AwesomeREA.org

Tool

xpcspy

Frida-powered command-line tool that observes XPC messages exchanged between processes on iOS and macOS in both directions, for understanding how Apple-platform apps and services talk over XPC. It can spawn or attach to a target over a USB or remote Frida connection, filter the trace by direction (incoming or outgoing) and by service name with wildcards, and optionally parse the binary-plist payloads carried in XPC dictionaries, with bplist00 and bplist16 described as officially supported and bplist15 and bplist17 as experimental. A Python CLI drives a TypeScript Frida agent that is compiled to JavaScript.

Requirements & limits

  • Reviewed at tag v0.9.0 (the reviewed commit, last pushed 2026-05-11); the matching xpcspy 0.9.0 release was uploaded to PyPI the same day. requirements.txt pins frida ~=17.9.7 and frida-tools ~=14.8.2, so a compatible Frida must be present, and interception works only where that Frida can instrument the target: a local macOS process, or an iOS device reachable by a frida-server over USB (-U) or remotely (-R/-H).
  • Install with pip3 install xpcspy for the CLI. Building from source uses the Makefile: the Frida agent under agent/ is a TypeScript project compiled with frida-compile (needs Node.js and npm), then python3 setup.py sdist packages the Python tool. The package metadata credits author hot3eed and points its homepage at github.com/hot3eed/xpcspy.
  • The analyst chooses the process to inspect by name, PID, frontmost application or a spawned file; no sample files ship with the tool. It reads the XPC traffic of a running target for analysis and does not modify or inject messages. bplist parsing is partly experimental, and the README's TODO list notes recursive bplist deserialization and other unfinished work.
  • Apache-2.0. The reviewed sources establish no REA connection, and nothing was installed or run in this review.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
App · Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  2. setup.py GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  3. requirements.txt GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  4. Makefile GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  5. agent/package.json GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  6. xpcspy/__init__.py GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  7. LICENSE GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  8. https://github.com/ab-rizk/xpcspy/releases/tag/v0.9.0
  9. https://pypi.org/project/xpcspy/0.9.0/

More in Native binaries

All 99 entries in Native binaries