September 2008 - Darwin-kernel

Re: Daemon to Trigger when Certain Apps are Quit
by Mike Zuhl 18 Sep '08

18 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 17, 2008, at 1:05 PM, Jerry Krinock wrote: On 2008 Sep, 17, at 8:47, Quinn wrote: <http://developer.apple.com/technotes/tn/tn2050.html> On 2008 Sep, 17, at 7:41, Philip Aker wrote: --Mike Zuhl _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… As far as doing this once you're running, I just updated TN2050 to described all of your various options. AFAIK launchd doesn't have any support for this sort of thing, so you'll have to run all the time. Indeed, NSWorkspaceDidTerminateApplicationNotification is what I currently use in my background app. Maybe kqueue with EVFILT_PROC NOTE_EXIT So, either way, if I insist on keeping this feature, I still need to have a continuously-running daemon of some kind. Hmmm. If any of your code (i.e., library functions) are running in these watched apps, there's another BSD way of watching for the app to quit. 1) Have your daemon set up a named pipe and accepts connections. You can do it with a thread per connection with a read(), or just a select (). 2) The first time your library code in the app gets run, it connects to the named pipe and does nothing else with the connections 3) When the app exits, the named pipe will be closed. The daemon will get an EOF on its end of the pipe--either by the thread's read() completing or the select() returning with activity on that connection I've done this under Linux where the only problem was hitting the limit of 1024 file descriptors on select(). (Yeah, I had a lot of processes to watch.) Of course, this scheme doesn't work for arbitrary processes that aren't using any of your code. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Daemon to Trigger when Certain Apps are Quit
by Philip Aker 18 Sep '08

18 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 17, 2008, at 1:05 PM, Jerry Krinock wrote: <http://developer.apple.com/technotes/tn/tn2050.html> Philip Aker echo astwta@lvpc.dslh@nl | tr a-z@. p-za-o.@ Democracy: Two wolves and a sheep voting on lunch. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On 2008 Sep, 17, at 8:47, Quinn wrote: As far as doing this once you're running, I just updated TN2050 to described all of your various options. AFAIK launchd doesn't have any support for this sort of thing, so you'll have to run all the time. Indeed, NSWorkspaceDidTerminateApplicationNotification is what I currently use in my background app. On 2008 Sep, 17, at 7:41, Philip Aker wrote: Maybe kqueue with EVFILT_PROC NOTE_EXIT So, either way, if I insist on keeping this feature, I still need to have a continuously-running daemon of some kind. Hmmm. I think so. My situation is not the quite the same, so I'm keeping the kqueue stuff as a separate tool in my application bundle and using CFNotifs for communication. Thanks for TN2050 Quinn, it's nice to be aware of the various options. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Daemon to Trigger when Certain Apps are Quit
by Jerry Krinock 17 Sep '08

17 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 2008 Sep, 17, at 8:47, Quinn wrote: <http://developer.apple.com/technotes/tn/tn2050.html> On 2008 Sep, 17, at 7:41, Philip Aker wrote: Thanks, guys. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… As far as doing this once you're running, I just updated TN2050 to described all of your various options. AFAIK launchd doesn't have any support for this sort of thing, so you'll have to run all the time. Indeed, NSWorkspaceDidTerminateApplicationNotification is what I currently use in my background app. Maybe kqueue with EVFILT_PROC NOTE_EXIT So, either way, if I insist on keeping this feature, I still need to have a continuously-running daemon of some kind. Hmmm. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Daemon to Trigger when Certain Apps are Quit
by Quinn 17 Sep '08

17 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com <http://developer.apple.com/technotes/tn/tn2050.html> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 5:41 -0700 17/9/08, Jerry Krinock wrote: The WatchPaths and QueueDirectories triggers in launchd will be very useful, but how about being notified when certain apps quit? I might be able to kludge it by watching these apps' Preferences or Application Support directories, but does anyone know a better way to do this? As far as doing this once you're running, I just updated TN2050 to described all of your various options. AFAIK launchd doesn't have any support for this sort of thing, so you'll have to run all the time. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Daemon to Trigger when Certain Apps are Quit
by Philip Aker 17 Sep '08

