Full Code of troybowman/ios_instruments_client for AI

Repository: troybowman/ios_instruments_client
Branch: master
Commit: 4bf5fa83e41d
Files: 12
Total size: 42.8 KB

Directory structure:
gitextract_gsu1c1_y/

├── .gitignore
├── LICENSE
├── README.md
├── cftypes.cpp
├── cftypes.h
├── common.cpp
├── common.h
├── ios_instruments_client.cpp
├── ios_instruments_client.h
├── makefile
├── mobile_device.cpp
└── mobile_device.h

================================================
FILE CONTENTS
================================================

================================================
FILE: .gitignore
================================================
*.swp
obj/*
ios_instruments_client
ios_instruments_client.dSYM


================================================
FILE: LICENSE
================================================
MIT License

Copyright (c) 2018 Hex-Rays

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.


================================================
FILE: README.md
================================================
# ios\_instruments\_client

This is a command-line tool that can communicate with the iOS Instruments Server.

It was inspired by my work on the [dtxmsg](https://github.com/troybowman/dtxmsg) IDA plugin.

The app is implemented in C++. It should build/run on any recent version of OSX,
and it can work with any recent version of iOS.

## build

$ make

## run

$ ./ios\_instruments\_client -h


================================================
FILE: cftypes.cpp
================================================
#include <Foundation/Foundation.h>
#include "cftypes.h"

//------------------------------------------------------------------------------
string_t to_stlstr(CFStringRef ref)
{
  if ( ref == NULL )
    return "";

  CFIndex length = CFStringGetLength(ref);
  if ( length <= 0 )
    return "";

  CFIndex bufsize = CFStringGetMaximumSizeForEncoding(length, kCFStringEncodingUTF8) + 1;
  char *buf = (char *)calloc(bufsize, 1);

  string_t ret;
  if ( CFStringGetCString(ref, buf, bufsize, kCFStringEncodingUTF8) )
    ret = buf;

  free(buf);
  return ret;
}

//------------------------------------------------------------------------------
string_t get_description(CFTypeRef ref)
{
  CFStringRef desc = CFCopyDescription(ref);
  string_t ret = to_stlstr(desc);
  CFRelease(desc);
  return ret;
}

//-----------------------------------------------------------------------------
void archive(bytevec_t *buf, CFTypeRef ref)
{
  @autoreleasepool
  {
    id object = (__bridge id)ref;
    NSData *data = [NSKeyedArchiver archivedDataWithRootObject:object];
    const void *bytes = [data bytes];
    int length = [data length];
    append_v(*buf, bytes, length);
  }
}

//-----------------------------------------------------------------------------
CFTypeRef unarchive(const uint8_t *buf, size_t bufsize)
{
  @autoreleasepool
  {
    NSData *data = [NSData dataWithBytesNoCopy:(void *)buf length:bufsize freeWhenDone:false];
    id object = [NSKeyedUnarchiver unarchiveObjectWithData:data];
    return (__bridge CFTypeRef)[object retain];
  }
}

//-----------------------------------------------------------------------------
CFArrayRef deserialize(
        const uint8_t *buf,
        size_t bufsize,
        string_t *errbuf)
{
  if ( bufsize < 16 )
  {
    sprnt(errbuf, "Error: buffer of size 0x%lx is too small for a serialized array", bufsize);
    return NULL;
  }

  uint64_t size = *((uint64_t *)buf+1);
  if ( size > bufsize )
  {
    sprnt(errbuf, "size of array object (%llx) is larger than total length of data (%lx)", size, bufsize);
    return NULL;
  }

  CFMutableArrayRef array = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);

  uint64_t off = sizeof(uint64_t) * 2;
  uint64_t end = off + size;

  while ( off < end )
  {
    int length = 0;
    int type = *((int *)(buf+off));
    off += sizeof(int);

    CFTypeRef ref = NULL;

    switch ( type )
    {
      case 2:
        // archived object
        length = *((int *)(buf+off));
        off += sizeof(int);
        ref = unarchive(buf+off, length);
        break;

      case 3:
      case 5:
        // 32-bit int
        ref = CFNumberCreate(NULL, kCFNumberSInt32Type, buf+off);
        length = 4;
        break;

      case 4:
      case 6:
        // 64-bit int
        ref = CFNumberCreate(NULL, kCFNumberSInt64Type, buf+off);
        length = 8;
        break;

      case 10:
        // dictionary key. for arrays, the keys are empty and we ignore them
        continue;

      default:
        // there are more. we will deal with them as necessary
        break;
    }

    if ( ref == NULL )
    {
      sprnt(errbuf, "invalid object at offset %llx, type: %d\n", off, type);
      return NULL;
    }

    CFArrayAppendValue(array, ref);
    CFRelease(ref);
    off += length;
  }

  return (CFArrayRef)array;
}


================================================
FILE: cftypes.h
================================================
#ifndef CFTYPES_H
#define CFTYPES_H

#include <CoreFoundation/CoreFoundation.h>
#include "common.h"

//------------------------------------------------------------------------------
// convert the given CFString to an STL string
string_t to_stlstr(CFStringRef ref);

//------------------------------------------------------------------------------
// get a human readable description of the given CF object
string_t get_description(CFTypeRef ref);

//------------------------------------------------------------------------------
// serialize a CF object
void archive(bytevec_t *buf, CFTypeRef ref);

//------------------------------------------------------------------------------
// deserialize a CF object
CFTypeRef unarchive(const uint8_t *buf, size_t bufsize);

//------------------------------------------------------------------------------
// deserialize an array of CF objects
CFArrayRef deserialize(const uint8_t *buf, size_t bufsize, string_t *errbuf = NULL);

#endif // CFTYPES_H


================================================
FILE: common.cpp
================================================
#include "common.h"

