search

objective-see / OverSight

OverSight monitors a mac's mic and webcam, alerting the user when the internal mic is activated, or whenever a process accesses the webcam.
GNU General Public License v3.0
490 stars 38 forks source link

V. 2.0 issues #12

Open webdesignweisshart opened 3 years ago

webdesignweisshart commented 3 years ago
  1. The camera does not seem to be monitored at all. Tested with FaceTime, WhatsApp and Google Chrome version. 90.0.
  2. The microphone is only detected on the second access. Sometimes also when it is deactivated, but never on the first access.

MacOS BigSur 11.3

objective-see commented 3 years ago

Strange! Hrmmm,

Can you:

  1. Run log stream --level debug --predicate="subsystem='com.objective-see.oversight'" from the Terminal
  2. (re)start OverSight (select quit from its Status Bar menu, then just relaunch it from /Applications).
  3. Post any output here (or email to bugs@objective-see.com).

Other thoughts

  1. Is Do Not Disturb mode on?
  2. Are you using an external mic or camera?

Thanks

webdesignweisshart commented 3 years ago

Do not disturb mode = off mic and cam onboard Macbook Pro

Log: (hope it helps) Last login: Wed May 12 15:17:20 on console xxxx ~ % log stream --level debug --predicate="subsystem='com.objective-see.oversight'" Filtering the log data using "subsystem == "com.objective-see.oversight"" Timestamp Thread Type Activity PID TTL
2021-05-12 17:15:40.337073+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] started: /Applications/OverSight.app/Contents/MacOS/OverSight (pid: 6278 / uid: 501) 2021-05-12 17:15:40.337597+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] arguments: ( "/Applications/OverSight.app/Contents/MacOS/OverSight" ) 2021-05-12 17:15:40.439052+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] checking if any camera is active 2021-05-12 17:15:40.460548+0200 0x1a201 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] permission to display notifications granted? 1 (error: (null)) 2021-05-12 17:15:40.510471+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] device: Apple Inc./FaceTime HD Camera 2021-05-12 17:15:40.510622+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] isRunning: 0 2021-05-12 17:15:40.511578+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] (real) parent: 2021-05-12 17:15:40.640154+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] setting state to: enabled 2021-05-12 17:15:40.640968+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] starting AV monitoring 2021-05-12 17:15:40.641009+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] CPU architecuture: Intel ...will leverage 'VDCAssistant' 2021-05-12 17:15:40.641264+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] starting audio monitor 2021-05-12 17:15:40.643840+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] device: Existential Audio Inc./BlackHole 2ch 2021-05-12 17:15:40.643888+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] device: Apple Inc./Built-in Microphone 2021-05-12 17:15:40.644023+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] monitoring 54 for audio changes 2021-05-12 17:15:46.993491+0200 0x1a1e3 Debug 0x196d8 6278 0 OverSight: [com.objective-see.oversight:application] setting app's activation policy 2021-05-12 17:15:46.993646+0200 0x1a1e3 Debug 0x196d8 6278 0 OverSight: [com.objective-see.oversight:application] windows: 2021-05-12 17:15:46.993703+0200 0x1a1e3 Debug 0x196d8 6278 0 OverSight: [com.objective-see.oversight:application] window(s) not visible, setting policy: NSApplicationActivationPolicyAccessory 2021-05-12 17:16:11.311050+0200 0x1a3c8 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] checking for update 2021-05-12 17:16:11.888828+0200 0x1a3c8 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] latest version: 1.0.0 2021-05-12 17:16:11.888909+0200 0x1a1e3 Debug 0x0 6278 0 OverSight: [com.objective-see.oversight:application] no updates available

objective-see commented 3 years ago

Thanks! So far, that looks ok ....

If you launch an app that leverages the mic, or camera (say PhotoBooth), what does that show in the log?

Thanks again!

