xniff

xniff sniffs xpc or mach IPC communications going to and from a target process.

boot args

xniff is made for apple silicon, and likely requires the following boot args to be set in order to run properly.

-arm64e_preview_abi thid_should_crash=0 tss_should_crash=0 amfi_get_out_of_my_way=1

building xniff

to build xniff, use the shell script

./build.sh

capturing traffic

xniff supports capturing traffic from both newly created and preexisting processes.

newly created processes:

sudo build/xniff launch --xpc --out /tmp/out.xniff -- /usr/bin/shortcuts list

existing processes:

sudo build/xniff attach 1234 --mach --out /tmp/process.xniff

note that xniff doesn't remove its hooks so if you'd like to reattach xniff to a process you need to restart it

reading dumps

xniff has both a graphical and command line interface to interact with captured dumps.

to open a dump in the viewer:

build/xniff-viewer /tmp/screentime.xniff

to view in the terminal:

build/xniff-print /tmp/out.xniff