#define MAXSTR 1024

//-----------------------------------------------------------------------------
void append_v(bytevec_t &out, const void *v, size_t len)
{
  const uint8_t *begin = (const uint8_t *)v;
  const uint8_t *end   = begin + len;
  out.insert(out.end(), begin, end);
}

//-----------------------------------------------------------------------------
void append_d(bytevec_t &out, uint32_t num)
{
  append_v(out, &num, sizeof(num));
}

//-----------------------------------------------------------------------------
void append_q(bytevec_t &out, uint64_t num)
{
  append_v(out, &num, sizeof(num));
}

//-----------------------------------------------------------------------------
void append_b(bytevec_t &out, const bytevec_t &bv)
{
  append_v(out, bv.data(), bv.size());
}

//-----------------------------------------------------------------------------
void vsprnt(string_t *out, const char *format, va_list va)
{
  char buf[MAXSTR];
  if ( out != NULL && vsnprintf(buf, sizeof(buf), format, va) > 0 )
    *out = buf;
}

//-----------------------------------------------------------------------------
void sprnt(string_t *out, const char *format, ...)
{
  va_list va;
  va_start(va, format);
  vsprnt(out, format, va);
  va_end(va);
}


================================================
FILE: common.h
================================================
#ifndef COMMON_H
#define COMMON_H

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string>
#include <vector>

typedef std::string string_t;
typedef std::vector<uint8_t> bytevec_t;

void append_d(bytevec_t &out, uint32_t num);
void append_q(bytevec_t &out, uint64_t num);
void append_b(bytevec_t &out, const bytevec_t &bv);
void append_v(bytevec_t &out, const void *v, size_t len);

void sprnt(string_t *out, const char *format, ...);
void vsprnt(string_t *out, const char *format, va_list va);

#endif // COMMON_H


================================================
FILE: ios_instruments_client.cpp
================================================
#include "ios_instruments_client.h"
#include "mobile_device.h"
#include <unistd.h>

static string_t device_id;              // user's preferred device (-d option)
static bool found_device = false;       // has the user's preferred device been detected?
static bool verbose = false;            // verbose mode (-v option)
static int cur_message = 0;             // current message id
static int cur_channel = 0;             // current channel id
static CFDictionaryRef channels = NULL; // list of available channels published by the instruments server
static int pid2kill = -1;               // process id to kill ("kill" option)
static const char *bid2launch = NULL;   // bundle id of app to launch ("launch" option)
static bool proclist = false;           // print the process list ("proclist" option)
static bool applist = false;            // print the application list ("applist" option)
static bool ssl_enabled = false;        // does the instruments server use SSL?

//-----------------------------------------------------------------------------
void message_aux_t::append_int(int32_t val)
{
  append_d(buf, 10);  // empty dictionary key
  append_d(buf, 3);   // 32-bit int
  append_d(buf, val);
}

//-----------------------------------------------------------------------------
void message_aux_t::append_long(int64_t val)
{
  append_d(buf, 10);  // empty dictionary key
  append_d(buf, 4);   // 64-bit int
  append_q(buf, val);
}

//-----------------------------------------------------------------------------
void message_aux_t::append_obj(CFTypeRef obj)
{
  append_d(buf, 10);  // empty dictionary key
  append_d(buf, 2);   // archived object

  bytevec_t tmp;
  archive(&tmp, obj);

  append_d(buf, tmp.size());
  append_b(buf, tmp);
}

//-----------------------------------------------------------------------------
void message_aux_t::get_bytes(bytevec_t *out) const
{
  if ( !buf.empty() )
  {
    // the final serialized array must start with a magic qword,
    // followed by the total length of the array data as a qword,
    // followed by the array data itself.
    append_q(*out, 0x1F0);
    append_q(*out, buf.size());
    append_b(*out, buf);
  }
}

//-----------------------------------------------------------------------------
// callback that handles device notifications. called once for each connected device.
static void device_callback(am_device_notification_callback_info *cbi, void *arg)
{
  if ( cbi->code != ADNCI_MSG_CONNECTED )
    return;

  CFStringRef id = MobileDevice.AMDeviceCopyDeviceIdentifier(cbi->dev);
  string_t _device_id = to_stlstr(id);
  CFRelease(id);

  if ( !device_id.empty() && device_id != _device_id )
    return;

  found_device = true;

  if ( verbose )
    printf("found device: %s\n", _device_id.c_str());

  do
  {
    // start a session on the device
    if ( MobileDevice.AMDeviceConnect(cbi->dev) != kAMDSuccess
      || MobileDevice.AMDeviceIsPaired(cbi->dev) == 0
      || MobileDevice.AMDeviceValidatePairing(cbi->dev) != kAMDSuccess
      || MobileDevice.AMDeviceStartSession(cbi->dev) != kAMDSuccess )
    {
      fprintf(stderr, "Error: failed to start a session on the device\n");
      break;
    }

    am_device_service_connection **connptr = (am_device_service_connection **)arg;

    // launch the instruments server
    mach_error_t err = MobileDevice.AMDeviceSecureStartService(
            cbi->dev,
            CFSTR("com.apple.instruments.remoteserver"),
            NULL,
            connptr);

    if ( err != kAMDSuccess )
    {
      // try again with an SSL-enabled service, commonly used after iOS 14
      err = MobileDevice.AMDeviceSecureStartService(
              cbi->dev,
              CFSTR("com.apple.instruments.remoteserver.DVTSecureSocketProxy"),
              NULL,
              connptr);

      if ( err != kAMDSuccess )
      {
        fprintf(stderr, "Failed to start the instruments server (0x%x). "
                 "Perhaps DeveloperDiskImage.dmg is not installed on the device?\n", err);
        break;
      }

      ssl_enabled = true;
    }

    if ( verbose )
      printf("successfully launched instruments server\n");
  }
  while ( false );