webdesignweisshart commented 3 years ago

First: mic Filtering the log data using "subsystem == "com.objective-see.oversight"" Timestamp Thread Type Activity PID TTL
2021-05-12 17:26:29.256961+0200 0x1c6e8 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] new tcc access msg: SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=210.5, function=TCCAccessRequest, service=kTCCServiceMicrophone, target_token={pid:474, auid:501, euid:501}, 2021-05-12 17:26:29.257658+0200 0x1c6e8 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] new (audio) client: CLIENT: pid: 474, path: /System/Library/PrivateFrameworks/CoreSpeech.framework/corespeechd, clientID: (null) 2021-05-12 17:26:29.258169+0200 0x1c6e8 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] new client tccd response : RECV: synchronous reply <dictionary: 0x7f97c2359d60> { count = 4, transaction: 0, voucher = 0x0, contents = "auth_value" => <uint64: 0xf1b75e1324bfd381>: 2 "result" => <bool: 0x7fff871fb0a0>: true "auth_version" => <uint64: 0xf1b75e1324bfe381>: 1 "auth_reason" => <uint64: 0xf1b75e1324bf4381>: 11 } 2021-05-12 17:26:29.806948+0200 0x1bd57 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] checking if built-in mic is active 2021-05-12 17:26:29.807084+0200 0x1bd57 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] device: Existential Audio Inc./BlackHole 2ch 2021-05-12 17:26:29.807123+0200 0x1bd57 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] device: Apple Inc./Built-in Microphone 2021-05-12 17:26:29.807436+0200 0x1bd57 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] mic is not on... 2021-05-12 17:26:29.867104+0200 0x1bd57 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] built in mic changed state to 1 2021-05-12 17:26:35.364664+0200 0x1bd57 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] built in mic changed state to 0 2021-05-12 17:26:35.364740+0200 0x1bd57 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] built in mic turned to off 2021-05-12 17:26:35.364778+0200 0x1bd57 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] removed all (audio) clients 2021-05-12 17:26:35.364823+0200 0x1bd57 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] ignoring mic event, as it was a 2x off

webdesignweisshart commented 3 years ago

PhotoBooth: Filtering the log data using "subsystem == "com.objective-see.oversight"" Timestamp Thread Type Activity PID TTL
2021-05-12 17:29:29.654239+0200 0x1d429 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] new client msg: Client Connect for PID 6582 2021-05-12 17:29:29.654772+0200 0x1d429 Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] new (video) client: CLIENT: pid: 6582, path: /System/Applications/Photo Booth.app/Contents/MacOS/Photo Booth, clientID: (null) 2021-05-12 17:29:40.053920+0200 0x1d81f Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] dead client msg: ClientDied 21047 [PID: 6582] 2021-05-12 17:29:40.053994+0200 0x1d81f Debug 0x0 6450 0 OverSight: [com.objective-see.oversight:application] removed client at index 0

webdesignweisshart commented 3 years ago

Hi Patrick, were the logfiles from PhotoBooth and microphone helpful? Were you able to locate the error?

objective-see commented 3 years ago

Thanks this is helpful ...looks like OverSight isn't seeing a few log messages that it expects to get from the system (i.e. "camera on").

One more question, can you run this from the terminal: log stream --predicate 'process=="VDCAssistant"'

(this is what OverSight monitors, and should have all the log msgs).

And then start Photo Booth (ensuring that camera then also gets activated (by PhotoBooth)).

...and post the output from that? Thanks for the help!

webdesignweisshart commented 3 years ago

Hi,

Photo Booth - yes, camera works, indicator light is on.

Last login: Mon May 17 14:38:27 on console x@MacBook-Pro ~ % log stream --predicate 'process=="VDCAssistant"'

Filtering the log data using "process == "VDCAssistant"" Timestamp Thread Type Activity PID TTL
2021-05-17 18:02:54.601634+0200 0x244c4 Default 0x0 265 0 VDCAssistant: [com.apple.VDCAssistant:assistant] Client Connect for PID 6170 2021-05-17 18:03:23.619879+0200 0x244c4 Default 0x0 265 0 VDCAssistant: [com.apple.VDCAssistant:assistant] ClientDied 19211 [PID: 6170]

Hope this helps.

objective-see commented 3 years ago

Ok thanks! Odd that it's not generating other messages.

And if you run it w/ --level info?

So: log stream --level info --predicate 'process=="VDCAssistant"'

Thank you again for the assistance!

webdesignweisshart commented 3 years ago

log stream --level info --predicate 'process=="VDCAssistant"' Filtering the log data using "process == "VDCAssistant"" Timestamp Thread Type Activity PID TTL
2021-05-17 18:18:25.807619+0200 0x279f4 Default 0x0 265 0 VDCAssistant: [com.apple.VDCAssistant:assistant] Client Connect for PID 6470 2021-05-17 18:18:35.654520+0200 0x279f4 Default 0x0 265 0 VDCAssistant: [com.apple.VDCAssistant:assistant] ClientDied 19755 [PID: 6470]

I ran it once with OverSight active, and then w/o OverSight. Both runs resulted in the same above output.

objective-see commented 3 years ago

Ok, this is helpful! ...just to confirm you are on an Intel-based Mac (not an M1/arm)?

