Mac OS : is there any way to sniff system open call without kernel - swift

I've to open a file from any location in Mac OS and I want to do some operation before it opens in any relative application. Is there any way to sniff the system open call and hold it for while and do some operation.
For an example, I'm opening test.doc file, which will open in msword application or can choose any other application by right click and open with. I want to hold for a while and want to perform some operation before launching this ms word application or any relative application(system open call) on my text.doc file.
Is there any way in programming language for Mac OS (C/C++/ObjectiveC/Swift) without going to kernel.
Any help will be highly appreciated.

As far as I'm aware totally intercepting/hooking the syscall can only be done in a kext.
If it's for a specific application, and this application supports dynamically loaded plugins, you could write a plugin that hooks the syscall.
You can in principle inject code into the process and hook the open() syscall for that process even if the application does not support plugins. (e.g. using mach_inject) The downside of this is that if e.g. the user double-clicks a file in the Finder, and this launches the application and immediately opens the file, there is only a very small window of time in which you could inject the code. I don't think there's a way you can do this reliably with only user space code.

Even with a kernel extension, hooking syscalls is no longer viable due to various protections in the kernel, such as KASLR. With Mojave, code injection will no longer be viable due to SIP. The only supported method to do what's being asked is to use the Kernel Authorisation (KAuth) framework.

Related

Keyboard Filter Driver. Scan Code -> VK_??? (OEM Specific)

Preface (Imaginary. So someone does not ask 'What are you trying to do?):
I have a Win32 C++ application.
This application wants to know when the user wants to open the start menu via Ctrl+Esc
Of course, Ctrl+Esc is fired from the operating system so the application never see's it.
I have looked at Windows Virtual Keys.
I see that there are plenty of OEM specific VK's
(0x92-0x96,0xE0,0xE9-0xF5,..)
So my thought was:
Keyboard Filter Driver.
When my application has the focus it tells the Keyboard Filter Driver.
When my driver sees the Ctrl is down and an Esc down occurs (And my application has focus):
-- Swallow the Esc and replace it with a scan code that will produce say a VK_0x92 (OEM Specific).
Since I have swallowed the Esc the operating system will never see Ctr+Esc
My application will then see the VK_0x92 and know the user wants to open the start menu and perform some action.
My question is how do I 'muck' the input within my driver (KEYBOARD_INPUT_DATA) in order for a say
VK_0x92 to appear within my application?
Thanks in advance for any pointers.
It is all about the Keyboard Layout.
What I needed to do was not supported by Microsoft Keyboard Layout Creator (MKLC).
See: Keyboard Layout Samples.
I found the samples to be very old and hard to read through. Clearly the US and German keyboard samples are not the most recent.
I wrote a program to create Visual Studio projects for keyboard layouts by pointing to a specific layout (I.e, KBDUS.dll for example). I generate the source code, .vxcproj, ... I then make my modifications and build it.
Installing the layout is another can of worms entirely. I have asked in several places for Microsoft to release the source code for the CustomAction Dll that is contained within the MKLC generated .MSI to no avail.

Automate log conversion as Action in Vector CANoe

CANoe offers an option Actions in the Export and Logging Settings window. The help window says:
An action defines an application that is called after saving the
target file.
What I'd like to achieve is something similar to this question: have all the logs from the application happen in BLF format using a single logging block (for performance reasons, I don't want to put a lot of logging blocks in the simulation), then set up an action to automatically convert the BLF file to ASC. Yes, I could write an helper program opening CANoe via COM, but I'd like not to. Somebody from Vector told me once that the only portion of CANoe certified for ISO26262 is the CLI, but it doesn't sound right to me.
I can't even get started on this, as I cannot find any documentation about using CANoe via CLI. Does anybody knows how to do this (if it can be done)?
EDIT: in the CANoe RT Server: Command Line Control portion of the help manual, it says (emphasys mine):
Configuration and control of the CANoe RT server is mainly done via
the CANoe dialog on the user PC in Options dialog (Extensions|CANoe
RT). In addition you can also control Runtime Server and Runtime
Kernel via command line input on the server host.
so they have CLI for something. I'm afraid the answer might be that is not feasible because Vector wants to enforce COM interface as the only interface for automation pipelines (see also Jenkins integration)
The question which you are referring to uses COM interface for performing the conversion.
A suggestion for you is to create an application which open a new CANoe window and then make the conversion and close immediately(similar to the one in the question you referred).
Then, you can start the application via the Actions feature.
NOTE: There are no CLIs to control the CANoe application.