  MobileDevice.AMDeviceStopSession(cbi->dev);
  MobileDevice.AMDeviceDisconnect(cbi->dev);

  CFRunLoopStop(CFRunLoopGetCurrent());
}

//-----------------------------------------------------------------------------
// launch the instruments server on the user's device.
// returns a handle that can be used to send/receive data to/from the server.
static am_device_service_connection *start_server(void)
{
  am_device_notification *notify_handle = NULL;
  am_device_service_connection *conn = NULL;

  mach_error_t err = MobileDevice.AMDeviceNotificationSubscribe(
          device_callback,
          0,
          0,
          &conn,
          &notify_handle);

  if ( err != kAMDSuccess )
  {
    fprintf(stderr, "failed to register device notifier: 0x%x\n", err);
    return NULL;
  }

  // start a run loop, and wait for the device notifier to call our callback function.
  // if no device was detected within 3 seconds, we bail out.
  CFRunLoopRunInMode(kCFRunLoopDefaultMode, 3, false);

  MobileDevice.AMDeviceNotificationUnsubscribe(notify_handle);

  if ( conn == NULL && !found_device )
  {
    if ( device_id.empty() )
      fprintf(stderr, "Failed to find a connected device\n");
    else
      fprintf(stderr, "Failed to find device with id = %s\n", device_id.c_str());
    return NULL;
  }

  return conn;
}

//-----------------------------------------------------------------------------
// "call" an Objective-C method in the instruments server process
//   conn           server handle
//   channel        determines the object that will receive the message,
//                  obtained by a previous call to make_channel()
//   selector       method name
//   args           serialized list of arguments for the method
//   expects_reply  do we expect a return value from the method?
//                  the return value can be obtained by a subsequent call to recv_message()
static bool send_message(
        am_device_service_connection *conn,
        int channel,
        CFStringRef selector,
        const message_aux_t *args,
        bool expects_reply = true)
{
  uint32_t id = ++cur_message;

  bytevec_t aux;
  if ( args != NULL )
    args->get_bytes(&aux);

  bytevec_t sel;
  if ( selector != NULL )
    archive(&sel, selector);

  DTXMessagePayloadHeader pheader;
  // the low byte of the payload flags represents the message type.
  // so far it seems that all requests to the instruments server have message type 2.
  pheader.flags = 0x2 | (expects_reply ? 0x1000 : 0);
  pheader.auxiliaryLength = aux.size();
  pheader.totalLength = aux.size() + sel.size();

  DTXMessageHeader mheader;
  mheader.magic = 0x1F3D5B79;
  mheader.cb = sizeof(DTXMessageHeader);
  mheader.fragmentId = 0;
  mheader.fragmentCount = 1;
  mheader.length = sizeof(pheader) + pheader.totalLength;
  mheader.identifier = id;
  mheader.conversationIndex = 0;
  mheader.channelCode = channel;
  mheader.expectsReply = (expects_reply ? 1 : 0);

  bytevec_t msg;
  append_v(msg, &mheader, sizeof(mheader));
  append_v(msg, &pheader, sizeof(pheader));
  append_b(msg, aux);
  append_b(msg, sel);

  size_t msglen = msg.size();
  ssize_t nsent = ssl_enabled
                ? MobileDevice.AMDServiceConnectionSend(conn, msg.data(), msglen)
                : write(MobileDevice.AMDServiceConnectionGetSocket(conn), msg.data(), msglen);
  if ( nsent != msglen )
  {
    fprintf(stderr, "Failed to send 0x%lx bytes of message: %s\n", msglen, strerror(errno));
    return false;
  }

  return true;
}

//-----------------------------------------------------------------------------
// handle a response from the server.
//   conn    server handle
//   retobj  contains the return value for the method invoked by send_message()
//   aux     usually empty, except in specific situations (see _notifyOfPublishedCapabilities)
static bool recv_message(
        am_device_service_connection *conn,
        CFTypeRef *retobj,
        CFArrayRef *aux)
{
  uint32_t id = 0;
  bytevec_t payload;

  int sock = MobileDevice.AMDServiceConnectionGetSocket(conn);

  while ( true )
  {
    DTXMessageHeader mheader;
    ssize_t nrecv = ssl_enabled
                  ? MobileDevice.AMDServiceConnectionReceive(conn, &mheader, sizeof(mheader))
                  : read(sock, &mheader, sizeof(mheader));
    if ( nrecv != sizeof(mheader) )
    {
      fprintf(stderr, "failed to read message header: %s, nrecv = %lx\n", strerror(errno), nrecv);
      return false;
    }

    if ( mheader.magic != 0x1F3D5B79 )
    {
      fprintf(stderr, "bad header magic: %x\n", mheader.magic);
      return false;
    }

    if ( mheader.conversationIndex == 1 )
    {
      // the message is a response to a previous request, so it should have the same id as the request
      if ( mheader.identifier != cur_message )
      {
        fprintf(stderr, "expected response to message id=%d, got a new message with id=%d\n", cur_message, mheader.identifier);
        return false;
      }
    }
    else if ( mheader.conversationIndex == 0 )
    {
      // the message is not a response to a previous request. in this case, different iOS versions produce different results.
      // on iOS 9, the incoming message can have the same message ID has the previous message we sent to the server.
      // on later versions, the incoming message will have a new message ID. we must be aware of both situations.
      if ( mheader.identifier > cur_message )
      {
        // new message id, we must update the count on our side
        cur_message = mheader.identifier;
      }
      else if ( mheader.identifier < cur_message )
      {
        // the id must match the previous request, anything else doesn't really make sense
        fprintf(stderr, "unexpected message ID: %d\n", mheader.identifier);
        return false;
      }
    }
    else
    {
      fprintf(stderr, "invalid conversation index: %d\n", mheader.conversationIndex);
      return false;
    }

    if ( mheader.fragmentId == 0 )
    {
      id = mheader.identifier;
      // when reading multiple message fragments, the 0th fragment contains only a message header
      if ( mheader.fragmentCount > 1 )
        continue;
    }

