April 2012 - Darwin-kernel - lists.apple.com

Re: Kauth event for write operation
by Quinn "The Eskimo!" 05 Apr '12

05 Apr '12

On 30 Mar 2012, at 20:19, simran charley wrote: > Here after file closed with dirty = true, means file modification done, then what is the significance of last event {WRITE_DATA ACCESS} ? It's hard to say without more info (I suspect it's copying some metadata). Why not set a breakpoint in your kauth listener and look at the backtrace? Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

How to get the slide of another process
by Gerriet M. Denkmann 04 Apr '12

04 Apr '12

Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the slide of it? If this is my own pid, I would use _dyld_get_image_vmaddr_slide() - but what to use for other pids? Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get kind of running process
by Gerriet M. Denkmann 04 Apr '12

04 Apr '12

On 3 Apr 2012, at 22:06, Shantonu Sen wrote: > you should look at the source code to top > > <http://www.opensource.apple.com/source/top/top-73/libtop.c> Thank you very much. This was a very valuable link. The answer to my problem is the (as far as I can see) undocumented string: "sysctl.proc_cputype" which induces sysctl() to return the cpu-type (CPU_TYPE_X86 or CPU_TYPE_X86_64) of a supplied pid. > On Apr 3, 2012, at 3:55 AM, "Gerriet M. Denkmann" <gerriet(a)mdenkmann.de> wrote: > >> Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the information Activity Monitor displays under "Kind", i.e. Intel, Intel 64, PowerPC etc. ? >> >> I looked at sysctl ( CTL_KERN, KERN_PROC, KERN_PROC_PID, pid ) but did not see anything useful. >> >> There is proc_is64bit(), but it seems this is not for normal apps. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get kind of running process
by Shantonu Sen 03 Apr '12

03 Apr '12

you should look at the source code to top <http://www.opensource.apple.com/source/top/top-73/libtop.c> Shantonu On Apr 3, 2012, at 3:55 AM, "Gerriet M. Denkmann" <gerriet(a)mdenkmann.de> wrote: > Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the information Activity Monitor displays under "Kind", i.e. Intel, Intel 64, PowerPC etc. ? > > I looked at sysctl ( CTL_KERN, KERN_PROC, KERN_PROC_PID, pid ) but did not see anything useful. > > There is proc_is64bit(), but it seems this is not for normal apps. > > What to use? > > > Kind regards, > > Gerriet. > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/ssen%40apple.com > > This email sent to ssen(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

How to get kind of running process
by Gerriet M. Denkmann 03 Apr '12

03 Apr '12

Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the information Activity Monitor displays under "Kind", i.e. Intel, Intel 64, PowerPC etc. ? I looked at sysctl ( CTL_KERN, KERN_PROC, KERN_PROC_PID, pid ) but did not see anything useful. There is proc_is64bit(), but it seems this is not for normal apps. What to use? Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: format of sysctl( { CTL_KERN, KERN_PROCARGS, pid } )
by Shantonu Sen 01 Apr '12

