{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/setup.py",
    "https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/requirements.txt",
    "https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/Makefile",
    "https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/agent/package.json",
    "https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/xpcspy/__init__.py",
    "https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/LICENSE",
    "https://github.com/ab-rizk/xpcspy/releases/tag/v0.9.0",
    "https://pypi.org/project/xpcspy/0.9.0/"
  ],
  "category": "dynamic-analysis",
  "description_en": "Frida-powered command-line tool that observes XPC messages exchanged between processes on iOS and macOS in both directions, for understanding how Apple-platform apps and services talk over XPC. It can spawn or attach to a target over a USB or remote Frida connection, filter the trace by direction (incoming or outgoing) and by service name with wildcards, and optionally parse the binary-plist payloads carried in XPC dictionaries, with bplist00 and bplist16 described as officially supported and bplist15 and bplist17 as experimental. A Python CLI drives a TypeScript Frida agent that is compiled to JavaScript.",
  "description_zh": "基于 Frida 的命令行工具，可双向观察 iOS 和 macOS 上进程之间交换的 XPC 消息，用于理解 Apple 平台的应用与服务如何通过 XPC 通信。它可通过 USB 或远程 Frida 连接启动或附加到目标，按方向（传入或传出）和带通配符的服务名过滤跟踪，并可选解析 XPC 字典中携带的二进制 plist 负载，其中 bplist00 和 bplist16 被列为正式支持，bplist15 和 bplist17 为实验性。工具由 Python 命令行驱动一个编译为 JavaScript 的 TypeScript Frida 代理。",
  "entry_url": "https://awesomerea.org/resources/xpcspy/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/xpcspy/",
  "evidence_url": "https://github.com/ab-rizk/xpcspy/blob/07c5a5b323d85c578d7892dbeffdd88d0700b174/README.md",
  "group": "tools",
  "id": "xpcspy",
  "json_url": "https://awesomerea.org/resources/xpcspy/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/xpcspy/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/xpcspy/index.md",
  "name": "xpcspy",
  "name_zh": "xpcspy XPC 消息拦截工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Reviewed at tag v0.9.0 (the reviewed commit, last pushed 2026-05-11); the matching xpcspy 0.9.0 release was uploaded to PyPI the same day. requirements.txt pins frida ~=17.9.7 and frida-tools ~=14.8.2, so a compatible Frida must be present, and interception works only where that Frida can instrument the target: a local macOS process, or an iOS device reachable by a frida-server over USB (-U) or remotely (-R/-H).",
    "Install with pip3 install xpcspy for the CLI. Building from source uses the Makefile: the Frida agent under agent/ is a TypeScript project compiled with frida-compile (needs Node.js and npm), then python3 setup.py sdist packages the Python tool. The package metadata credits author hot3eed and points its homepage at github.com/hot3eed/xpcspy.",
    "The analyst chooses the process to inspect by name, PID, frontmost application or a spawned file; no sample files ship with the tool. It reads the XPC traffic of a running target for analysis and does not modify or inject messages. bplist parsing is partly experimental, and the README's TODO list notes recursive bplist deserialization and other unfinished work.",
    "Apache-2.0."
  ],
  "requirements_zh": [
    "审阅版本为标签 v0.9.0（即所审阅的提交，最后推送于 2026-05-11）；对应的 xpcspy 0.9.0 版当天上传至 PyPI。requirements.txt 固定 frida ~=17.9.7 和 frida-tools ~=14.8.2，因此需要存在兼容的 Frida，且拦截只能在该 Frida 能够插桩目标的场景下进行：本地 macOS 进程，或可通过 USB（-U）或远程（-R/-H）由 frida-server 访问的 iOS 设备。",
    "通过 pip3 install xpcspy 安装命令行工具。从源码构建使用 Makefile：agent/ 下的 Frida 代理是用 frida-compile 编译的 TypeScript 项目（需要 Node.js 和 npm），随后用 python3 setup.py sdist 打包 Python 工具。包元数据标注作者为 hot3eed，并将主页指向 github.com/hot3eed/xpcspy。",
    "分析者通过名称、PID、前台应用或启动的文件来选择要检查的进程；工具不附带任何样本文件。它读取运行中目标的 XPC 流量用于分析，不会修改或注入消息。bplist 解析部分仍属实验性，README 的 TODO 列表也提到递归 bplist 反序列化等尚未完成的工作。",
    "采用 Apache-2.0 许可。"
  ],
  "targets": [
    "app",
    "protocol"
  ],
  "url": "https://github.com/ab-rizk/xpcspy",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}