    // read the entire payload in the current fragment
    bytevec_t frag;
    append_v(frag, &mheader, sizeof(mheader));
    frag.resize(frag.size() + mheader.length);

    uint8_t *data = frag.data() + sizeof(mheader);

    uint32_t nbytes = 0;
    while ( nbytes < mheader.length )
    {
      uint8_t *curptr = data + nbytes;
      size_t curlen = mheader.length - nbytes;
      nrecv = ssl_enabled
            ? MobileDevice.AMDServiceConnectionReceive(conn, curptr, curlen)
            : read(sock, curptr, curlen);
      if ( nrecv <= 0 )
      {
        fprintf(stderr, "failed reading from socket: %s\n", strerror(errno));
        return false;
      }
      nbytes += nrecv;
    }

    // append to the incremental payload
    append_v(payload, data, mheader.length);

    // done reading message fragments?
    if ( mheader.fragmentId == mheader.fragmentCount - 1 )
      break;
  }

  const DTXMessagePayloadHeader *pheader = (const DTXMessagePayloadHeader *)payload.data();

  // we don't know how to decompress messages yet
  uint8_t compression = (pheader->flags & 0xFF000) >> 12;
  if ( compression != 0 )
  {
    fprintf(stderr, "message is compressed (compression type %d)\n", compression);
    return false;
  }

  // serialized object array is located just after payload header
  const uint8_t *auxptr = payload.data() + sizeof(DTXMessagePayloadHeader);
  uint32_t auxlen = pheader->auxiliaryLength;

  // archived payload object appears after the auxiliary array
  const uint8_t *objptr = auxptr + auxlen;
  uint64_t objlen = pheader->totalLength - auxlen;

  if ( auxlen != 0 && aux != NULL )
  {
    string_t errbuf;
    CFArrayRef _aux = deserialize(auxptr, auxlen, &errbuf);
    if ( _aux == NULL )
    {
      fprintf(stderr, "Error: %s\n", errbuf.c_str());
      return false;
    }
    *aux = _aux;
  }

  if ( objlen != 0 && retobj != NULL )
    *retobj = unarchive(objptr, objlen);

  return true;
}

//-----------------------------------------------------------------------------
// perform the initial client-server handshake.
// here we retrieve the list of available channels published by the instruments server.
// we can open a given channel with make_channel().
static bool perform_handshake(am_device_service_connection *conn)
{
  // I'm not sure if this argument is necessary - but Xcode uses it, so I'm using it too.
  CFMutableDictionaryRef capabilities = CFDictionaryCreateMutable(NULL, 0, NULL, NULL);

  int64_t _v1 = 1;
  int64_t _v2 = 2;

  CFNumberRef v1 = CFNumberCreate(NULL, kCFNumberSInt64Type, &_v1);
  CFNumberRef v2 = CFNumberCreate(NULL, kCFNumberSInt64Type, &_v2);

  CFDictionaryAddValue(capabilities, CFSTR("com.apple.private.DTXBlockCompression"), v2);
  CFDictionaryAddValue(capabilities, CFSTR("com.apple.private.DTXConnection"), v1);

  // serialize the dictionary
  message_aux_t args;
  args.append_obj(capabilities);

  CFRelease(capabilities);
  CFRelease(v1);
  CFRelease(v2);

  if ( !send_message(conn, 0, CFSTR("_notifyOfPublishedCapabilities:"), &args, false) )
    return false;

  CFTypeRef obj = NULL;
  CFArrayRef aux = NULL;

  // we are now expecting the server to reply with the same message.
  // a description of all available channels will be provided in the arguments list.
  if ( !recv_message(conn, &obj, &aux) || obj == NULL || aux == NULL )
  {
    fprintf(stderr, "Error: failed to receive response from _notifyOfPublishedCapabilities:\n");
    return false;
  }

  bool ok = false;
  do
  {
    if ( CFGetTypeID(obj) != CFStringGetTypeID()
      || to_stlstr((CFStringRef)obj) != "_notifyOfPublishedCapabilities:" )
    {
      fprintf(stderr, "Error: unexpected message selector: %s\n", get_description(obj).c_str());
      break;
    }

    CFDictionaryRef _channels;

    // extract the channel list from the arguments
    if ( CFArrayGetCount(aux) != 1
      || (_channels = (CFDictionaryRef)CFArrayGetValueAtIndex(aux, 0)) == NULL
      || CFGetTypeID(_channels) != CFDictionaryGetTypeID()
      || CFDictionaryGetCount(_channels) == 0 )
    {
      fprintf(stderr, "channel list has an unexpected format:\n%s\n", get_description(aux).c_str());
      break;
    }

    channels = (CFDictionaryRef)CFRetain(_channels);

    if ( verbose )
      printf("channel list:\n%s\n", get_description(channels).c_str());

    ok = true;
  }
  while ( false );

  CFRelease(obj);
  CFRelease(aux);

  return ok;
}

//-----------------------------------------------------------------------------
// establish a connection to a service in the instruments server process.
// the channel identifier should be in the list of channels returned by the server
// in perform_handshake(). after a channel is established, you can use send_message()
// to remotely invoke Objective-C methods.
static int make_channel(am_device_service_connection *conn, CFStringRef identifier)
{
  if ( !CFDictionaryContainsKey(channels, identifier) )
  {
    fprintf(stderr, "channel %s is not supported by the server\n", to_stlstr(identifier).c_str());
    return -1;
  }

  int code = ++cur_channel;

  message_aux_t args;
  args.append_int(code);
  args.append_obj(identifier);

