Skip to content

Make -filter argument take a regex #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jevinskie wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Make -filter argument take a regex #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ca2c85e
Automatic signing for ME and Obj-C modernization
jevinskie Oct 14, 2023
79e98de
Make -filter take a regex (much more useful). Modernize Obj-C.
jevinskie Oct 20, 2023
f0f3f3e
wtf was this?
jevinskie Feb 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 19 additions & 12 deletions App/ProcessMonitor.xcodeproj/project.pbxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
archiveVersion = 1;
classes = {
};
objectVersion = 50;
objectVersion = 54;
objects = {

/* Begin PBXBuildFile section */
Expand Down Expand Up @@ -113,7 +113,8 @@
CD38A8352358B410004EBB67 /* Project object */ = {
isa = PBXProject;
attributes = {
LastUpgradeCheck = 1220;
BuildIndependentTargetsInParallel = YES;
LastUpgradeCheck = 1500;
ORGANIZATIONNAME = "Patrick Wardle";
TargetAttributes = {
CD38A83C2358B410004EBB67 = {
Expand Down Expand Up @@ -198,9 +199,11 @@
CLANG_WARN_UNREACHABLE_CODE = YES;
CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
COPY_PHASE_STRIP = NO;
DEAD_CODE_STRIPPING = YES;
DEBUG_INFORMATION_FORMAT = dwarf;
ENABLE_STRICT_OBJC_MSGSEND = YES;
ENABLE_TESTABILITY = YES;
ENABLE_USER_SCRIPT_SANDBOXING = YES;
GCC_C_LANGUAGE_STANDARD = gnu11;
GCC_DYNAMIC_NO_PIC = NO;
GCC_NO_COMMON_BLOCKS = YES;
Expand Down Expand Up @@ -257,9 +260,11 @@
CLANG_WARN_UNREACHABLE_CODE = YES;
CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
COPY_PHASE_STRIP = NO;
DEAD_CODE_STRIPPING = YES;
DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
ENABLE_NS_ASSERTIONS = NO;
ENABLE_STRICT_OBJC_MSGSEND = YES;
ENABLE_USER_SCRIPT_SANDBOXING = YES;
GCC_C_LANGUAGE_STANDARD = gnu11;
GCC_NO_COMMON_BLOCKS = YES;
GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
Expand All @@ -281,11 +286,12 @@
buildSettings = {
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
CODE_SIGN_ENTITLEMENTS = ProcessMonitor/ProcessMonitor.entitlements;
CODE_SIGN_IDENTITY = "Developer ID Application";
CODE_SIGN_STYLE = Manual;
CODE_SIGN_IDENTITY = "Apple Development";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 1.5.0;
DEVELOPMENT_TEAM = VBG97UB4TA;
DEAD_CODE_STRIPPING = YES;
DEVELOPMENT_TEAM = ZK96P738ZR;
ENABLE_HARDENED_RUNTIME = YES;
HEADER_SEARCH_PATHS = ../Library/Release;
INFOPLIST_FILE = ProcessMonitor/Info.plist;
Expand All @@ -295,9 +301,9 @@
);
LIBRARY_SEARCH_PATHS = ../Library/Release;
MARKETING_VERSION = 1.5.0;
PRODUCT_BUNDLE_IDENTIFIER = "com.objective-see.processmonitor";
PRODUCT_BUNDLE_IDENTIFIER = "vin.je.com.objective-see.processmonitor";
PRODUCT_NAME = "$(TARGET_NAME)";
PROVISIONING_PROFILE_SPECIFIER = "Process Monitor";
PROVISIONING_PROFILE_SPECIFIER = "";
};
name = Debug;
};
Expand All @@ -306,11 +312,12 @@
buildSettings = {
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
CODE_SIGN_ENTITLEMENTS = ProcessMonitor/ProcessMonitor.entitlements;
CODE_SIGN_IDENTITY = "Developer ID Application";
CODE_SIGN_STYLE = Manual;
CODE_SIGN_IDENTITY = "Apple Development";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 1.5.0;
DEVELOPMENT_TEAM = VBG97UB4TA;
DEAD_CODE_STRIPPING = YES;
DEVELOPMENT_TEAM = ZK96P738ZR;
ENABLE_HARDENED_RUNTIME = YES;
HEADER_SEARCH_PATHS = ../Library/Release;
INFOPLIST_FILE = ProcessMonitor/Info.plist;
Expand All @@ -320,9 +327,9 @@
);
LIBRARY_SEARCH_PATHS = ../Library/Release;
MARKETING_VERSION = 1.5.0;
PRODUCT_BUNDLE_IDENTIFIER = "com.objective-see.processmonitor";
PRODUCT_BUNDLE_IDENTIFIER = "vin.je.com.objective-see.processmonitor";
PRODUCT_NAME = "$(TARGET_NAME)";
PROVISIONING_PROFILE_SPECIFIER = "Process Monitor";
PROVISIONING_PROFILE_SPECIFIER = "";
};
name = Release;
};
Expand Down
4 changes: 2 additions & 2 deletions App/ProcessMonitor.xcodeproj/xcshareddata/xcschemes/ProcessMonitor.xcscheme
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1220"
LastUpgradeVersion = "1500"
version = "1.3">
<BuildAction
parallelizeBuildables = "YES"
Expand Down Expand Up @@ -31,7 +31,7 @@
</Testables>
</TestAction>
<LaunchAction
buildConfiguration = "Debug"
buildConfiguration = "Release"
selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
debugAsWhichUser = "root"
Expand Down
4 changes: 2 additions & 2 deletions App/ProcessMonitor/main.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@
//'skipAPple' flag
BOOL skipApple = NO;