17 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 17, 2008, at 5:41 AM, Jerry Krinock wrote: Maybe kqueue with EVFILT_PROC NOTE_EXIT Philip Aker echo astwta@lvpc.dslh@nl | tr a-z@. p-za-o.@ Democracy: Two wolves and a sheep voting on lunch. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… The current version of my app includes a daemon which runs constantly and watches directories, and also for certain apps to quit. The next version will drop support for Mac OS 10.3 and of course I'd like to eliminate this daemon by hooking into launchd. The WatchPaths and QueueDirectories triggers in launchd will be very useful, but how about being notified when certain apps quit? I might be able to kludge it by watching these apps' Preferences or Application Support directories, but does anyone know a better way to do this? This email sent to site_archiver(a)lists.apple.com

1 0

Daemon to Trigger when Certain Apps are Quit
by Jerry Krinock 17 Sep '08

17 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thanks, Jerry Krinock _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… The current version of my app includes a daemon which runs constantly and watches directories, and also for certain apps to quit. The next version will drop support for Mac OS 10.3 and of course I'd like to eliminate this daemon by hooking into launchd. The WatchPaths and QueueDirectories triggers in launchd will be very useful, but how about being notified when certain apps quit? I might be able to kludge it by watching these apps' Preferences or Application Support directories, but does anyone know a better way to do this? This email sent to site_archiver(a)lists.apple.com

1 0

Re: pointers for newbie wanting to write a 'window' logger
by Joel Sherriff 08 Sep '08

08 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.16 (Macintosh/20080707) Joel take a look on ApplicationServices.framework and CGWindowListCreateDescriptionFromArray Hmm, well it looks like the thing I expected to be hard is easy (thank's to Philip's pointer), but the thing I expected to be easy isn't so much. This is also not particularly a kernel thing, but I might as well continue the thread if no one objects... Any thoughts on how to get the window title of the "active" window? The event mechanism doesn't give a lot of detail since it's at such a low level - Process Serial Number, PID, and a bunch of other things I don't understand...but not Window Id, so I know now that an event occurred, but not what window it was sent to. That's half the battle. It looks like there's a new CGWindow interface in Leopard that has some details - but only the application name (kCGWindowName), not the title. And, without a window id in the CGEvent data I couldn't link the two together anyway. But application name isn't sufficient for my needs - I really need the title. Joel On Sep 5, 2008, at 2:43 PM, Joel Sherriff wrote: Sounds like you could do this with the event tap and window facilities available in CoreGraphics (CGEvent.h for starters). Look here <http://prefabsoftware.com/> to see an illustration of the tap portion of your needs. Philip Aker echo astwta@lvpc.dslh@nl | tr a-z@. p-za-o.@ Democracy: Two wolves and a sheep voting on lunch. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com This email sent to openspecies(a)gmail.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… That's what I was referring to by my vague reference to CGWindow and only being able to get the window name from it. Unless I'm missing something...which is possible. It looks like CGWindowListCreateDescriptionFromArray let's me get information about the window hierarchy, but not the window title or what window is on top. I'm currently investigating the window manager api to see if it's accessible from there - particularly ActiveNonFloatingWindow(). mm w wrote: On Mon, Sep 8, 2008 at 9:15 AM, Joel Sherriff <joel(a)6sa.com> wrote: Philip Aker wrote: New to OS X, but I need to write an app that records activity similiar to a keylogger - only that I don't want the keys that are recorded, only to know that a key or mouse button was pressed and what the window title of the window that got the event was. A window-activity logger, versus a keylogger. I'd prefer not to go to as low a level as a kernel extension, as I'd really like to keep this in user space (but I will, if I have to). I've done the same thing in Windows (using hooks) and Linux (X11 using the XRecord extension to the X server), but I know little or nothing about Quartz, Aqua, Carbon, kernel extensions, etc, etc, so I'm asking for guidance as to the right layer to target and technology to use. In the X11 version, the monitor loads from the Xsession config - that is it starts when the user logs in and runs only while the user is logged in... ideally I'd like to mimic that. Can someone with more experience on OS X features give me some pointers? Btw, I know this isn't specifically a kernel question, but I figure the kernel guru's would know best when something shouldn't be done in a kernel extension. If a kernel extension is the only way to do it though, then that's the way I'll go. This email sent to site_archiver(a)lists.apple.com

1 0

Re: pointers for newbie wanting to write a 'window' logger
by Philip Aker 08 Sep '08

