search

BonzaiThePenguin / Loading

Simple network activity monitor for macOS
BSD 2-Clause "Simplified" License
609 stars 32 forks source link

Show consumed traffic amount? #7

Open delebedev opened 9 years ago

delebedev commented 9 years ago

It would be really lovely to see amount of traffic for each app, or is it out of scope for Loading?

BonzaiThePenguin commented 9 years ago

Right now it's definitely outside the scope of the project, but at some point I agree it would be nice to have that information in there somewhere.

ricardopereira commented 9 years ago

+1

matiassingers commented 9 years ago

:+1:

BonzaiThePenguin commented 9 years ago

:)

dbkaplun commented 9 years ago

I'm looking to implement similar functionality in a different project. Can you point me to resources regarding NetworkStatistics, reverse engineering advice, etc? Thanks in advance!

BonzaiThePenguin commented 9 years ago

NetworkStatistics is completely undocumented, but I used Hopper Disassembler and a ton of trial and error to find the right framework and function calls that I needed. Hopper can give you the function definition to a point, but it will say things like int when it's actually a Core Foundation class. For return types of int I think I called CFStringRef CFCopyDescription(CFTypeRef cf ) on them, at which point it would either crash (which tells me it's not a Core Foundation object) or it'd return something like "CFDictionary" which is even more helpful. I'd then use Hopper to find things that looked like constant declarations (_kNStatSrcKeyRxPackets), then I'd pass all of them in as keys into the dictionary to see what values they returned, if any.

BonzaiThePenguin commented 9 years ago

Inspecting the disassembled code for each function usually gives hints for what the parameters are supposed to be, like NStatManagerCreate has a line that copies a block so one of the arguments is probably a block, it uses dispatch queues so another argument is probably a queue, it uses the Core Foundation allocator so it probably needs a kCFAllocatorDefault argument, and so on.

For reverse-engineering data formats, you usually just use the app that generates the data to make known changes, then inspect the data in a hex editor and see what changed. If you change the rating for a song in iTunes from one star to two stars and one of the bytes in the file changes from 51 to 102, the rating is probably stored in that byte as rating * 51.