//filter string
NSString* filterBy = nil;
//filter regex
NSRegularExpression *filterByRegex = nil;

//'prettyPrint' flag
BOOL prettyPrint = NO;
Expand Down
51 changes: 27 additions & 24 deletions App/ProcessMonitor/main.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ int main(int argc, const char * argv[]) {
NSArray* arguments = nil;

//grab args
arguments = [[NSProcessInfo processInfo] arguments];
arguments = [NSProcessInfo processInfo].arguments;

//run via user (app)?
// display error popup
Expand Down Expand Up @@ -63,7 +63,7 @@ int main(int argc, const char * argv[]) {

//run loop
// as don't want to exit
[[NSRunLoop currentRunLoop] run];
[NSRunLoop.currentRunLoop run];

} //pool

Expand Down Expand Up @@ -98,7 +98,7 @@ BOOL processArgs(NSArray* arguments)
index++;

//sanity check
// make sure name comes after
// make sure name regex comes after
if(index >= arguments.count)
{
//invalid
Expand All @@ -108,8 +108,17 @@ BOOL processArgs(NSArray* arguments)
goto bail;
}

//grab filter name
filterBy = [arguments objectAtIndex:index];
//grab filter name regex
NSError *regex_error = nil;
filterByRegex = [NSRegularExpression regularExpressionWithPattern:arguments[index] options:0 error:&regex_error];
if (!filterByRegex || regex_error) {
printf("%s", [NSString stringWithFormat:@"Error creating regex: %@\n", regex_error.localizedDescription].UTF8String);
//invalid
validArgs = NO;

//bail
goto bail;
}
}

bail:
Expand All @@ -118,39 +127,33 @@ BOOL processArgs(NSArray* arguments)
}

//print usage
void usage()
void usage(void)
{
//name
NSString* name = nil;
NSString* name = NSBundle.mainBundle.infoDictionary[@"CFBundleName"];

//version
NSString* version = nil;

//extract name
name = [[[NSBundle mainBundle] infoDictionary] objectForKey:@"CFBundleName"];

//extract version
version = [[[NSBundle mainBundle] infoDictionary] objectForKey:@"CFBundleVersion"];
NSString* version = NSBundle.mainBundle.infoDictionary[@"CFBundleVersion"];