08 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 8, 2008, at 9:15 AM, Joel Sherriff wrote: Untitled windows usually show up as {} in the resulting list. On Sep 5, 2008, at 2:43 PM, Joel Sherriff wrote: Philip Aker echo astwta@lvpc.dslh@nl | tr a-z@. p-za-o.@ Democracy: Two wolves and a sheep voting on lunch. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/philip.aker%40shaw.ca Philip Aker echo astwta@lvpc.dslh@nl | tr a-z@. p-za-o.@ Democracy: Two wolves and a sheep voting on lunch. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Hmm, well it looks like the thing I expected to be hard is easy (thank's to Philip's pointer), but the thing I expected to be easy isn't so much. This is also not particularly a kernel thing, but I might as well continue the thread if no one objects... Any thoughts on how to get the window title of the "active" window? The event mechanism doesn't give a lot of detail since it's at such a low level - Process Serial Number, PID, and a bunch of other things I don't understand...but not Window Id, so I know now that an event occurred, but not what window it was sent to. That's half the battle. It looks like there's a new CGWindow interface in Leopard that has some details - but only the application name (kCGWindowName), not the title. And, without a window id in the CGEvent data I couldn't link the two together anyway. But application name isn't sufficient for my needs - I really need the title. Look into the facilities available Accessibility.h (in sub-framework HIServices.h of ApplicationServices.framework). Note there is also an alternate and perhaps easier method using an EventMonitor target in Carbon proper but this requires "Enable access for assistive devices" to be checked in the user's preferences. Consequently, I'm not sure if it must be enabled when using Accessibility services directly. Here is an AppleScript call which illustrates how to get every window (also requires "Enable access for assistive devices" to be enabled). tell application "System Events" to get title of every window of every application process You can map the window to the process by a choice of means including PID. Philip Aker wrote: New to OS X, but I need to write an app that records activity similiar to a keylogger - only that I don't want the keys that are recorded, only to know that a key or mouse button was pressed and what the window title of the window that got the event was. A window-activity logger, versus a keylogger. I'd prefer not to go to as low a level as a kernel extension, Sounds like you could do this with the event tap and window facilities available in CoreGraphics (CGEvent.h for starters). Look here <http://prefabsoftware.com/> to see an illustration of the tap portion of your needs. as I'd really like to keep this in user space (but I will, if I have to). I've done the same thing in Windows (using hooks) and Linux (X11 using the XRecord extension to the X server), but I know little or nothing about Quartz, Aqua, Carbon, kernel extensions, etc, etc, so I'm asking for guidance as to the right layer to target and technology to use. In the X11 version, the monitor loads from the Xsession config - that is it starts when the user logs in and runs only while the user is logged in... ideally I'd like to mimic that. Can someone with more experience on OS X features give me some pointers? Btw, I know this isn't specifically a kernel question, but I figure the kernel guru's would know best when something shouldn't be done in a kernel extension. If a kernel extension is the only way to do it though, then that's the way I'll go. This email sent to philip.aker(a)shaw.ca This email sent to site_archiver(a)lists.apple.com

