objective-see/TaskExplorer
1
0
Fork 0
mirror of https://github.com/objective-see/TaskExplorer.git synced 2026-03-22 07:02:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

support for displaying & filtering packed files

Browse Source 
support for displaying & filtering  encrypted files
support for enumerating dylibs in 32bit processes
UI improvements (main text in cells is single, albeit attributed string)
This commit is contained in:
Patrick Wardle
2016-02-21 19:36:37 -10:00
parent ca1579d883
commit f8cd92239d
21 changed files with 527 additions and 353 deletions
Download Patch File Download Diff File Expand all files Collapse all files
remoteTaskService/remoteTaskService.m
+16 -4
View File
@@ -354,17 +354,29 @@ bail:
dylibs = [NSMutableArray array];
//vmmap can't directly handle 32bit procs
// ->so exec via 'arch -i386 vmmap <32bit pid>' ...though El Capitan doesn't have i386 version :/
// ->so either exec 'vmmap32' or on older OSs, exec via 'arch -i386 vmmap <32bit pid>'
if(YES == Is32Bit(pid.unsignedIntValue))
{
//exec 'file' to get file type
results = [[NSString alloc] initWithData:execTask(ARCH, @[@"-i386", VMMAP, [pid stringValue]]) encoding:NSUTF8StringEncoding];
//when system has 32bit version of vmmap ('vmmap32')
// ->use that
if(YES == [[NSFileManager defaultManager] fileExistsAtPath:VMMAP_32])
{
//exec vmmap32
results = [[NSString alloc] initWithData:execTask(VMMAP_32, @[@"-w", [pid stringValue]]) encoding:NSUTF8StringEncoding];
}
//otherwise
// ->assume vmmap is 'fat', and exec 32bit version (pre El Capitan)
else
{
//exec 'file' to get file type
results = [[NSString alloc] initWithData:execTask(ARCH, @[@"-i386", VMMAP, [pid stringValue]]) encoding:NSUTF8StringEncoding];
}
}
//for 64bit procs
// ->just exec vmmap directly
else
{
//exec 'file' to get file type
//exec vmmap
results = [[NSString alloc] initWithData:execTask(VMMAP, @[@"-w", [pid stringValue]]) encoding:NSUTF8StringEncoding];
}