tony-go / snixpc

XPC sniffer using LLDB
GNU Affero General Public License v3.0
29 stars 0 forks source link

Share your thoughts :) #2

Open tony-go opened 1 month ago

tony-go commented 1 month ago

Hi 👋🏼 and welcome :)

This issue aims to gather feedback for the first stable version of snixpc. If you already test the plugin you probably already see some limitations.

Main ones are:

  1. This warning:
    warning: hit breakpoint while running function, skipping commands and conditions to prevent recursion
  2. LLDB goes out of control for XPC intensive application, for instance if you attach LLDB to Notes.app and run snif. When I saw the warning (1) I disabled auto continue to manually do process.Continue() once expressions has been evaluated. But the warning still appear! I also tried to add a lock but it does not help much.

In extension I sometimes saw this during development:

Process 90513 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=1, subcode=0x19c768e20)
    frame #0: 0x000000019c768e20 CoreFoundation` __CFRunLoopServiceMachPort.cold.1  + 56
CoreFoundation`:
->  0x19c768e20 <+56>: brk    #0x1
    0x19c768e24 <+60>: and    w8, w0, #0x3e00
    0x19c768e28 <+64>: sub    w9, w8, #0x400
    0x19c768e2c <+68>: extr   w16, w8, w9, #0xa
    0x19c768e30 <+72>: cmp    w16, #0x7
    0x19c768e34 <+76>: b.hi   0x19c768e20               ; <+56>
    0x19c768e38 <+80>: adrp   x0, 429
    0x19c768e3c <+84>: add    x0, x0, #0x42c            ; "Out of IPC space"

This could indicate that the XPC communication, is hitting some kind of limit or unexpected condition.

Solutions:

I don't have proper solutions in mind but rather hypothesis:

tony-go commented 4 weeks ago

Another option could be to get the description of the object and parse that string directly!