0

I'm making an application which is able to limit the amount of time to operate other apps in macOS, and found that I should imitate this app's behavior. Although I searched and tried many things, I finally could't imitate it by myself. So I want you to advise me.

At first, I found that Applescript seemed to be useful only for applications supporting a function to minimize the window because I think blocking limited apps by killing process is not good. Then I decided to observe an app's (1Focus) behavior which had already achieved its function.

Although I am not familiar with reverse engineering, I tried to use strings, otool, dtruss, dapptrace, and Hopper. It is certain that I couldn't get useful information, but I found that com.apple.appkit.xpc.openAndSavePanelService seemed to be involved. It can be easily seen in the energy tab of Activity Monitor and I am reading this document now.

Sulthan
  • 128,090
  • 22
  • 218
  • 270
Tomoaki Kobayashi
  • 1
  • 1
  • use hopperapp trial version to see it's internals. Just don't give up that easily. The app is app store friendly so no use of dtrace and similar. Only public apis. You can even use Xcode to attach to process and use breakpoint commands like br set -n "nameofselector:" – Marek H Mar 29 '19 at 18:40
  • [[NSWorkspace sharedWorkspace] notificationCenter] and addObserver for NSWorkspaceDidActivateApplicationNotification NSWorkspaceDidUnhideApplicationNotification NSWorkspaceDidLaunchApplicationNotification. User info of the delivered notification should contain some information. Also look at [[NSAppleEventManager sharedAppleEventManager] currentAppleEven]. Also look at CFArrayRef windowList = CGWindowListCopyWindowInfo(kCGWindowListOptionOnScreenOnly, kCGNullWindowID); – Marek H Mar 29 '19 at 19:08
  • Thank you. I got [a question](https://stackoverflow.com/questions/614185/window-move-and-resize-apis-in-os-x/614433) which seemed to be useful. But eventually I don't know how 1Focus behave so. It doesn't require any privacy settings for minimizing other apps. So it might use private API. – Tomoaki Kobayashi Mar 30 '19 at 13:10
  • @MarekH I didn't know debugger can be attached to apps compiled without -g option. I'll try it later. – Tomoaki Kobayashi Mar 30 '19 at 13:18
  • You need to disable System Protection aka csrutil. 10.14 added binary protection against this kind of attaching so it might be better sometimes to use 10.12 or 10.13 or one can go harder and re-sign with own certificate and plist. Once you attach use lldb to print object address and add it to variables viewer with type. e.g. add expression -> (NSColor *)0x3332332. Use space for quicklook. Also use simple commands like "po [NSApp windows]"... MAGIC! – Marek H Mar 30 '19 at 13:24

0 Answers0