Advanced Frida Usage Part 3 – Inspecting XPC Calls

				
					// Get addresses of the functions that we will intercept
var xpc_connection_create_mach_service = Module.findExportByName(null, "xpc_connection_create_mach_service");
var xpc_connection_send_message = Module.findExportByName(null, "xpc_connection_send_message");
var xpc_dictionary_set_string = Module.findExportByName(null, "xpc_dictionary_set_string");

// Get address of xpc_copy_description and create new NativeFunction
// It accepts xpc_object_t and returns char *
var xpc_copy_description_addr = Module.findExportByName(null, "xpc_copy_description");
var xpc_copy_description = new NativeFunction(xpc_copy_description_addr, "pointer", ["pointer"]);

// Get address of xpc_connection_get_name and create new NativeFunction
// It accepts xpc_connection_t and returns char *
var xpc_connection_get_name_addr = Module.findExportByName(null, "xpc_connection_get_name");
var xpc_connection_get_name = new NativeFunction(xpc_connection_get_name_addr, "pointer", ["pointer"]);

// Helper function to read char * 
function readCString(cstr) {
    return Memory.readUtf8String(cstr);
}

/* parameters:
	1. name
	2. dispatch queue (not interested in this now)
	3. flags (listener or client mode)
*/
Interceptor.attach(xpc_connection_create_mach_service, {
    onEnter(args) {
		  // first argument is char* name and we want to read it
        var serviceName = readCString(args[0]);
        console.log(`[*] xpc_connection_create_mach_service called for service: ${serviceName}`);
    }
});

/* parameters:
	1. connection (xpc_connection_t)
	2. message (xpc_object_t)
*/
Interceptor.attach(xpc_connection_send_message, {
    onEnter(args) {
        var conn = args[0];
        var connName = readCString(xpc_connection_get_name(conn));
        var message = args[1];
        var messageDescription = readCString(xpc_copy_description(message));
        console.log(`[*] xpc_connection_send_message(name=${connName}) called for ${conn} with description: ${messageDescription}`);
    }
});

/* parameters:
	1. dictionary (xpc_object_t)
	2. key (char*)
	3. value (char*)
*/
Interceptor.attach(xpc_dictionary_set_string, {
    onEnter(args) {
        var key = readCString(args[1]);
        var value = readCString(args[2]);
        console.log(`[*] xpc_dictionary_set_string called for ${key} = ${value}`);
    }
});