{"id":17066271,"url":"https://github.com/reverseapple/gxpc","last_synced_at":"2025-04-05T10:08:18.858Z","repository":{"id":176682869,"uuid":"648722050","full_name":"ReverseApple/gxpc","owner":"ReverseApple","description":"Sniff XPC communication using Frida and Go","archived":false,"fork":false,"pushed_at":"2025-02-26T20:42:32.000Z","size":1777,"stargazers_count":130,"open_issues_count":4,"forks_count":6,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-03-29T09:11:47.422Z","etag":null,"topics":["frida","ios","macos","reverse-engineering","xnu","xpc"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ReverseApple.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-02T16:35:44.000Z","updated_at":"2025-03-10T06:04:18.000Z","dependencies_parsed_at":"2023-12-07T21:27:27.629Z","dependency_job_id":"e8c8dfe0-8515-4a3d-bec9-2e4e8a1cb2db","html_url":"https://github.com/ReverseApple/gxpc","commit_stats":{"total_commits":76,"total_committers":6,"mean_commits":"12.666666666666666","dds":0.2763157894736842,"last_synced_commit":"c2ed104a4989531ace15e106a45bb4d1b0c4ad98"},"previous_names":["nsecho/gxpc","reverseapple/gxpc"],"tags_count":30,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ReverseApple%2Fgxpc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ReverseApple%2Fgxpc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ReverseApple%2Fgxpc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ReverseApple%2Fgxpc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ReverseApple","download_url":"https://codeload.github.com/ReverseApple/gxpc/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247318744,"owners_count":20919484,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["frida","ios","macos","reverse-engineering","xnu","xpc"],"created_at":"2024-10-14T11:06:29.976Z","updated_at":"2025-04-05T10:08:18.830Z","avatar_url":"https://github.com/ReverseApple.png","language":"JavaScript","readme":"# gxpc\n\nTool inspired by [xpcspy](https://github.com/hot3eed/xpcspy) tool to monitor XPC traffic. \n\ngxpc recursively parses types of `xpc_object_t` as well as unmarshalling the data back to Go types.\n\n# Installation\n\nDownload one of the prebuilt binaries for macOS(x86_64 or arm64) from [here](https://github.com/ReverseApple/gxpc/releases) \nor do it manually as described below. \n\n* Follow the instructions for devkit documented [here](https://github.com/frida/frida-go)\n* Run `go install github.com/ReverseApple/gxpc@latest`\n\n# Usage\n\n```bash\nXPC sniffer\n\nUsage:\n  gxpc [spawn_args] [flags]\n\nFlags:\n  -b, --blacklist strings    blacklist connection by name\n      --blacklistp strings   blacklist connection by PID\n  -f, --file string          spawn the file\n  -h, --help                 help for gxpc\n  -i, --id string            connect to device with ID\n  -l, --list                 list available devices\n  -n, --name string          process name\n  -o, --output string        save output to this file\n  -p, --pid int              PID of wanted process (default -1)\n  -r, --remote string        connect to device at IP address\n  -w, --whitelist strings    whitelist connection by name\n      --whitelistp strings   whitelist connection by PID\n```\n\nIf you do not pass `-i` flag, default device is USB.\n\nIf you want to spawn a file/binary, pass the `-f` that points to the file/binary you want to spawn along with the arguments.\n\n* `gxpc -i local -f /bin/cat /tmp/somefile` - without some specific flags to the spawned binary\n* `gxpc -i local -f /path/to/binary -- -a -b \"TEST\"` - with some specific flags to the spawned binary\n\nAdditionally, you can filter on connection names or PIDs, if you pass both filters (name and PID), it will take only name. \n`--whitelist` and `--whitelistp` along with the `--blacklist` and `--blacklistp` accepts the list, such as `--blacklistp \"89,32,41\"` which will \nblacklist the ports 89, 32 and 41.\n\n![Running gxpc](running.png)\n\n![Running against Signal](running_one.png)\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freverseapple%2Fgxpc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Freverseapple%2Fgxpc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freverseapple%2Fgxpc/lists"}