2018-12-06 18:31:498341人阅读
//callback
// invoked anytime anybody broadcasts a notification
static void callback(CFNotificationCenterRef center, void *observer, CFStringRef name_cf,
const void *object, CFDictionaryRef userInfo)
{
NSLog(@"event: %@", (__bridge NSString*)name_cf);
NSLog(@"user info: %@", userInfo);
NSLog(@"object: %@", (__bridge id)object);
return;
}
int main(int argc, const char * argv[])
{
//register for distributed notifications
// note: as name is nil, this means "all"
CFNotificationCenterAddObserver(CFNotificationCenterGetDistributedCenter(), nil, callback,
nil, nil, CFNotificationSuspensionBehaviorDeliverImmediately);
[[NSRunLoop currentRunLoop] run];
return 0;
}
- (void)addObserver:(id)observer
selector:(SEL)selector
name:(NSNotificationName)name
object:(NSString *)object
suspensionBehavior:(NSNotificationSuspensionBehavior)suspensionBehavior;
$ ./sniffsniff
2018-11-19 20:54:08.244963-1000 sniffsniff[50098:11034854] event: com.apple.screenIsLocked
2018-11-19 20:54:08.244994-1000 sniffsniff[50098:11034854] user info: (null)
2018-11-19 20:54:08.245039-1000 sniffsniff[50098:11034854] object: 501
2018-11-19 20:54:11.150683-1000 sniffsniff[50098:11034854] event: com.apple.screenIsUnlocked
2018-11-19 20:54:11.150727-1000 sniffsniff[50098:11034854] user info: (null)
2018-11-19 20:54:11.150751-1000 sniffsniff[50098:11034854] object: 501
2018-11-19 20:55:00.033848-1000 sniffsniff[50098:11034854] event: com.apple.screensaver.didlaunch
2018-11-19 20:55:00.033882-1000 sniffsniff[50098:11034854] user info: (null)
2018-11-19 20:55:00.033898-1000 sniffsniff[50098:11034854] object: (null)
2018-11-19 20:55:00.414571-1000 sniffsniff[50098:11034854] event: com.apple.screensaver.didstart
2018-11-19 20:55:00.414663-1000 sniffsniff[50098:11034854] user info: {
runFromPref = 0;
}
2018-11-19 20:55:02.744793-1000 sniffsniff[50098:11034854] event: com.apple.screensaver.willstop
2018-11-19 20:55:02.744831-1000 sniffsniff[50098:11034854] user info: (null)
2018-11-19 20:55:02.744843-1000 sniffsniff[50098:11034854] object: (null)
2018-11-19 20:55:02.760187-1000 sniffsniff[50098:11034854] event: com.apple.screensaver.didstop
2018-11-19 20:55:02.760292-1000 sniffsniff[50098:11034854] user info: {
runFromPref = 0;
}
2018-11-19 20:55:02.760312-1000 sniffsniff[50098:11034854] object: (null)
2018-11-19 20:55:15.733963-1000 sniffsniff[50098:11034854] event: IOBluetoothDeviceDisableScan
2018-11-19 20:55:15.733993-1000 sniffsniff[50098:11034854] user info: (null)
2018-11-19 20:55:15.734011-1000 sniffsniff[50098:11034854] object: (null)
2018-11-19 20:56:15.720241-1000 sniffsniff[50098:11034854] event: com.apple.CFNetwork.CookiesChanged.2e3972d12eadbbbef05326fe6f5f0c3e1c05bdcc
2018-11-19 20:56:15.720292-1000 sniffsniff[50098:11034854] user info: (null)
2018-11-19 20:56:15.720307-1000 sniffsniff[50098:11034854] object: (null)
2018-11-19 21:01:12.870597-1000 sniffsniff[50098:11034854] event: com.apple.DownloadFileFinished
2018-11-19 21:01:12.870626-1000 sniffsniff[50098:11034854] user info: (null)
2018-11-19 21:01:12.870641-1000 sniffsniff[50098:11034854] object: /Users/patrick/Downloads/LuLu_1.1.2.zip
$ ./sniffsniff
2018-11-19 21:21:41.202420-1000 sniffsniff[50388:11098618] *** attempt to register for all distributed notifications thwarted by sandboxing.
