support for displaying & filtering packed files

support for displaying & filtering  encrypted files
support for enumerating dylibs in 32bit processes
UI improvements (main text in cells is single, albeit attributed string)

remoteTaskService/main.m

@@ -6,14 +6,13 @@
 //  Copyright (c) 2015 Objective-See, LLC. All rights reserved.
 //
 
-#import <Foundation/Foundation.h>
-#import "remoteTaskService.h"
 #import "serviceInterface.h"
+#import "remoteTaskService.h"
 
 #import <syslog.h>
 #import <libproc.h>
 #import <sys/proc_info.h>
-
+#import <Foundation/Foundation.h>
 
 //interface for 'extension' to NSXPCConnection
 // ->allows us to access the 'private' auditToken iVar
@@ -39,8 +38,7 @@
 //function def
 OSStatus SecTaskValidateForRequirement(SecTaskRef task, CFStringRef requirement);
 
-//TODO: CHANGE B4 RELEASE!!
-//-> for testing: @"Mac Developer: patrick wardle (5SKKU32KLJ)"
+//signing auth
 #define SIGNING_AUTH @"Developer ID Application: Objective-See, LLC (VBG97UB4TA)"
 
 //skeleton interface
@@ -103,6 +101,8 @@ bail:
 
 @end
 
+//TODO: add exception handling!!!!
+
 int main(int argc, const char *argv[])
 {
     //make really r00t

remoteTaskService/remoteTaskService.m

@@ -354,17 +354,29 @@ bail:
     dylibs = [NSMutableArray array];
     
     //vmmap can't directly handle 32bit procs
-    // ->so exec via 'arch -i386 vmmap <32bit pid>' ...though El Capitan doesn't have i386 version :/
+    // ->so either exec 'vmmap32' or on older OSs, exec via 'arch -i386 vmmap <32bit pid>'
     if(YES == Is32Bit(pid.unsignedIntValue))
     {
-        //exec 'file' to get file type
-        results = [[NSString alloc] initWithData:execTask(ARCH, @[@"-i386", VMMAP, [pid stringValue]]) encoding:NSUTF8StringEncoding];
+        //when system has 32bit version of vmmap ('vmmap32')
+        // ->use that
+        if(YES == [[NSFileManager defaultManager] fileExistsAtPath:VMMAP_32])
+        {
+            //exec vmmap32
+            results = [[NSString alloc] initWithData:execTask(VMMAP_32, @[@"-w", [pid stringValue]]) encoding:NSUTF8StringEncoding];
+        }
+        //otherwise
+        // ->assume vmmap is 'fat', and exec 32bit version (pre El Capitan)
+        else
+        {
+            //exec 'file' to get file type
+            results = [[NSString alloc] initWithData:execTask(ARCH, @[@"-i386", VMMAP, [pid stringValue]]) encoding:NSUTF8StringEncoding];
+        }
     }
     //for 64bit procs
     // ->just exec vmmap directly
     else
     {
-        //exec 'file' to get file type
+        //exec vmmap
         results = [[NSString alloc] initWithData:execTask(VMMAP, @[@"-w", [pid stringValue]]) encoding:NSUTF8StringEncoding];
     }