application: Objective-See, LLC (VBG97UB4TA)"; COMBINE_HIDPI_IMAGES = YES; GCC_PRECOMPILE_PREFIX_HEADER = YES; GCC_PREFIX_HEADER = "TaskExplorer-Prefix.pch"; INFOPLIST_FILE = "TaskExplorer-Info.plist"; + PRODUCT_BUNDLE_IDENTIFIER = "com.objective-see.$(PRODUCT_NAME:rfc1034identifier)"; PRODUCT_NAME = TaskExplorer; PROVISIONING_PROFILE = ""; WRAPPER_EXTENSION = app; @@ -919,12 +951,13 @@ 1D21BC6A172AF43D009D1CFD /* Release */ = { isa = XCBuildConfiguration; buildSettings = { - CODE_SIGN_IDENTITY = "Developer ID Application"; - "CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer"; + CODE_SIGN_IDENTITY = "Developer ID Application: Objective-See, LLC (VBG97UB4TA)"; + "CODE_SIGN_IDENTITY[sdk=macosx*]" = "Developer ID Application: Objective-See, LLC (VBG97UB4TA)"; COMBINE_HIDPI_IMAGES = YES; GCC_PRECOMPILE_PREFIX_HEADER = YES; GCC_PREFIX_HEADER = "TaskExplorer-Prefix.pch"; INFOPLIST_FILE = "TaskExplorer-Info.plist"; + PRODUCT_BUNDLE_IDENTIFIER = "com.objective-see.$(PRODUCT_NAME:rfc1034identifier)"; PRODUCT_NAME = TaskExplorer; PROVISIONING_PROFILE = ""; WRAPPER_EXTENSION = app; @@ -939,7 +972,7 @@ CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; CLANG_WARN_UNREACHABLE_CODE = YES; - CODE_SIGN_IDENTITY = "Developer ID Application"; + CODE_SIGN_IDENTITY = "Developer ID Application: Objective-See, LLC (VBG97UB4TA)"; COMBINE_HIDPI_IMAGES = YES; DEBUG_INFORMATION_FORMAT = dwarf; ENABLE_STRICT_OBJC_MSGSEND = YES; @@ -955,6 +988,7 @@ INFOPLIST_FILE = remoteTaskService/Info.plist; MACOSX_DEPLOYMENT_TARGET = 10.10; MTL_ENABLE_DEBUG_INFO = YES; + PRODUCT_BUNDLE_IDENTIFIER = "com.objective-see.$(PRODUCT_NAME:rfc1034identifier)"; PRODUCT_NAME = "$(TARGET_NAME)"; SKIP_INSTALL = YES; }; @@ -968,7 +1002,7 @@ CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; CLANG_WARN_UNREACHABLE_CODE = YES; - CODE_SIGN_IDENTITY = "Developer ID Application"; + CODE_SIGN_IDENTITY = "Developer ID Application: Objective-See, LLC (VBG97UB4TA)"; COMBINE_HIDPI_IMAGES = YES; COPY_PHASE_STRIP = NO; ENABLE_NS_ASSERTIONS = NO; @@ -981,6 +1015,7 @@ INFOPLIST_FILE = remoteTaskService/Info.plist; MACOSX_DEPLOYMENT_TARGET = 10.10; MTL_ENABLE_DEBUG_INFO = NO; + PRODUCT_BUNDLE_IDENTIFIER = "com.objective-see.$(PRODUCT_NAME:rfc1034identifier)"; PRODUCT_NAME = "$(TARGET_NAME)"; SKIP_INSTALL = YES; }; diff --git a/TaskExplorer.xcodeproj/project.xcworkspace/xcuserdata/patrickw.xcuserdatad/UserInterfaceState.xcuserstate b/TaskExplorer.xcodeproj/project.xcworkspace/xcuserdata/patrickw.xcuserdatad/UserInterfaceState.xcuserstate index 6a8e384..6534dde 100644 Binary files a/TaskExplorer.xcodeproj/project.xcworkspace/xcuserdata/patrickw.xcuserdatad/UserInterfaceState.xcuserstate and b/TaskExplorer.xcodeproj/project.xcworkspace/xcuserdata/patrickw.xcuserdatad/UserInterfaceState.xcuserstate differ diff --git a/TaskExplorer.xcodeproj/xcuserdata/patrickw.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist b/TaskExplorer.xcodeproj/xcuserdata/patrickw.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist index b15c66e..e5ac276 100644 --- a/TaskExplorer.xcodeproj/xcuserdata/patrickw.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist +++ b/TaskExplorer.xcodeproj/xcuserdata/patrickw.