Date/Time: Mon Nov 19 21:21:41 2018
OS Version: 18B75
Application: sniffsniff
Backtrace:
0 CoreFoundation 0x00007fff3c082c46 __CFGenerateReport + 197
1 CoreFoundation 0x00007fff3c015f43 __CFXNotificationRegisterObserver + 1035
2 CoreFoundation 0x00007fff3bef1af2 _CFXNotificationRegisterObserver + 14
3 Foundation 0x00007fff3e28845a -[NSDistributedNotificationCenter
addObserver:selector:name:object:suspensionBehavior:] + 233
4 Foundation 0x00007fff3e28836b -[NSDistributedNotificationCenter
addObserver:selector:name:object:] + 29
5 sniffsniff 0x000000010000125e -[AppDelegate applicationDidFinishLaunching:] + 142
static void callback(CFNotificationCenterRef center, void *observer, CFStringRef name_cf, const void *object, CFDictionaryRef userInfo)
{
NSLog(@"event: %@", (__bridge NSString*)name_cf);
NSLog(@"user info: %@", userInfo);
NSLog(@"object: %@", (__bridge id)object);
return;
}
- (void)applicationDidFinishLaunching:(NSNotification *)aNotification {
NSString* name = @"com.apple.DownloadFileFinished";
CFNotificationCenterAddObserver(CFNotificationCenterGetDistributedCenter(), nil,
callback, (CFStringRef)name, nil, CFNotificationSuspensionBehaviorDeliverImmediately);
}
./sniffsniff
2018-11-22 12:50:38.175 sniffsniff[93641:15431613] event: com.apple.DownloadFileFinished
2018-11-22 12:50:38.175 sniffsniff[93641:15431613] user info: (null)
2018-11-22 12:50:38.175 sniffsniff[93641:15431613] object: /Users/user/Downloads/thePeeTapes.mov
import Cocoa
import MonitorKit
@NSApplicationMain
class AppDelegate: NSObject, NSApplicationDelegate {
func applicationDidFinishLaunching(_ aNotification: Notification) {
//call into MonitorKit
// enable 'distributed notifications' monitor
let monitor = DistributedNotifcationsMonitor()
monitor.start() { event in
print("event: ", event.name.rawValue)
if let userInfo = event.userInfo {
print("event info: ", userInfo)
}
if let object = event.object {
print("event object: ", object)
}
}
}
}
event info: [AnyHashable("bundleIDs"): <__NSArrayM 0x600000c57bd0>(
com.objective-see.KnockKnock)
event info: [AnyHashable("com.apple.dt.Xcode.editorCoordinatorCompletion.fileURL"): /Users/patrick/Documents/GitHub/DoNotDisturb/launchDaemon/launchDaemon/Lid.m, AnyHashable("com.apple.dt.Xcode.editorCoordinatorCompletion.reporterClass"): _IDEOpenRequest]
event info: [AnyHashable("originatorAuditToken"): ]
event object: com.apple.LSSharedFileList.ApplicationRecentDocuments/com.apple.ichat
event info: [AnyHashable("originatorAuditToken"): ]
event object: com.apple.LSSharedFileList.ApplicationRecentDocuments/com.apple.textedit
KextArrayKey = (
"com.apple.message.bundleID" = "com.objective-see.lulu";
"com.apple.message.kextname" = "LuLu.kext";
"com.apple.message.kextpath" = "/Library/Extensions/LuLu.kext";
"com.apple.message.signaturetype" = "3rd-party kext with devid+ certificate";)
event object: /Users/patrick/Downloads/LuLu_1.1.2.zip
event info: [AnyHashable("Device ID"): 288230377351874764, AnyHashable("Surface Width mm"): 130, AnyHashable("Device Type"): Trackpad, AnyHashable("SupportsActuation"): 0, AnyHashable("Built-in"): 0, AnyHashable("SupportsForce"): 0, AnyHashable("Surface Height mm"): 110, AnyHashable("Opaque"): 1]
event info: [AnyHashable("A2DP_CONNECTED_DEVICES"): 1, AnyHashable("PAGEABLE"): 2, AnyHashable("POWER_STATE"): 1, AnyHashable("ADDRESS"): 8c-85-90-14-95-11, AnyHashable("ESTIMATED_BANDWIDTH_UTILIZATION"): 65, AnyHashable("ACL_CONNECTION_COUNT"): 2, AnyHashable("HARDWARE_NAME"): 15, AnyHashable("CONNECTED_DEVICES"): <__NSArrayM 0x600000c0bf60>(
{
ADDRESS = "60-c5-47-89-08-cc";
NAME = "Apple Trackpad";
"PRODUCT_ID" = 782;
"SNIFF_ATTEMPTS" = 2;
"VENDOR_ID" = 1452;
},
{
ADDRESS = "04-52-c7-77-0d-4e";
NAME = "Bose QuietComfort 35";
"PRODUCT_ID" = 16396;
"SNIFF_ATTEMPTS" = 1;
"VENDOR_ID" = 158;
},
{
ADDRESS = "34-88-5d-6b-5b-49";
NAME = "Logitech K811";
"PRODUCT_ID" = 45847;
"SNIFF_ATTEMPTS" = 1;
"VENDOR_ID" = 1133;
})
event info: [AnyHashable("VolumeURL"): file:///Volumes/TSSCI_USB/, AnyHashable("VolumeRefNum"): -108]
本文翻译自:https://objective-see.com/blog/blog_0x39.html
翻译作者:41yf1sh 原文地址: http://www.4hou.com/system/14971.html