01 Apr '12

the only documentation is the source: <http://www.opensource.apple.com/source/xnu/xnu-1699.24.23/bsd/kern/kern_sys…> <http://www.opensource.apple.com/source/xnu/xnu-1699.24.23/bsd/kern/kern_exe…> those aren't uint32=0, they are zeros to align parts of the argument area at pointer alignment (8 bytes for a 64-bit process) Shantonu On Mar 31, 2012, at 7:48 PM, Gerriet M. Denkmann <gerriet(a)mdenkmann.de> wrote: > > On 1 Apr 2012, at 07:44, Michael Nickerson wrote: > >> On Mar 31, 2012, at 3:40 PM, "Gerriet M. Denkmann" <gerriet(a)mdenkmann.de> wrote: >> >>> Is the output format of format of sysctl( { CTL_KERN, KERN_PROCARGS, pid } ) somewhere documented? >>> >>> The output seems to be mostly Utf8-strings, with some ints thrown in. These ints seem to have their lower 16 bits = zero. >>> >>> >> >> If I remember correctly, it's just an array of chars, each separated by a NULL char ('\0'). It's been awhile since I played around with it, but I think it's the path that was used to invoke the executable (twice I think), followed by any arguments passed to it, and maybe after that environment variables. The latter may only be given with KERN_PROCARGS2, I don't remember. > > > A typical output of KERN_PROCARGS is: > 00000 "/System/Library/PrivateFrameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService" > 0x08c uint32 0 > 0x090 "com.apple.coremedia.videodecoder" > 0x0b1 "HOME=/Users/gerriet" > 0x0c5 "Apple_PubSub_Socket_Render=/tmp/launch-kEQ3zJ/Render" > 0x0fa "SSH_AUTH_SOCK=/tmp/launch-prg9nP/Listeners" > 0x125 "PATH=/usr/bin:/bin:/usr/sbin:/sbin" > 0x148 "__CF_USER_TEXT_ENCODING=0x1F6:0:2" > 0x16a "TMPDIR=/var/folders/0f/2zvz4vss10gdwm_dwz__2kh80000gp/T/" > 0x1a4 uint32 0 > 0x1a8 "stack_guard=0xc24643161eedeb92" > 0x1c7 "malloc_entropy=0x0681aaf5720495d0,0x6d06a7d32ea812b7" > 0x1fc uint32 0 > 0x200 uint32 0 > 0x204 uint32 0xbfff0000 > 0x208 uint32 0 > 0x20c "/System/Library/PrivateFrameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService" > 0x298 uint32 0 > > That is: '\0' terminated Utf8-strings + some uint32. > The sequence 0,0, 0xbfff0000, 0 is fairly typical. > The other zeroes may or may not occur. > > KERN_PROCARGS2 has only uint32s - if at all. Nothing which looks interesting for me. > > > Kind regards, > > Gerriet. > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/ssen%40apple.com > > This email sent to ssen(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: format of sysctl( { CTL_KERN, KERN_PROCARGS, pid } )
by Gerriet M. Denkmann 01 Apr '12

01 Apr '12

On 1 Apr 2012, at 07:44, Michael Nickerson wrote: > On Mar 31, 2012, at 3:40 PM, "Gerriet M. Denkmann" <gerriet(a)mdenkmann.de> wrote: > >> Is the output format of format of sysctl( { CTL_KERN, KERN_PROCARGS, pid } ) somewhere documented? >> >> The output seems to be mostly Utf8-strings, with some ints thrown in. These ints seem to have their lower 16 bits = zero. >> >> > > If I remember correctly, it's just an array of chars, each separated by a NULL char ('\0'). It's been awhile since I played around with it, but I think it's the path that was used to invoke the executable (twice I think), followed by any arguments passed to it, and maybe after that environment variables. The latter may only be given with KERN_PROCARGS2, I don't remember. A typical output of KERN_PROCARGS is: 00000 "/System/Library/PrivateFrameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService" 0x08c uint32 0 0x090 "com.apple.coremedia.videodecoder" 0x0b1 "HOME=/Users/gerriet" 0x0c5 "Apple_PubSub_Socket_Render=/tmp/launch-kEQ3zJ/Render" 0x0fa "SSH_AUTH_SOCK=/tmp/launch-prg9nP/Listeners" 0x125 "PATH=/usr/bin:/bin:/usr/sbin:/sbin" 0x148 "__CF_USER_TEXT_ENCODING=0x1F6:0:2" 0x16a "TMPDIR=/var/folders/0f/2zvz4vss10gdwm_dwz__2kh80000gp/T/" 0x1a4 uint32 0 0x1a8 "stack_guard=0xc24643161eedeb92" 0x1c7 "malloc_entropy=0x0681aaf5720495d0,0x6d06a7d32ea812b7" 0x1fc uint32 0 0x200 uint32 0 0x204 uint32 0xbfff0000 0x208 uint32 0 0x20c "/System/Library/PrivateFrameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService" 0x298 uint32 0 That is: '\0' terminated Utf8-strings + some uint32. The sequence 0,0, 0xbfff0000, 0 is fairly typical. The other zeroes may or may not occur. KERN_PROCARGS2 has only uint32s - if at all. Nothing which looks interesting for me. Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0