Revert/Reload all open files in Visual Studio Code?

I have been trying to figure this out, and cannot determine if it is possible or not.
Essentially, I commonly work with a VSCode window containing many files located on an external network drive (CIFS mount in Linux). When these files are changed "on-disk", they do not update in the editor until I switch focus to each file by changing the active editor tab. This means I have to switch tabs, wait for the update to process, and then repeat for all open tabs (could be 10 or 20 tabs).
Is there anyway to force all open editors to refresh or revert at once? That would ease my workflow a lot for examining differences between these open files on the fly. There's a command to "Revert File", but that only works on the open file, rather than all currently-opened ones. I've looked in the settings and browsed for an extension, but I can't find anything to accomplish this task.
Well, You can try to map the external network drive to local disk and give appropriate permission for read and write restriction.
If your computer has firewall or anti virus installed, then you must exclude vs access restriction from fw/av inspection.
Otherwise you can also improve your network adapter performance, associate to buffers, throughput, packet latency, etc.
Alternatively, you can use any source control, so your codes could be persist locally and could be synchronized from/to source control server.
Hope this could helps.

grant OSX sandboxed finder sync extension persistent write access

I've written a short swift code to add a button to the finder which creates a new blank file at the current directory via a system touch call. The extension gets the current directory fine (via FIFinderSyncController.defaultController().targetedURL()), but the touch command failed due to sandboxing. How do I ask for permission for the write access? The user-selected file option is not triggered for my code.
As far as I know this should not be possible within Finder sync extension. However, as the workaround you may transfer this functionality to the main application - first ask user to drag drive, where functionality will be enabled, to the app main window, save security bookmark, and then send command from Finder extension to the main app.
You should be able to use a temporary exception entitlement as described here. More specifically, one of the two entitlements should be sufficient:
com.apple.security.temporary-exception.files.home-relative-path.read-write
com.apple.security.temporary-exception.files.absolute-path.read-write
As noted in the documentation, you should submit your reasons for needing a temporary exception entitlement if you plan on submitting your app to the App Store. (I've never gone through this procedure, so I'm not sure how what this process is like).
As far as I know, this isn't possible, and furthermore, this is not the purpose of Finder sync extensions. Apple says here that:
Make sure the Finder Sync extension point is appropriate for the functionality you plan to provide. The best Finder Sync extensions support apps that sync the contents of a local folder with a remote data source. Finder Sync is not intended as a general tool for modifying the Finder’s user interface.
If you want to modify Finder to do what you purpose, you'd have to:
Use a temporary exception entitlement, which will de facto cause your app to be rejected; or
re-think your approach
I'd suggest the latter. Apple is making it more and more difficult to modify the system with every release (for better or for worse). If you need this functionality, file a bug report requesting it.

Packaging a GWT app to run completely offline NOT installed via a "marketplace"

