Question

Any help with this problem would be fantastic. I appreciate all contributions!

Let us say I’m running a daemon that is observing the behaviour of the app that has keyboard focus. I have it’s PID and process name. Is there any way I can see what files that application is accessing?

I’m programming in Objective-C, Cocoa and C.

Thanks!

EDIT:

Sorry, I should have clarified. I want to be doing this programmatically from the daemon. Thanks

Answer 1

There’s a command line tool called lsof that shows you every file that’s open and what program has it open. You could look at its source, then do the same thing periodically.

I don’t think you can intercept reads and writes, though—not without using DTrace, which requires root powers.