  CFTypeRef retobj = NULL;

  // request to open the channel, expect an empty reply
  if ( !send_message(conn, 0, CFSTR("_requestChannelWithCode:identifier:"), &args)
    || !recv_message(conn, &retobj, NULL) )
  {
    return -1;
  }

  if ( retobj != NULL )
  {
    fprintf(stderr, "Error: _requestChannelWithCode:identifier: returned %s\n", get_description(retobj).c_str());
    CFRelease(retobj);
    return -1;
  }

  return code;
}

//-----------------------------------------------------------------------------
// invoke method -[DTDeviceInfoService runningProcesses]
//   args:    none
//   returns: CFArrayRef procs
static bool print_proclist(am_device_service_connection *conn)
{
  int channel = make_channel(conn, CFSTR("com.apple.instruments.server.services.deviceinfo"));
  if ( channel < 0 )
    return false;

  CFTypeRef retobj = NULL;

  if ( !send_message(conn, channel, CFSTR("runningProcesses"), NULL)
    || !recv_message(conn, &retobj, NULL)
    || retobj == NULL )
  {
    fprintf(stderr, "Error: failed to retrieve return value for runningProcesses\n");
    return false;
  }

  bool ok = true;
  if ( CFGetTypeID(retobj) == CFArrayGetTypeID() )
  {
    CFArrayRef array = (CFArrayRef)retobj;

    printf("proclist:\n");
    for ( size_t i = 0, size = CFArrayGetCount(array); i < size; i++ )
    {
      CFDictionaryRef dict = (CFDictionaryRef)CFArrayGetValueAtIndex(array, i);

      CFStringRef _name = (CFStringRef)CFDictionaryGetValue(dict, CFSTR("name"));
      string_t name = to_stlstr(_name);

      CFNumberRef _pid = (CFNumberRef)CFDictionaryGetValue(dict, CFSTR("pid"));
      int pid = 0;
      CFNumberGetValue(_pid, kCFNumberSInt32Type, &pid);

      printf("%6d %s\n", pid, name.c_str());
    }
  }
  else
  {
    fprintf(stderr, "Error: process list is not in the expected format: %s\n", get_description(retobj).c_str());
    ok = false;
  }

  CFRelease(retobj);
  return ok;
}

//-----------------------------------------------------------------------------
// invoke method -[DTApplicationListingService installedApplicationsMatching:registerUpdateToken:]
//   args:   CFDictionaryRef dict
//           CFStringRef token
//   returns CFArrayRef apps
static bool print_applist(am_device_service_connection *conn)
{
  int channel = make_channel(conn, CFSTR("com.apple.instruments.server.services.device.applictionListing"));
  if ( channel < 0 )
    return false;

  // the method expects a dictionary and a string argument.
  // pass empty values so we get descriptions for all known applications.
  CFDictionaryRef dict = CFDictionaryCreate(NULL, NULL, NULL, 0, NULL, NULL);

  message_aux_t args;
  args.append_obj(dict);
  args.append_obj(CFSTR(""));

  CFRelease(dict);

  CFTypeRef retobj = NULL;

  if ( !send_message(conn, channel, CFSTR("installedApplicationsMatching:registerUpdateToken:"), &args)
    || !recv_message(conn, &retobj, NULL)
    || retobj == NULL )
  {
    fprintf(stderr, "Error: failed to retrieve applist\n");
    return false;
  }

  bool ok = true;
  if ( CFGetTypeID(retobj) == CFArrayGetTypeID() )
  {
    CFArrayRef array = (CFArrayRef)retobj;
    for ( size_t i = 0, size = CFArrayGetCount(array); i < size; i++ )
    {
      CFDictionaryRef app_desc = (CFDictionaryRef)CFArrayGetValueAtIndex(array, i);
      printf("%s\n", get_description(app_desc).c_str());
    }
  }
  else
  {
    fprintf(stderr, "apps list has an unexpected format: %s\n", get_description(retobj).c_str());
    ok = false;
  }

  CFRelease(retobj);
  return ok;
}

//-----------------------------------------------------------------------------
// invoke method -[DTProcessControlService killPid:]
//   args:    CFNumberRef process_id
//   returns: void
static bool kill(am_device_service_connection *conn, int pid)
{
  int channel = make_channel(conn, CFSTR("com.apple.instruments.server.services.processcontrol"));
  if ( channel < 0 )
    return false;

  CFNumberRef _pid = CFNumberCreate(NULL, kCFNumberSInt32Type, &pid);

  message_aux_t args;
  args.append_obj(_pid);

  CFRelease(_pid);

  return send_message(conn, channel, CFSTR("killPid:"), &args, false);
}

//-----------------------------------------------------------------------------
// invoke method -[DTProcessControlService launchSuspendedProcessWithDevicePath:bundleIdentifier:environment:arguments:]
//   args:    CFStringRef app_path
//            CFStringRef bundle_id
//            CFArrayRef args_for_app
//            CFDictionaryRef environment_vars
//            CFDictionaryRef launch_options
//   returns: CFNumberRef pid
static bool launch(am_device_service_connection *conn, const char *_bid)
{
  int channel = make_channel(conn, CFSTR("com.apple.instruments.server.services.processcontrol"));
  if ( channel < 0 )
    return false;

