# xpcspy

> Frida-powered command-line tool that observes XPC messages exchanged between processes on iOS and macOS in both directions, for understanding how Apple-platform apps and services talk over XPC. It can spawn or attach to a target over a USB or remote Frida connection, filter the trace by direction (incoming or outgoing) and by service name with wildcards, and optionally parse the binary-plist payloads carried in XPC dictionaries, with bplist00 and bplist16 described as officially supported and bplist15 and bplist17 as experimental. A Python CLI drives a TypeScript Frida agent that is compiled to JavaScript.

- Type: Tool
- Targets: App · Protocol
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-02
- Original resource: <https://github.com/ab-rizk/xpcspy>
- Primary source: <https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/README.md>
- Catalog page: <https://awesomerea.org/resources/xpcspy/>
- Record JSON: <https://awesomerea.org/resources/xpcspy/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/xpcspy/index.md)

## Requirements & limits

- Reviewed at tag v0.9.0 (the reviewed commit, last pushed 2026-05-11); the matching xpcspy 0.9.0 release was uploaded to PyPI the same day. requirements.txt pins frida ~=17.9.7 and frida-tools ~=14.8.2, so a compatible Frida must be present, and interception works only where that Frida can instrument the target: a local macOS process, or an iOS device reachable by a frida-server over USB (-U) or remotely (-R/-H).
- Install with pip3 install xpcspy for the CLI. Building from source uses the Makefile: the Frida agent under agent/ is a TypeScript project compiled with frida-compile (needs Node.js and npm), then python3 setup.py sdist packages the Python tool. The package metadata credits author hot3eed and points its homepage at github.com/hot3eed/xpcspy.
- The analyst chooses the process to inspect by name, PID, frontmost application or a spawned file; no sample files ship with the tool. It reads the XPC traffic of a running target for analysis and does not modify or inject messages. bplist parsing is partly experimental, and the README's TODO list notes recursive bplist deserialization and other unfinished work.
- Apache-2.0.

## Primary sources

1. <https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/README.md>
2. <https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/setup.py>
3. <https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/requirements.txt>
4. <https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/Makefile>
5. <https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/agent/package.json>
6. <https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/xpcspy/__init__.py>
7. <https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/LICENSE>
8. <https://github.com/ab-rizk/xpcspy/releases/tag/v0.9.0>
9. <https://pypi.org/project/xpcspy/0.9.0/>

## More in Native binaries

- [de4py](https://awesomerea.org/resources/de4py/index.md) · Tool
- [Dwarf](https://awesomerea.org/resources/dwarf-debugger/index.md) · Tool
- [bddisasm](https://awesomerea.org/resources/bddisasm/index.md) · Tool
- [decompyle3](https://awesomerea.org/resources/decompyle3/index.md) · Tool
- [DRAKVUF](https://awesomerea.org/resources/drakvuf/index.md) · Tool
- [ViperMonkey](https://awesomerea.org/resources/vipermonkey/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.