{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/ReverseApple/gxpc/blob/4fad36db87126c0b29b987472b5863206fb77ac2/main.go",
    "https://github.com/ReverseApple/gxpc/blob/4fad36db87126c0b29b987472b5863206fb77ac2/script.ts",
    "https://github.com/ReverseApple/gxpc/blob/4fad36db87126c0b29b987472b5863206fb77ac2/offsets.go",
    "https://github.com/ReverseApple/gxpc/blob/4fad36db87126c0b29b987472b5863206fb77ac2/go.mod",
    "https://github.com/ReverseApple/gxpc/blob/4fad36db87126c0b29b987472b5863206fb77ac2/.goreleaser.yaml",
    "https://github.com/ReverseApple/gxpc/blob/4fad36db87126c0b29b987472b5863206fb77ac2/.github/workflows/release.yml",
    "https://github.com/ReverseApple/gxpc/blob/4fad36db87126c0b29b987472b5863206fb77ac2/LICENSE",
    "https://github.com/ReverseApple/gxpc/releases/tag/v2.2.1"
  ],
  "category": "dynamic-analysis",
  "description_en": "macOS command-line XPC sniffer, inspired by xpcspy, that injects a Frida agent into an attached or newly spawned process and logs the XPC messages it sends and receives, labelled with the libxpc function, connection name, peer PID and process name. The agent recursively converts xpc_object_t dictionaries, arrays and scalar values into readable output and decodes binary-plist payloads, while a Go host built on frida-go selects a local, USB or remote Frida device, filters connections by name or PID and can save the trace to a file. It observes how Apple-platform apps and services communicate over XPC and does not alter or inject messages.",
  "description_zh": "受 xpcspy 启发的 macOS 命令行 XPC 嗅探工具：把 Frida 代理注入已附加或新启动的进程，记录其收发的 XPC 消息，并标出对应的 libxpc 函数、连接名、对端 PID 与进程名。代理会递归地把 xpc_object_t 字典、数组和标量值转换为可读输出，并解码二进制 plist 负载；基于 frida-go 的 Go 主程序负责选择本地、USB 或远程 Frida 设备，按名称或 PID 过滤连接，并可将跟踪结果保存到文件。它用于观察 Apple 平台应用与服务如何通过 XPC 通信，不会修改或注入消息。",
  "entry_url": "https://awesomerea.org/resources/gxpc/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/gxpc/",
  "evidence_url": "https://github.com/ReverseApple/gxpc/blob/4fad36db87126c0b29b987472b5863206fb77ac2/README.md",
  "group": "tools",
  "id": "gxpc",
  "json_url": "https://awesomerea.org/resources/gxpc/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/gxpc/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/gxpc/index.md",
  "name": "gxpc",
  "name_zh": "gxpc XPC 通信嗅探工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v2.2.1, published 2025-08-12, with macOS x86_64 and arm64 archives that GoReleaser links against the Frida 17.2.16 core devkit; the reviewed main commit adds only a cobra dependency bump (2025-09-02). Installing with go install instead needs Go, cgo and the Frida devkit set up as frida-go documents; go.mod declares Go 1.20 and frida-go 1.0.0.",
    "On first run the binary writes its embedded TypeScript agent and package files to a gxpc folder in the system temp directory, runs npm install for frida-objc-bridge and compiles the agent with Frida’s compiler, so Node.js, npm and network access are needed at least once; the compiled agent is then reused. The analyst picks the target by PID, process name or a file to spawn, on a local device (-i local), a USB device (the default) or a remote Frida server; the README documents no device setup or tested OS versions.",
    "Outgoing messages come from hooks on the public libxpc send, reply and notification functions, and new connections from xpc_connection_create_mach_service and xpc_connection_set_event_handler. Incoming messages rely on the private _xpc_connection_call_event_handler and __CFBinaryPlistCreate15, which the agent resolves from debug symbols and caches as offsets per machine and OS build in gxpc.conf in the user’s home directory (or a file given with -c). bplist16 payloads are decoded through an external jlutil executable when one is installed on the host, otherwise by the agent’s own parser or as base64. In the reviewed main.go the --whitelistp option reads the --whitelist value, so PID allow-listing may not work as documented.",
    "MIT. frida-go, the Frida devkit and frida-objc-bridge keep their own licenses, and jlutil is a separate third-party tool not shipped with gxpc."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v2.2.1，发布于 2025-08-12，提供由 GoReleaser 针对 Frida 17.2.16 core devkit 链接构建的 macOS x86_64 与 arm64 压缩包；所审阅的 main 分支提交只多了一次 cobra 依赖升级（2025-09-02）。若改用 go install 安装，需要 Go、cgo，并按 frida-go 文档配置 Frida devkit；go.mod 声明 Go 1.20 和 frida-go 1.0.0。",
    "首次运行时，程序会把内嵌的 TypeScript 代理及包文件写入系统临时目录下的 gxpc 文件夹，执行 npm install 安装 frida-objc-bridge，再用 Frida 编译器编译代理，因此至少需要一次 Node.js、npm 和网络访问；之后会复用已编译的代理。分析者可按 PID、进程名或待启动的文件选择目标，设备可以是本机（-i local）、USB 设备（默认）或远程 Frida 服务；README 未说明设备配置方法，也未列出测试过的系统版本。",
    "发出的消息通过挂钩公开的 libxpc 发送、回复与通知函数获取，新建连接则通过 xpc_connection_create_mach_service 和 xpc_connection_set_event_handler 记录。接收的消息依赖私有的 _xpc_connection_call_event_handler 和 __CFBinaryPlistCreate15，代理通过调试符号解析其地址，并按机型与系统构建号把偏移缓存到用户主目录下的 gxpc.conf（或以 -c 指定的文件）。bplist16 负载仅在宿主机安装了外部 jlutil 程序时由其解码，否则交给代理自带的解析器或以 base64 输出。在所审阅的 main.go 中，--whitelistp 选项读取的是 --whitelist 的值，因此按 PID 设置白名单可能无法按文档工作。",
    "采用 MIT 许可。frida-go、Frida devkit 与 frida-objc-bridge 保留各自许可证，jlutil 是另行提供的第三方工具，不随 gxpc 分发。"
  ],
  "targets": [
    "app",
    "protocol"
  ],
  "url": "https://github.com/ReverseApple/gxpc",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}