Question

I have list of background processes and their pid running in background in iphone got from following code. My projects requirement is-
(its like an antivirus)

1. Get information on each process

a. Name

b. Size

c. Last Modified Date/Time

d. Associated Files

e. What the process is accessing from all interfaces (storage, USB, Bluetooth, Wi-Fi etc)

f. Any other information available

Thanks in advance.

#import <mach/mach_host.h>
#include "stdlib.h"
#include "stdio.h"
#include "string.h"
#include "sys/sysctl.h"    
#include <CoreFoundation/CoreFoundation.h>
#include <assert.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>



- (void)viewDidLoad
{
 [super viewDidLoad];
 [self printProcessInfo];
}

-(int) printProcessInfo 
{
 int mib[5];
 struct kinfo_proc *procs = NULL, *newprocs;
 int i, st, nprocs;
 size_t miblen, size;

 /* Set up sysctl MIB */
 mib[0] = CTL_KERN;
 mib[1] = KERN_PROC;
 mib[2] = KERN_PROC_ALL;
 mib[3] = 0;
 miblen = 4;

 /* Get initial sizing */
 st = sysctl(mib, miblen, NULL, &size, NULL, 0);

 /* Repeat until we get them all ... */
 do {
      /* Room to grow */
      size += size / 10;
      newprocs = realloc(procs, size);
      if (!newprocs) {
           if (procs) {
                free(procs);
           }
           perror("Error: realloc failed.");
           return (0);
      }
      procs = newprocs;
      st = sysctl(mib, miblen, procs, &size, NULL, 0);
 } while (st == -1 && errno == ENOMEM);

 if (st != 0) {
      perror("Error: sysctl(KERN_PROC) failed.");
      return (0);
 }

 /* Do we match the kernel? */
 assert(size % sizeof(struct kinfo_proc) == 0);

 nprocs = size / sizeof(struct kinfo_proc);

 if (!nprocs) {
      perror("Error: printProcessInfo.");
      return(0);
 }
 printf("  PID\tName\n");
 printf("-----\t--------------\n");
 self.lists = [[NSMutableString alloc] init];
 for (i = nprocs-1; i >=0;  i--) {
       printf("%5d\t%s\n",(int)procs[i].kp_proc.p_pid, procs[i].kp_proc.p_comm);



 }
 NSLog(@"%@",lists);
 listsText.text = lists;
 free(procs);
 return (0);


}

Answer 1

answer a)name of process you are getting in above code.

answer d)to get associated files,pass pid of process to this function (we have got pid in questions code)-

 void print_argv_of_pid(int pid) {
  printf("%d\n", pid);
  int    mib[3], argmax, nargs, c = 0;
 size_t    size;
 char    *procargs, *sp, *np, *cp;
 extern int  eflg;
 int show_args = 1;

 mib[0] = CTL_KERN;
 mib[1] = KERN_ARGMAX;

 size = sizeof(argmax);
 if (sysctl(mib, 2, &argmax, &size, NULL, 0) == -1) {
 goto ERROR_A;
}

   /* Allocate space for the arguments. */
   procargs = (char *)malloc(argmax);
   if (procargs == NULL) {
     goto ERROR_A;
   }



   mib[0] = CTL_KERN;
   mib[1] = KERN_PROCARGS2;
   mib[2] = pid;


   size = (size_t)argmax;
   if (sysctl(mib, 3, procargs, &size, NULL, 0) == -1) {
     goto ERROR_B;
   }

   memcpy(&nargs, procargs, sizeof(nargs));
   cp = procargs + sizeof(nargs);

   /* Skip the saved exec_path. */
   for (; cp < &procargs[size]; cp++) {
     if (*cp == '\0') {
       /* End of exec_path reached. */
       break;
     }
   }
   if (cp == &procargs[size]) {
     goto ERROR_B;
   }

   /* Skip trailing '\0' characters. */
   for (; cp < &procargs[size]; cp++) {
     if (*cp != '\0') {
       /* Beginning of first argument reached. */
       break;
     }
   }
   if (cp == &procargs[size]) {
     goto ERROR_B;
   }
   /* Save where the argv[0] string starts. */
   sp = cp;


   for (np = NULL; c < nargs && cp < &procargs[size]; cp++) {
     if (*cp == '\0') {
       c++;
       if (np != NULL) {
           /* Convert previous '\0'. */
           *np = ' ';
       } else {
           /* *argv0len = cp - sp; */
       }
       /* Note location of current '\0'. */
       np = cp;

       if (!show_args) {
      /*
       * Don't convert '\0' characters to ' '.
       * However, we needed to know that the
       * command name was terminated, which we
       * now know.
       */
      break;
       }
     }
   }


   if (np == NULL || np == sp) {
     /* Empty or unterminated string. */
     goto ERROR_B;
   }

   /* Make a copy of the string. */
   printf("%s\n", sp);

   /* Clean up. */
   free(procargs);
   return;

   ERROR_B:
   free(procargs);
   ERROR_A:
   printf("error");

 }

answer b),c)-size and access times-

    struct stat st;
    //pass filepath upto /.app/ to stat function (use 'componentsseparatedby' of nsstring apply on full path which we got in answer d's code above) 
if (stat(filename, &st)) {
 perror(filename);
} else {
 printf("%s: mtime = %lld.%.9ld\n", filename, (long long)st.st_mtimespec.tv_sec, st.st_mtimespec.tv_nsec);

  printf("File size:                %lld bytes\n",
        (long long) st.st_size);


 printf("Last status change:       %s", ctime(&st.st_ctime));
 printf("Last file access:         %s", ctime(&st.st_atime));
 printf("Last file modification:   %s", ctime(&st.st_mtime));
}

other information-
TO KILL THE PROCESS-
just pass pid of process to be killed-

int pid_exists(long pid)
{
 int kill_ret;

 // save some time if it's an invalid PID
 if (pid < 0) {
      return 0;
 }

 // if kill returns success of permission denied we know it's a valid PID
 kill_ret = kill(pid , 0); 
 if ( (0 == kill_ret) || (EPERM == errno) ) {
      return 1;
 }

 // otherwise return 0 for PID not found
 return 0;

}