  // app path: not used, just pass empty string
  CFStringRef path = CFStringCreateWithCString(NULL, "", kCFStringEncodingUTF8);
  // bundle id
  CFStringRef bid = CFStringCreateWithCString(NULL, _bid, kCFStringEncodingUTF8);
  // args for app: not used, just pass empty array
  CFArrayRef appargs = CFArrayCreate(NULL, NULL, 0, NULL);
  // environment variables: not used, just pass empty dictionary
  CFDictionaryRef env = CFDictionaryCreate(NULL, NULL, NULL, 0, NULL, NULL);

  // launch options
  int _v0 = 0; // don't suspend the process after starting it
  int _v1 = 1; // kill the application if it is already running

  CFNumberRef v0 = CFNumberCreate(NULL, kCFNumberSInt32Type, &_v0);
  CFNumberRef v1 = CFNumberCreate(NULL, kCFNumberSInt32Type, &_v1);

  const void *keys[] =
  {
    CFSTR("StartSuspendedKey"),
    CFSTR("KillExisting")
  };
  const void *values[] = { v0, v1 };
  CFDictionaryRef options = CFDictionaryCreate(
        NULL,
        keys,
        values,
        2,
        NULL,
        NULL);

  message_aux_t args;
  args.append_obj(path);
  args.append_obj(bid);
  args.append_obj(env);
  args.append_obj(appargs);
  args.append_obj(options);

  CFRelease(v1);
  CFRelease(v0);
  CFRelease(options);
  CFRelease(env);
  CFRelease(appargs);
  CFRelease(bid);
  CFRelease(path);

  CFTypeRef retobj = NULL;

  if ( !send_message(conn, channel, CFSTR("launchSuspendedProcessWithDevicePath:bundleIdentifier:environment:arguments:options:"), &args)
    || !recv_message(conn, &retobj, NULL)
    || retobj == NULL )
  {
    fprintf(stderr, "Error: failed to launch %s\n", _bid);
    return false;
  }

  bool ok = true;
  if ( CFGetTypeID(retobj) == CFNumberGetTypeID() )
  {
    CFNumberRef _pid = (CFNumberRef)retobj;
    int pid = 0;
    CFNumberGetValue(_pid, kCFNumberSInt32Type, &pid);
    printf("pid: %d\n", pid);
  }
  else
  {
    fprintf(stderr, "failed to retrieve the process ID: %s\n", get_description(retobj).c_str());
    ok = false;
  }

  CFRelease(retobj);
  return ok;
}

//-----------------------------------------------------------------------------
static void usage(const char *prog)
{
  fprintf(stderr, "usage: %s [-v] [-d <device id>] TASK <task args>\n"
           "\n"
           "This is a sample client application for the iOS Instruments server.\n"
           "It is capable of rudimentary communication with the server and can\n"
           "ask it to perform some interesting tasks.\n"
           "\n"
           "TASK can be one of the following:\n"
           "  proclist  - print a list of running processes\n"
           "  applist   - print a list of installed applications\n"
           "  launch    - launch a given app. provide the bundle id of the app to launch\n"
           "  kill      - kill a given process. provide the pid of the process to kill\n"
           "\n"
           "other args:\n"
           "  -v  more verbose output\n"
           "  -d  device ID. if empty, this app will use the first device it finds\n", prog);
}

//-----------------------------------------------------------------------------
static bool parse_args(int argc, const char **argv)
{
  if ( argc > 1 )
  {
    for ( int i = 1; i < argc; )
    {
      if ( strcmp("-v", argv[i]) == 0 )
      {
        verbose = true;
        i++;
        continue;
      }
      else if ( strcmp("-d", argv[i]) == 0 )
      {
        if ( i == argc - 1 )
        {
          fprintf(stderr, "Error: -d option requires a device id string\n");
          break;
        }
        device_id = argv[i+1];
        i += 2;
        continue;
      }

      string_t task = argv[i];

      if ( task == "proclist" )
      {
        proclist = true;
        return true;
      }
      else if ( task == "applist" )
      {
        applist = true;
        return true;
      }
      else if ( task == "kill" )
      {
        if ( i == argc - 1 )
        {
          fprintf(stderr, "Error: \"kill\" requires a process id\n");
          break;
        }
        pid2kill = atoi(argv[i+1]);
        return true;
      }
      else if ( task == "launch" )
      {
        if ( i == argc - 1 )
        {
          fprintf(stderr, "Error: \"launch\" requires a bundle id\n");
          break;
        }
        bid2launch = argv[i+1];
        return true;
      }

      fprintf(stderr, "Error, invalid task: %s\n", task.c_str());
      break;
    }
  }

  usage(argv[0]);
  return false;
}

//-----------------------------------------------------------------------------
int main(int argc, const char **argv)
{
  if ( !parse_args(argc, argv) )
    return EXIT_FAILURE;

  if ( !MobileDevice.load() )
    return EXIT_FAILURE;

  am_device_service_connection *conn = start_server();
  if ( conn == NULL )
    return EXIT_FAILURE;

  bool ok = false;
  if ( perform_handshake(conn) )
  {
    if ( proclist )
      ok = print_proclist(conn);
    else if ( applist )
      ok = print_applist(conn);
    else if ( pid2kill > 0 )
      ok = kill(conn, pid2kill);
    else if ( bid2launch != NULL )
      ok = launch(conn, bid2launch);
    else
      ok = true;

    CFRelease(channels);
  }

  MobileDevice.AMDServiceConnectionInvalidate(conn);
  CFRelease(conn);

  return ok ? EXIT_SUCCESS : EXIT_FAILURE;
}


================================================
FILE: ios_instruments_client.h
================================================
#ifndef IOS_INSTRUMENTS_CLIENT
#define IOS_INSTRUMENTS_CLIENT

#include "cftypes.h"

//-----------------------------------------------------------------------------
struct DTXMessageHeader
{
  uint32_t magic;
  uint32_t cb;
  uint16_t fragmentId;
  uint16_t fragmentCount;
  uint32_t length;
  uint32_t identifier;
  uint32_t conversationIndex;
  uint32_t channelCode;
  uint32_t expectsReply;
};

