Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

xpcspy

Frida-powered command-line tool that observes XPC messages exchanged between processes on iOS and macOS in both directions, for understanding how Apple-platform apps and services talk over XPC. It can spawn or attach to a target over a USB or remote Frida connection, filter the trace by direction (incoming or outgoing) and by service name with wildcards, and optionally parse the binary-plist payloads carried in XPC dictionaries, with bplist00 and bplist16 described as officially supported and bplist15 and bplist17 as experimental. A Python CLI drives a TypeScript Frida agent that is compiled to JavaScript.

Targets
App · Protocol
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Reviewed at tag v0.9.0 (the reviewed commit, last pushed 2026-05-11); the matching xpcspy 0.9.0 release was uploaded to PyPI the same day. requirements.txt pins frida ~=17.9.7 and frida-tools ~=14.8.2, so a compatible Frida must be present, and interception works only where that Frida can instrument the target: a local macOS process, or an iOS device reachable by a frida-server over USB (-U) or remotely (-R/-H).
  • Install with pip3 install xpcspy for the CLI. Building from source uses the Makefile: the Frida agent under agent/ is a TypeScript project compiled with frida-compile (needs Node.js and npm), then python3 setup.py sdist packages the Python tool. The package metadata credits author hot3eed and points its homepage at github.com/hot3eed/xpcspy.
  • The analyst chooses the process to inspect by name, PID, frontmost application or a spawned file; no sample files ship with the tool. It reads the XPC traffic of a running target for analysis and does not modify or inject messages. bplist parsing is partly experimental, and the README's TODO list notes recursive bplist deserialization and other unfinished work.
  • Apache-2.0.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  2. setup.py GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  3. requirements.txt GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  4. Makefile GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  5. agent/package.json GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  6. xpcspy/__init__.py GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  7. LICENSE GitHub · ab-rizk/xpcspy · Revision 07c5a5b
  8. https://github.com/ab-rizk/xpcspy/releases/tag/v0.9.0
  9. https://pypi.org/project/xpcspy/0.9.0/

More in Native binaries

All 269 entries in Native binaries

↑↓ move↵ open⌘↵ new tab