1 0

Re: pointers for newbie wanting to write a 'window' logger
by mm w 08 Sep '08

08 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=WrIz56WvTqn2YA3ZOE0VF63ObqfbkdSAkkpcl2m6qmI=; b=XN9misIbu8W69YHjohbcJLDrWFn/wUoJFKO0ngKarjpCABZ6Mcfat7yWKiwpHJjkAJ PdhuqIOdpkwFVvqYbbxcmP+2foy5DlOo2mGJozqjXyzpPUVwppX6p8jmrkMgLxKMnOJd bexTq6tZLVIM6phKtTWCVnr/EjwFjHOnKlIs0= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=mbMv3Y5IHGS/eFxxTFtyevEuPhhWVgJnldx7t+TW45Ib3bXfsvl1Eb0KDLYJsPrQds WSt07G8hD1SLDC/+VGcZIvGFE378e//p3zd0c7D4NUyCNJy+T/IIo548tL9rOmeIMhzC 9SaQ1yqWFGsZNa3+JXzo/v7T1+d8ekC6aQbJA= take a look on ApplicationServices.framework and CGWindowListCreateDescriptionFromArray On Mon, Sep 8, 2008 at 9:15 AM, Joel Sherriff <joel(a)6sa.com> wrote: > Hmm, well it looks like the thing I expected to be hard is easy (thank's to > Philip's pointer), but the thing I expected to be easy isn't so much. This > is also not particularly a kernel thing, but I might as well continue the > thread if no one objects... > > Any thoughts on how to get the window title of the "active" window? The > event mechanism doesn't give a lot of detail since it's at such a low level > - Process Serial Number, PID, and a bunch of other things I don't > understand...but not Window Id, so I know now that an event occurred, but > not what window it was sent to. That's half the battle. It looks like > there's a new CGWindow interface in Leopard that has some details - but only > the application name (kCGWindowName), not the title. And, without a window > id in the CGEvent data I couldn't link the two together anyway. But > application name isn't sufficient for my needs - I really need the title. > > Joel > > > Philip Aker wrote: >> >> On Sep 5, 2008, at 2:43 PM, Joel Sherriff wrote: >> >>> New to OS X, but I need to write an app that records activity similiar to >>> a keylogger - only that I don't want the keys that are recorded, only to >>> know that a key or mouse button was pressed and what the window title of the >>> window that got the event was. A window-activity logger, versus a keylogger. >>> I'd prefer not to go to as low a level as a kernel extension, >> >> Sounds like you could do this with the event tap and window facilities >> available in CoreGraphics (CGEvent.h for starters). Look here >> <http://prefabsoftware.com/> to see an illustration of the tap portion of >> your needs. >> >>> as I'd really like to keep this in user space (but I will, if I have to). >>> I've done the same thing in Windows (using hooks) and Linux (X11 using the >>> XRecord extension to the X server), but I know little or nothing about >>> Quartz, Aqua, Carbon, kernel extensions, etc, etc, so I'm asking for >>> guidance as to the right layer to target and technology to use. In the X11 >>> version, the monitor loads from the Xsession config - that is it starts when >>> the user logs in and runs only while the user is logged in... ideally I'd >>> like to mimic that. Can someone with more experience on OS X features give >>> me some pointers? >> >>> Btw, I know this isn't specifically a kernel question, but I figure the >>> kernel guru's would know best when something shouldn't be done in a kernel >>> extension. If a kernel extension is the only way to do it though, then >>> that's the way I'll go. >> >> >> Philip Aker >> echo astwta@lvpc.dslh@nl | tr a-z@. p-za-o.@ >> >> Democracy: Two wolves and a sheep voting on lunch. >> >> > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com > > This email sent to openspecies(a)gmail.com > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: pointers for newbie wanting to write a 'window' logger
by Joel Sherriff 08 Sep '08

08 Sep '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.16 (Macintosh/20080707) Joel On Sep 5, 2008, at 2:43 PM, Joel Sherriff wrote: Philip Aker echo astwta@lvpc.dslh@nl | tr a-z@. p-za-o.@ Democracy: Two wolves and a sheep voting on lunch. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Hmm, well it looks like the thing I expected to be hard is easy (thank's to Philip's pointer), but the thing I expected to be easy isn't so much. This is also not particularly a kernel thing, but I might as well continue the thread if no one objects... Any thoughts on how to get the window title of the "active" window? The event mechanism doesn't give a lot of detail since it's at such a low level - Process Serial Number, PID, and a bunch of other things I don't understand...but not Window Id, so I know now that an event occurred, but not what window it was sent to. That's half the battle. It looks like there's a new CGWindow interface in Leopard that has some details - but only the application name (kCGWindowName), not the title. And, without a window id in the CGEvent data I couldn't link the two together anyway. But application name isn't sufficient for my needs - I really need the title. Philip Aker wrote: New to OS X, but I need to write an app that records activity similiar to a keylogger - only that I don't want the keys that are recorded, only to know that a key or mouse button was pressed and what the window title of the window that got the event was. A window-activity logger, versus a keylogger. I'd prefer not to go to as low a level as a kernel extension, Sounds like you could do this with the event tap and window facilities available in CoreGraphics (CGEvent.h for starters). Look here <http://prefabsoftware.com/> to see an illustration of the tap portion of your needs. as I'd really like to keep this in user space (but I will, if I have to). I've done the same thing in Windows (using hooks) and Linux (X11 using the XRecord extension to the X server), but I know little or nothing about Quartz, Aqua, Carbon, kernel extensions, etc, etc, so I'm asking for guidance as to the right layer to target and technology to use. In the X11 version, the monitor loads from the Xsession config - that is it starts when the user logs in and runs only while the user is logged in... ideally I'd like to mimic that. Can someone with more experience on OS X features give me some pointers? Btw, I know this isn't specifically a kernel question, but I figure the kernel guru's would know best when something shouldn't be done in a kernel extension. If a kernel extension is the only way to do it though, then that's the way I'll go. This email sent to site_archiver(a)lists.apple.com

1 0