Theres a few questions similar to this, so I'll try to be clear as possible.
We have an existing, fairly large and complex, GWT webgame I have been asked to make work offline. It has to be offline in pretty much the strictest sense.
Imagine we have been told to make it work off a CD Rom.
So installation is allowed, but we cant expect the users to go to a Chrome/Firefox store and install it from there. It would need to be off the disc.
Likewise, altering of the browsers start-up flags would be unreasonable to expect of users.
Ideally, it would be nice if they just clicked a HTML file for the start page and it opened in their browsers of choice.
We successfully got it working this way in Firefox by adding;
"<add-linker name='xsiframe' />"
To our gwt.xml settings. This seems to solve any security issues FF has with local file access.
However, this does not solve the problem for Chrome.
The main game starts up, but various file requests are blocked due to security issues like these;
XMLHttpRequest cannot load file:///E:/Game%20projects/[Thorn]%20Game/ThornGame/text/messages_en.properties. Cross origin requests are only supported for protocol schemes: http, data, chrome, chrome-extension, https, chrome-extension-resource.MyApplication-0.js:34053 com_google_gwt_http_client_RequestBuilder_$doSend__Lcom_google_gwt_http_client_RequestBuilder_2Ljava_lang_String_2Lcom_google_gwt_http_client_RequestCallback_2Lcom_google_gwt_http_client_Request_2 MyApplication-0.js:34053
Now I was aware same origin policy issues might popup as during development we often tested locally using flags in chrome to bi-pass them.
Thing is...now I dont know how to get around them when we cant use startup flags.
Obviously in the example given its just the .properties file GWT uses to get some language related text. I could dump that inline in one way or another.
However, its only one of many,many,many files being blocked.
The whole game was made to run off *.txt game scripts on the sever - to allow easy updating by non-coders. Really the actual GWT code is just an "engine" and all the XMLHttpRequested files supply the actual "game".
These files are of various types; csv, txt, ntlist, jam.
The last two being custom extensions for what are really just txt files.
All these files are blocked by chromes security. It seems from what I can make out only images are allowed to be accessed locally.
Having all these files compiled in would just be impossible, as they are not fixed in number (ie, one central .txt file determains various scene .txt files which in turn determain various object files and directory's...).
Putting all this into a bundle would be nightmare to create and maintain.
So in essence I need some way to supply a offline version of a GWT project that can access a large number of various files in its subdirectories without security issues.
So far all I can think of is;
A) Theres something I can tell chrome via html or gwt that allows these files to be read in Chrome like FF can. (I suspect this isn't possible).
An alternative to XMLHttpRequest maybe?
B) I need to somehow package a game+a webbrowser in a executable package that has permission to access files in its directory's. (http://www.appcelerator.com/titanium ? ?? ).
C) I need to package and have the user run a full webserver that can then deliver all these files in a XMLHttp accessible way.
D) Bit of a funny one...we cant tell the user to add flags to browser start up...but Maybe I could write a game installer which just detects if they have Chrome or Firefox. It then opens up the games html in their browser with the correct flags for them? This would open up security issues if they browse elsewhere with that instance though, so Id presumably need other flags to disable the url bar if that's possible.
I am happy to make various changes to our code to achieve any of this - but as mentioned above theres no way to determain all the files needing to be accessed at compile time.
And finally, of course, it all has to be as easy as possible for the end user.
Ideally just clicking a html file, or installing something no more complex then a standard windows program.
Thanks for reading this rather long explanation, any pointers and ideas would be very welcome. I especially will appreciate multiple different options or feedback from anyone that's done this.
========================================
I accepted the suggestion to use Chromiumembedded below.
This works and does what I need (and much much more)
To help others that might want to use it, I specifically made two critical changes to the example project;
Because CEF needs a absolute path to the web apps local html, I wrote a c++ function to get the directory the .exe was launched from. This was a platform specific implementation, so if supporting a few OS's (which CEF does) be sure to write dedicated code for each.
Because my webapp will make use of local files, I enabled the Chrome flag for this by changing the browser settings;
browser_settings.file_access_from_file_urls = STATE_ENABLED;
These two changes were enough to get my app working, but it is obviously the bare minimum to make a application. Hopefully my finding will help others.
I'd suggest going the wrapper route. That is, provide a minimal browser implementation that opens your files directly. Options are Chromium Embedded[1]. If the nature of the application absolutely requires the files to be served as non-file urls then bundle a minimal webserver, have the on-disk executable start the server and open the bundled browser with whatever startup arguments you want.
[1] https://bitbucket.org/chromiumembedded/cef