AwesomeREA.org

Tool

gxpc

macOS command-line XPC sniffer, inspired by xpcspy, that injects a Frida agent into an attached or newly spawned process and logs the XPC messages it sends and receives, labelled with the libxpc function, connection name, peer PID and process name. The agent recursively converts xpc_object_t dictionaries, arrays and scalar values into readable output and decodes binary-plist payloads, while a Go host built on frida-go selects a local, USB or remote Frida device, filters connections by name or PID and can save the trace to a file. It observes how Apple-platform apps and services communicate over XPC and does not alter or inject messages.

Requirements & limits

  • Latest release at review: v2.2.1, published 2025-08-12, with macOS x86_64 and arm64 archives that GoReleaser links against the Frida 17.2.16 core devkit; the reviewed main commit adds only a cobra dependency bump (2025-09-02). Installing with go install instead needs Go, cgo and the Frida devkit set up as frida-go documents; go.mod declares Go 1.20 and frida-go 1.0.0.
  • On first run the binary writes its embedded TypeScript agent and package files to a gxpc folder in the system temp directory, runs npm install for frida-objc-bridge and compiles the agent with Frida’s compiler, so Node.js, npm and network access are needed at least once; the compiled agent is then reused. The analyst picks the target by PID, process name or a file to spawn, on a local device (-i local), a USB device (the default) or a remote Frida server; the README documents no device setup or tested OS versions.
  • Outgoing messages come from hooks on the public libxpc send, reply and notification functions, and new connections from xpc_connection_create_mach_service and xpc_connection_set_event_handler. Incoming messages rely on the private _xpc_connection_call_event_handler and __CFBinaryPlistCreate15, which the agent resolves from debug symbols and caches as offsets per machine and OS build in gxpc.conf in the user’s home directory (or a file given with -c). bplist16 payloads are decoded through an external jlutil executable when one is installed on the host, otherwise by the agent’s own parser or as base64. In the reviewed main.go the --whitelistp option reads the --whitelist value, so PID allow-listing may not work as documented.
  • MIT. frida-go, the Frida devkit and frida-objc-bridge keep their own licenses, and jlutil is a separate third-party tool not shipped with gxpc. The reviewed sources establish no REA connection; nothing was installed or run in this review.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
App · Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · ReverseApple/gxpc · Revision 4fad36d
  2. main.go GitHub · ReverseApple/gxpc · Revision 4fad36d
  3. script.ts GitHub · ReverseApple/gxpc · Revision 4fad36d
  4. offsets.go GitHub · ReverseApple/gxpc · Revision 4fad36d
  5. go.mod GitHub · ReverseApple/gxpc · Revision 4fad36d
  6. .goreleaser.yaml GitHub · ReverseApple/gxpc · Revision 4fad36d
  7. .github/workflows/release.yml GitHub · ReverseApple/gxpc · Revision 4fad36d
  8. LICENSE GitHub · ReverseApple/gxpc · Revision 4fad36d
  9. https://github.com/ReverseApple/gxpc/releases/tag/v2.2.1

More in Native binaries

All 109 entries in Native binaries