Thanks!

objective-see commented 3 years ago

...and one last test, is anything shown if you run:

log stream --predicate 'process=="appleh13camerad"'

(And restart Photo Booth)

webdesignweisshart commented 3 years ago

MacBook Pro Retina 15' mid 2015 2,5 GHz Quad-Core Intel Core i7

webdesignweisshart commented 3 years ago

log stream --predicate 'process=="appleh13camerad"' does not return any msg at all.

objective-see commented 3 years ago

Ok thanks, that's all helpful info! I'll work on a fix/new version to address this :)

webdesignweisshart commented 3 years ago

Thank you,

I'm looking forward to a new version.

Am 17.05.2021 um 18:35 schrieb Objective-See @.***>:

Ok thanks, that's all helpful info! I'll work on a fix/new version to address this :)

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

von commented 3 years ago

I'm seeing similar behavior: no detection of video going active/inactive and detection of audio seems inconsistent. Primarily testing with Zoom, but also Photo Booth.

Big Sur 11.4. MacBook Air (13-inch, Mid 2013).

von commented 3 years ago

Perhaps helpful?

❯ log stream --predicate 'process=="AppleCameraAssistant"'
Filtering the log data using "process == "AppleCameraAssistant""
Timestamp                       Thread     Type        Activity             PID    TTL
2021-07-09 21:37:29.695808-0400 0x101a     Activity    0xb5f0c2             486    0    AppleCameraAssistant: (TCC) TCCAccessRequest() IPC
2021-07-09 21:37:30.038513-0400 0x101a     Default     0x0                  486    0    AppleCameraAssistant: StartHardwareStream: creating frame receiver:  1280 x  720 (420v)   [12.00,30.00]fps
2021-07-09 21:37:31.445707-0400 0x101a     Default     0x0                  486    0    AppleCameraAssistant: StopHardwareStream
2021-07-09 21:37:33.908734-0400 0x101a     Activity    0xb5f0c3             486    0    AppleCameraAssistant: (TCC) TCCAccessRequest() IPC
2021-07-09 21:37:34.238940-0400 0x101a     Default     0x0                  486    0    AppleCameraAssistant: StartHardwareStream: creating frame receiver:  1280 x  720 (420v)   [12.00,30.00]fps
2021-07-09 21:37:35.011260-0400 0x101a     Default     0x0                  486    0    AppleCameraAssistant: StopHardwareStream
webdesignweisshart commented 3 years ago

Is there any progress? A new version? Maybe a beta? Thanks for any info.

Am 17.05.2021 um 18:35 schrieb Objective-See @.***>:

Ok thanks, that's all helpful info! I'll work on a fix/new version to address this :)

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

MajesticBrownBear commented 2 years ago

Hi All. I have exactly the same issue as Webdesignweisshart. 1) The camera is not monitored at all. 2) The microphone is only detected on the second access, but after the first access (undetected), the message " Audio Device became inactive" appears.

MacOS BigSur 11.6 on MBP Late 2013.

Thanks for all the nice apps in any case! :-D

EasyNV commented 2 years ago

Hi All,

I have the same issue on OverSight 2.0 which is the Audio is not monitored at all.

