# gxpc > macOS command-line XPC sniffer, inspired by xpcspy, that injects a Frida agent into an attached or newly spawned process and logs the XPC messages it sends and receives, labelled with the libxpc function, connection name, peer PID and process name. The agent recursively converts xpc_object_t dictionaries, arrays and scalar values into readable output and decodes binary-plist payloads, while a Go host built on frida-go selects a local, USB or remote Frida device, filters connections by name or PID and can save the trace to a file. It observes how Apple-platform apps and services communicate over XPC and does not alter or inject messages. - Type: Tool - Targets: App · Protocol - Category: Debugging and dynamic analysis - Relationship: Foundation tool - Sources reviewed: 2026-10-20 - Added to the catalog: 2026-11-02 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/gxpc/index.md) ## Requirements & limits - Latest release at review: v2.2.1, published 2025-08-12, with macOS x86_64 and arm64 archives that GoReleaser links against the Frida 17.2.16 core devkit; the reviewed main commit adds only a cobra dependency bump (2025-09-02). Installing with go install instead needs Go, cgo and the Frida devkit set up as frida-go documents; go.mod declares Go 1.20 and frida-go 1.0.0. - On first run the binary writes its embedded TypeScript agent and package files to a gxpc folder in the system temp directory, runs npm install for frida-objc-bridge and compiles the agent with Frida’s compiler, so Node.js, npm and network access are needed at least once; the compiled agent is then reused. The analyst picks the target by PID, process name or a file to spawn, on a local device (-i local), a USB device (the default) or a remote Frida server; the README documents no device setup or tested OS versions. - Outgoing messages come from hooks on the public libxpc send, reply and notification functions, and new connections from xpc_connection_create_mach_service and xpc_connection_set_event_handler. Incoming messages rely on the private _xpc_connection_call_event_handler and __CFBinaryPlistCreate15, which the agent resolves from debug symbols and caches as offsets per machine and OS build in gxpc.conf in the user’s home directory (or a file given with -c). bplist16 payloads are decoded through an external jlutil executable when one is installed on the host, otherwise by the agent’s own parser or as base64. In the reviewed main.go the --whitelistp option reads the --whitelist value, so PID allow-listing may not work as documented. - MIT. frida-go, the Frida devkit and frida-objc-bridge keep their own licenses, and jlutil is a separate third-party tool not shipped with gxpc. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. 9. ## More in Native binaries - [Manticore](https://awesomerea.org/resources/manticore/index.md) · Tool - [Ghidra Ninja ghidra_scripts](https://awesomerea.org/resources/ghidra-ninja-scripts/index.md) · Tool - [FindCrypt - Ghidra Edition](https://awesomerea.org/resources/findcrypt-ghidra/index.md) · Tool - [Binary Refinery](https://awesomerea.org/resources/binary-refinery/index.md) · Tool - [AngryGhidra](https://awesomerea.org/resources/angryghidra/index.md) · Tool - [fpicker](https://awesomerea.org/resources/fpicker/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.