//-----------------------------------------------------------------------------
struct DTXMessagePayloadHeader
{
  uint32_t flags;
  uint32_t auxiliaryLength;
  uint64_t totalLength;
};

//------------------------------------------------------------------------------
// helper class for serializing method arguments
class message_aux_t
{
  bytevec_t buf;

public:
  void append_int(int32_t val);
  void append_long(int64_t val);
  void append_obj(CFTypeRef obj);

  void get_bytes(bytevec_t *out) const;
};

#endif // IOS_INSTRUMENTS_CLIENT


================================================
FILE: makefile
================================================
T = ios_instruments_client
O = obj
all: $(T)
.PHONY: all clean

CFLAGS = -g -O0 -mmacosx-version-min=10.9

ifeq ($(wildcard $(O)/.),)
  $(shell mkdir -p 2>/dev/null $(O))
endif

MAIN    = $(O)/$(T).o
COMMON  = $(O)/common.o
CFTYPES = $(O)/cftypes.o
MD      = $(O)/mobile_device.o

$(T): $(MAIN) $(COMMON) $(CFTYPES) $(MD)
	g++ $(CFLAGS) -o $@ $^ -lobjc -framework Foundation -framework CoreFoundation

$(MAIN): $(T).cpp $(T).h cftypes.h common.h mobile_device.h
	g++ $(CFLAGS) -c -o $@ $<

$(COMMON): common.cpp common.h
	g++ $(CFLAGS) -c -o $@ $<

$(CFTYPES): cftypes.cpp cftypes.h common.h
	g++ $(CFLAGS) -c -o $@ -x objective-c++ $<

$(MD): mobile_device.cpp mobile_device.h cftypes.h common.h
	g++ $(CFLAGS) -c -o $@ $<

clean:
	rm -rf $(T) $(T).dSYM $(O)/*


================================================
FILE: mobile_device.cpp
================================================
#include "mobile_device.h"
#include <err.h>
#include <dlfcn.h>

mobile_device_lib_t MobileDevice;

//------------------------------------------------------------------------------
bool mobile_device_lib_t::load(void)
{
  if ( dhandle != NULL )
    return true;

  const char *md_path = "/System/Library/PrivateFrameworks/MobileDevice.framework/MobileDevice";
  dhandle = dlopen(md_path, RTLD_NOW);
  if ( dhandle == NULL )
  {
    fprintf(stderr, "dlopen() failed for %s: %s", md_path, dlerror());
    return false;
  }

#define BINDFUN(name, type)                                              \
  _##name = reinterpret_cast<type>(dlsym(dhandle, #name));               \
  if ( _##name == NULL )                                                 \
  {                                                                      \
    unload();                                                            \
    fprintf(stderr, "Could not find function " #name " in %s", md_path); \
    return false;                                                        \
  }

  BINDFUN(AMDeviceNotificationSubscribe, mach_error_t (*)(am_device_notification_callback_t *, int, int, void *, am_device_notification **));
  BINDFUN(AMDeviceNotificationUnsubscribe, mach_error_t (*)(am_device_notification *));
  BINDFUN(AMDeviceCopyDeviceIdentifier, CFStringRef (*)(am_device *));
  BINDFUN(AMDeviceConnect, mach_error_t (*)(am_device *));
  BINDFUN(AMDeviceIsPaired, int (*)(am_device *));
  BINDFUN(AMDeviceValidatePairing, mach_error_t (*)(am_device *));
  BINDFUN(AMDeviceStartSession, mach_error_t (*)(am_device *));
  BINDFUN(AMDeviceStopSession, mach_error_t (*)(am_device *));
  BINDFUN(AMDeviceDisconnect, mach_error_t (*)(am_device *));
  BINDFUN(AMDeviceSecureStartService, mach_error_t (*)(am_device *, CFStringRef, int *, am_device_service_connection **));
  BINDFUN(AMDServiceConnectionInvalidate, void (*)(am_device_service_connection *));
  BINDFUN(AMDServiceConnectionGetSocket, int (*)(am_device_service_connection *));
  BINDFUN(AMDServiceConnectionSend, ssize_t (*)(am_device_service_connection *, const void *, size_t));
  BINDFUN(AMDServiceConnectionReceive, ssize_t (*)(am_device_service_connection *, void *, size_t));

#undef BINDFUN

  return true;
}

//------------------------------------------------------------------------------
void mobile_device_lib_t::unload()
{
  if ( dhandle != NULL )
  {
    dlclose(dhandle);
    reset();
  }
}

//------------------------------------------------------------------------------
mach_error_t mobile_device_lib_t::AMDeviceNotificationSubscribe(
        am_device_notification_callback_t *callback,
        int unused1,
        int unused2,
        void *arg,
        am_device_notification **hptr) const
{
  return _AMDeviceNotificationSubscribe(callback, unused1, unused2, arg, hptr);
}

//------------------------------------------------------------------------------
mach_error_t mobile_device_lib_t::AMDeviceNotificationUnsubscribe(am_device_notification *handle) const
{
  return _AMDeviceNotificationUnsubscribe(handle);
}

//------------------------------------------------------------------------------
CFStringRef mobile_device_lib_t::AMDeviceCopyDeviceIdentifier(am_device *device) const
{
  return _AMDeviceCopyDeviceIdentifier(device);
}

//------------------------------------------------------------------------------
mach_error_t mobile_device_lib_t::AMDeviceConnect(am_device *device) const
{
  return _AMDeviceConnect(device);
}

//------------------------------------------------------------------------------
int mobile_device_lib_t::AMDeviceIsPaired(am_device *device) const
{
  return _AMDeviceIsPaired(device);
}