Filtering the log data using "subsystem == "com.objective-see.oversight""
Timestamp                       Thread     Type        Activity             PID    TTL  
2021-10-28 22:03:53.380959+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new client msg: Client Connect for PID 13461
2021-10-28 22:03:53.381353+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new (video) client: CLIENT: pid: 13461, path: /System/Applications/FaceTime.app/Contents/MacOS/FaceTime, clientID: (null)
2021-10-28 22:03:53.381428+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new client id msg : [guid:0x8020000005ac8514] GetDevicesState for client 27739
2021-10-28 22:03:53.539207+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] camera on msg: [guid:0x8020000005ac8514] StartStream for client 1915
2021-10-28 22:03:53.539793+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] 'execute action' is disabled
2021-10-28 22:03:53.784635+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new client msg: Client Connect for PID 13464
2021-10-28 22:03:53.785088+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new (video) client: CLIENT: pid: 13464, path: /System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService, clientID: (null)
2021-10-28 22:03:53.785194+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new client id msg : [guid:0x8020000005ac8514] GetDevicesState for client 26043
2021-10-28 22:04:05.806101+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] dead client msg: ClientDied 27739 [PID: 13461]
2021-10-28 22:04:05.806163+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] removed client at index 0
2021-10-28 22:04:05.807364+0700 0x54f28    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] camera off msg: [guid:0x8020000005ac8514] Post event kCameraStreamStop
2021-10-28 22:04:06.035758+0700 0x553da    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] dead client msg: ClientDied 26043 [PID: 13464]
2021-10-28 22:04:06.035834+0700 0x553da    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] removed client at index 0
2021-10-28 22:04:06.807523+0700 0x5324b    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] checking if any camera is active
2021-10-28 22:04:06.807627+0700 0x5324b    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] device: Apple Inc./FaceTime HD Camera (Built-in)
2021-10-28 22:04:06.807677+0700 0x5324b    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] isRunning: 0
2021-10-28 22:04:06.807960+0700 0x5324b    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] 'execute action' is disabled
2021-10-28 22:04:08.614072+0700 0x5548e    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new client msg: Client Connect for PID 13466
2021-10-28 22:04:08.614344+0700 0x5548e    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new (video) client: CLIENT: pid: 13466, path: /System/Applications/FaceTime.app/Contents/MacOS/FaceTime, clientID: (null)
2021-10-28 22:04:08.614459+0700 0x5548e    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new client id msg : [guid:0x8020000005ac8514] GetDevicesState for client 28467
2021-10-28 22:04:08.775700+0700 0x5548e    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] camera on msg: [guid:0x8020000005ac8514] StartStream for client 1915
2021-10-28 22:04:08.776288+0700 0x5548e    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] 'execute action' is disabled
2021-10-28 22:04:09.009502+0700 0x553da    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new client msg: Client Connect for PID 13468
2021-10-28 22:04:09.010165+0700 0x553da    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new (video) client: CLIENT: pid: 13468, path: /System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService, clientID: (null)
2021-10-28 22:04:09.010307+0700 0x553da    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] new client id msg : [guid:0x8020000005ac8514] GetDevicesState for client 37175
2021-10-28 22:04:11.683954+0700 0x553da    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] dead client msg: ClientDied 28467 [PID: 13466]
2021-10-28 22:04:11.684019+0700 0x553da    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] removed client at index 0
2021-10-28 22:04:11.688752+0700 0x5548e    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] camera off msg: [guid:0x8020000005ac8514] Post event kCameraStreamStop
2021-10-28 22:04:11.917132+0700 0x5548e    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] dead client msg: ClientDied 37175 [PID: 13468]
2021-10-28 22:04:11.917180+0700 0x5548e    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] removed client at index 0
2021-10-28 22:04:12.688955+0700 0x5324b    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] checking if any camera is active
2021-10-28 22:04:12.689067+0700 0x5324b    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] device: Apple Inc./FaceTime HD Camera (Built-in)
2021-10-28 22:04:12.689117+0700 0x5324b    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] isRunning: 0
2021-10-28 22:04:12.689396+0700 0x5324b    Debug       0x0                  13324  0    OverSight: [com.objective-see.oversight:application] 'execute action' is disabled

I'm running on Big Sur 11.6.1 on MBP 2018

If you guys need any info, I'll be more than glad to provide. Thanks!

lm2807 commented 2 years ago

I'm having a somewhat similar issue where it detects the FaceTime camera activation, but not my Logitech webcam activation. M1 Macbook Pro running 12.2.1, OverSight v2.0.1.

I can stream the logs looking at Oversight, and when I switch back and forth between cameras, it will always show the detection of activation/deactivation of the FaceTime camera, but never the Logitech camera.

webdesignweisshart commented 2 years ago

The developer has supposedly been working on a bugfix since May 2021, but has not commented since then (for almost 1 year). Too bad about the good idea.

lm2807 commented 2 years ago

I may have found the problem for my situation. For M1 macs, OverSight looks for AppleH13CameraInterface or appleh13camerad to detect events in the log stream (see here in the code), but my USB Logitech Camera (or any USB camera I suspect) doesn't touch that daemon. Instead, it uses UVCUSBDeviceStreamingInterface:

UVCAssistant: (UVCFamily) [com.apple.UVCFamily:device] UVCUSBDeviceStreamingInterface: 0x1000195a1 [0x13ce14750] [start stream] format : UVCDeviceStreamFormat:[1920 * 1080 (MJPEG)] [0x13ce3a110] [subtype 6] frameInterval : 333333

UVCAssistant: (UVCFamily) [com.apple.UVCFamily:device] UVCUSBDeviceStreamingInterface: 0x1000195a1 [0x13ce14750] [stop stream] format : UVCDeviceStreamFormat:[1920 * 1080 (MJPEG)] [0x13ce3a110] [subtype 6] frameInterval : 333333

I'm not a macOS developer, but I can try tinkering with the xcodeproject and see if I can get a build working with that extra monitoring to cover USB cameras on M1 Macs.