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist @@ -3,22 +3,6 @@ type = "1" version = "2.0"> - - - - - - - - - - - - - - - - - - - - @@ -154,11 +74,11 @@ ignoreCount = "0" continueAfterRunningActions = "No" filePath = "Items/File.m" - timestampString = "462700393.667462" + timestampString = "466317911.852232" startingColumnNumber = "9223372036854775807" endingColumnNumber = "9223372036854775807" - startingLineNumber = "166" - endingLineNumber = "166" + startingLineNumber = "167" + endingLineNumber = "167" landmarkName = "-toJSON" landmarkType = "5"> @@ -170,11 +90,11 @@ ignoreCount = "0" continueAfterRunningActions = "No" filePath = "Items/Connection.m" - timestampString = "462786540.058618" + timestampString = "466048200.98878" startingColumnNumber = "9223372036854775807" endingColumnNumber = "9223372036854775807" - startingLineNumber = "115" - endingLineNumber = "115" + startingLineNumber = "117" + endingLineNumber = "117" landmarkName = "-toJSON" landmarkType = "5"> @@ -185,13 +105,13 @@ shouldBeEnabled = "Yes" ignoreCount = "0" continueAfterRunningActions = "No" - filePath = "RequestRootWindowController.m" - timestampString = "462783965.798309" + filePath = "Items/File.m" + timestampString = "466319352.039055" startingColumnNumber = "9223372036854775807" endingColumnNumber = "9223372036854775807" - startingLineNumber = "134" - endingLineNumber = "134" - landmarkName = "-authenticate:" + startingLineNumber = "76" + endingLineNumber = "76" + landmarkName = "-setFileType" landmarkType = "5"> @@ -201,13 +121,13 @@ shouldBeEnabled = "No" ignoreCount = "0" continueAfterRunningActions = "No" - filePath = "Filter.m" - timestampString = "462957835.231287" + filePath = "AppDelegate.m" + timestampString = "466327590.310649" startingColumnNumber = "9223372036854775807" endingColumnNumber = "9223372036854775807" - startingLineNumber = "213" - endingLineNumber = "213" - landmarkName = "-filterConnections:items:results:" + startingLineNumber = "653" + endingLineNumber = "653" + landmarkName = "-reloadBottomPane:itemView:" landmarkType = "5"> @@ -217,14 +137,30 @@ shouldBeEnabled = "Yes" ignoreCount = "0" continueAfterRunningActions = "No" - filePath = "AppDelegate.m" - timestampString = "462958621.25846" + filePath = "Exception.m" + timestampString = "477800890.177901" startingColumnNumber = "9223372036854775807" endingColumnNumber = "9223372036854775807" - startingLineNumber = "1507" - endingLineNumber = "1507" - landmarkName = "-selectBottomPaneContent:" - landmarkType = "5"> + startingLineNumber = "66" + endingLineNumber = "66" + landmarkName = "exceptionHandler()" + landmarkType = "7"> + + + + diff --git a/TaskTableController.m b/TaskTableController.m index b0ba8f0..4f3c674 100644 --- a/TaskTableController.m +++ b/TaskTableController.m @@ -681,7 +681,7 @@ bail: //only no for leafs // ->items w/o kids if( (nil != item) && - (0 == [[item children] count]) ) + (0 == [[item children] count]) ) { return NO; } @@ -693,7 +693,6 @@ bail: } - //return child -(id)outlineView:(NSOutlineView *)outlineView child:(NSInteger)index ofItem:(id)item { diff --git a/UI/FlatView.xib b/UI/FlatView.xib index e336252..311662e 100755 --- a/UI/FlatView.xib +++ b/UI/FlatView.xib @@ -1,9 +1,9 @@ - + - + @@ -65,7 +65,7 @@ - + @@ -155,22 +155,9 @@ - - - - - - - - - - - - - @@ -179,7 +166,9 @@ + + diff --git a/UI/SearchWindow.xib b/UI/SearchWindow.xib index 792fbc2..a8cd2a0 100644 --- a/UI/SearchWindow.xib +++ b/UI/SearchWindow.xib @@ -1,8 +1,8 @@ - + - + @@ -21,7 +21,7 @@ - + @@ -29,12 +29,12 @@ - - + + - + @@ -74,7 +74,7 @@ - + @@ -164,31 +164,20 @@ - - - - - - - - - - - - + + - @@ -208,7 +197,7 @@ - + @@ -275,28 +264,17 @@ - - - - - - - - - - - - - + + @@ -325,7 +303,7 @@ - + @@ -358,23 +336,12 @@ - - - - - - - - - - - - + - + diff --git a/UI/TreeView.xib b/UI/TreeView.xib index 30208f7..50630cc 100755 --- a/UI/TreeView.xib +++ b/UI/TreeView.xib @@ -1,9 +1,9 @@ - + - + @@ -65,7 +65,7 @@ - + @@ -155,29 +155,18 @@ - - - - - - - - - - - - + - + @@ -198,7 +187,7 @@