//------------------------------------------------------------------------------
mach_error_t mobile_device_lib_t::AMDeviceValidatePairing(am_device *device) const
{
  return _AMDeviceValidatePairing(device);
}

//------------------------------------------------------------------------------
mach_error_t mobile_device_lib_t::AMDeviceStartSession(am_device *device) const
{
  return _AMDeviceStartSession(device);
}

//------------------------------------------------------------------------------
mach_error_t mobile_device_lib_t::AMDeviceStopSession(am_device *device) const
{
  return _AMDeviceStopSession(device);
}

//------------------------------------------------------------------------------
mach_error_t mobile_device_lib_t::AMDeviceDisconnect(am_device *device) const
{
  return _AMDeviceDisconnect(device);
}

//------------------------------------------------------------------------------
mach_error_t mobile_device_lib_t::AMDeviceSecureStartService(
        am_device *device,
        CFStringRef name,
        int *unused,
        am_device_service_connection **hptr) const
{
  return _AMDeviceSecureStartService(device, name, unused, hptr);
}

//------------------------------------------------------------------------------
void mobile_device_lib_t::AMDServiceConnectionInvalidate(am_device_service_connection *handle) const
{
  _AMDServiceConnectionInvalidate(handle);
}

//------------------------------------------------------------------------------
int mobile_device_lib_t::AMDServiceConnectionGetSocket(am_device_service_connection *handle) const
{
  return _AMDServiceConnectionGetSocket(handle);
}

//------------------------------------------------------------------------------
ssize_t mobile_device_lib_t::AMDServiceConnectionSend(
        am_device_service_connection *handle,
        const void *buf,
        size_t len) const
{
  return _AMDServiceConnectionSend(handle, buf, len);
}

//------------------------------------------------------------------------------
ssize_t mobile_device_lib_t::AMDServiceConnectionReceive(
        am_device_service_connection *handle,
        void *buf,
        size_t size) const
{
  return _AMDServiceConnectionReceive(handle, buf, size);
}


================================================
FILE: mobile_device.h
================================================
#ifndef MOBILE_DEVICE_H
#define MOBILE_DEVICE_H

#include "cftypes.h"
#include <mach/error.h>

#define kAMDSuccess ERR_SUCCESS

// opaque structures
struct am_device;
struct am_device_notification;
struct am_device_service_connection;

#define ADNCI_MSG_CONNECTED    1
#define ADNCI_MSG_DISCONNECTED 2
#define ADNCI_MSG_UNKNOWN      3

// callback info for AMDeviceNotificationSubscribe()
struct am_device_notification_callback_info
{
  am_device *dev; // device handle
  uint32_t code;  // one of ADNCI_MSG_...
};
typedef void am_device_notification_callback_t(am_device_notification_callback_info *cbi, void *arg);

// manage access to the MobileDevice library
class mobile_device_lib_t
{
  // dll handle
  void *dhandle;

  // pointers to functions in MobileDevice. not to be used directly
  mach_error_t (*_AMDeviceNotificationSubscribe)(am_device_notification_callback_t *, int, int, void *, am_device_notification **);
  mach_error_t (*_AMDeviceNotificationUnsubscribe)(am_device_notification *);
  CFStringRef (*_AMDeviceCopyDeviceIdentifier)(am_device *);
  mach_error_t (*_AMDeviceConnect)(am_device *);
  int (*_AMDeviceIsPaired)(am_device *);
  mach_error_t (*_AMDeviceValidatePairing)(am_device *);
  mach_error_t (*_AMDeviceStartSession)(am_device *);
  mach_error_t (*_AMDeviceStopSession)(am_device *);
  mach_error_t (*_AMDeviceDisconnect)(am_device *);
  mach_error_t (*_AMDeviceSecureStartService)(am_device *, CFStringRef, int *, am_device_service_connection **);
  void (*_AMDServiceConnectionInvalidate)(am_device_service_connection *);
  int (*_AMDServiceConnectionGetSocket)(am_device_service_connection *);
  ssize_t (*_AMDServiceConnectionSend)(am_device_service_connection *, const void *, size_t);
  ssize_t (*_AMDServiceConnectionReceive)(am_device_service_connection *, void *, size_t);

public:
  mobile_device_lib_t(void) { reset(); }
  ~mobile_device_lib_t(void) { unload(); }

  void reset(void) { memset(this, 0, sizeof(*this)); }
  bool load(void);
  void unload(void);

  mach_error_t AMDeviceNotificationSubscribe(am_device_notification_callback_t *, int, int, void *, am_device_notification **) const;
  mach_error_t AMDeviceNotificationUnsubscribe(am_device_notification *) const;
  CFStringRef AMDeviceCopyDeviceIdentifier(am_device *) const;
  mach_error_t AMDeviceConnect(am_device *) const;
  int AMDeviceIsPaired(am_device *) const;
  mach_error_t AMDeviceValidatePairing(am_device *) const;
  mach_error_t AMDeviceStartSession(am_device *) const;
  mach_error_t AMDeviceStopSession(am_device *) const;
  mach_error_t AMDeviceDisconnect(am_device *) const;
  mach_error_t AMDeviceSecureStartService(am_device *, CFStringRef, int *, am_device_service_connection **) const;
  void AMDServiceConnectionInvalidate(am_device_service_connection *) const;
  int AMDServiceConnectionGetSocket(am_device_service_connection *) const;
  ssize_t AMDServiceConnectionSend(am_device_service_connection *handle, const void *buf, size_t len) const;
  ssize_t AMDServiceConnectionReceive(am_device_service_connection *handle, void *buf, size_t size) const;
};

extern mobile_device_lib_t MobileDevice;

#endif // MOBILE_DEVICE_H