//usage
printf("\n%s (v%s) usage:\n", name.UTF8String, version.UTF8String);
printf(" -h or -help display this usage info\n");
printf(" -pretty JSON output is 'pretty-printed'\n");
printf(" -skipApple ignore Apple (platform) processes \n");
printf(" -parseEnv parse environment variable information\n");
printf(" -filter <name> show events matching process name\n\n");
printf(" -h or -help display this usage info\n");
printf(" -pretty JSON output is 'pretty-printed'\n");
printf(" -skipApple ignore Apple (platform) processes \n");
printf(" -parseEnv parse environment variable information\n");
printf(" -filter <name regex> show events matching process name\n\n");

return;
}

//monitor
BOOL monitor()
BOOL monitor(void)
{
//(process) events of interest
es_event_type_t events[] = {ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_FORK, ES_EVENT_TYPE_NOTIFY_EXIT};

//init monitor
ProcessMonitor* procMon = [[ProcessMonitor alloc] init];
ProcessMonitor* procMon = ProcessMonitor.new;

//define block
// automatically invoked upon process events
Expand All @@ -170,10 +173,10 @@ BOOL monitor()

//filter
// and no match? skip
if(0 != filterBy.length)
if(nil != filterByRegex)
{
//check file paths & process
if(YES != [process.path hasSuffix:filterBy])
if(0 == [filterByRegex numberOfMatchesInString:process.path options:0 range:NSMakeRange(0, process.path.length)])
{
//ignore
return;
Expand Down Expand Up @@ -248,7 +251,7 @@ BOOL monitor()

//convert to string
// note, we manually unescape forward slashes
prettyString = [[[NSString alloc] initWithData:prettyData encoding:NSUTF8StringEncoding] stringByReplacingOccurrencesOfString:@"\\/" withString:@"/"];
prettyString = [[NSString.alloc initWithData:prettyData encoding:NSUTF8StringEncoding] stringByReplacingOccurrencesOfString:@"\\/" withString:@"/"];

bail:

Expand Down
13 changes: 8 additions & 5 deletions Library/Release/ProcessMonitor.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ enum csOptions{csNone, csStatic, csDynamic};
enum Signer{None, Apple, AppStore, DevID, AdHoc};

//architectures
enum Architectures{ArchUnknown, ArchAppleSilicon, ArchIntel};
enum Architectures{ArchUnknown, ArchFail1, ArchFail2, ArchFail3, ArchAppleSilicon, ArchIntel};

//cs options
#define CS_STATIC_CHECK YES
Expand All @@ -41,11 +41,11 @@ typedef void (^ProcessCallbackBlock)(Process* _Nonnull);
@interface ProcessMonitor : NSObject

//start monitoring
// pass in events of interest, count of said events, flag for codesigning, and callback
-(BOOL)start:(es_event_type_t* _Nonnull)events count:(uint32_t)count csOption:(NSUInteger)csOption callback:(ProcessCallbackBlock _Nonnull)callback;
// pass in events of interest, count of said events, flag for codesigning, flag for environment variable collection, and callback
-(BOOL)start:(es_event_type_t* _Nonnull)events count:(uint32_t)count csOption:(NSUInteger)csOption parseEnv:(BOOL)parseEnv callback:(ProcessCallbackBlock _Nonnull)callback;

//stop monitoring
-(BOOL)stop;
@property (NS_NONATOMIC_IOSONLY, readonly) BOOL stop;

@end

Expand Down Expand Up @@ -89,6 +89,9 @@ typedef void (^ProcessCallbackBlock)(Process* _Nonnull);
//args
@property(nonatomic, retain)NSMutableArray* _Nonnull arguments;

//environment variables
@property(nonatomic, retain)NSMutableDictionary* _Nullable environment;

//ancestors
@property(nonatomic, retain)NSMutableArray* _Nonnull ancestors;

Expand Down Expand Up @@ -118,6 +121,6 @@ typedef void (^ProcessCallbackBlock)(Process* _Nonnull);

//init
// flag controls code signing options
-(id _Nullable)init:(es_message_t* _Nonnull)message csOption:(NSUInteger)csOption;
-(instancetype _Nullable)init:(es_message_t* _Nonnull)message csOption:(NSUInteger)csOption parseEnv:(BOOL)parseEnv;

@end
Binary file modified Library/Release/libProcessMonitor.a
View file
Open in desktop
Copy link

@keith keith Feb 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

accidentally checked in binary

Binary file not shown.
Loading