Andrea
08/02/2022, 11:54 AMproc_pidpath
from libproc.h
to get the path of the process from the pid.
The code is pretty standard :
char path[PROC_PIDPATHINFO_MAXSIZE] = {0};
int bufsize = proc_pidpath(pid, path, sizeof(path));
if(bufsize > 0)
return std::string(path);
return {};
Also osquery already uses it so it should work fine.
Am I missing something?
Anybody experienced the same ?sharvil
08/02/2022, 12:40 PMAndrea
08/02/2022, 1:22 PMProductName: macOS
ProductVersion: 12.1
BuildVersion: 21C52
Everything I can get is this:
Process 6936 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x7ff7bf6ffff8)
frame #0: 0x0000000100025615 processinfo-test`std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_character_sequence<char, std::__1::char_traits<char> >(std::__1::basic_ostream<char, std::__1::char_traits<char> >&, char const*, unsigned long) + 47
processinfo-test`std::__1::__put_character_sequence<char, std::__1::char_traits<char> >:
-> 0x100025615 <+47>: callq 0x10002c558 ; symbol stub for: std::__1::basic_ostream<char, std::__1::char_traits<char> >::sentry::sentry(std::__1::basic_ostream<char, std::__1::char_traits<char> >&)
0x10002561a <+52>: cmpb $0x0, -0x40(%rbp)
0x10002561e <+56>: je 0x1000256a8 ; <+194>
0x100025624 <+62>: movq (%r14), %rax
sharvil
08/02/2022, 1:26 PMPROC_PIDPATHINFO_MAXSIZE
with something like 4096
in the char array and try again? I think PROC_PIDPATHINFO_MAXSIZE
doesn't come from libproc.h header, it might be coming from somewhere else➜ pidpath clang++ pidpath.cpp -o pidpath
➜ pidpath ./pidpath 1
proc 1: /sbin/launchd
➜ pidpath ./pidpath 350
proc 350: /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer
➜ pidpath ./pidpath 69115
proc 69115: /Applications/Microsoft <http://Excel.app/Contents/MacOS/Microsoft|Excel.app/Contents/MacOS/Microsoft> Excel
➜ pidpath ./pidpath 59177
proc 59177: /Applications/Google <http://Chrome.app/Contents/Frameworks/Google|Chrome.app/Contents/Frameworks/Google> Chrome Framework.framework/Versions/103.0.5060.134/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
➜ pidpath
Andrea
08/02/2022, 1:39 PMsharvil
08/02/2022, 1:44 PMAndrea
08/02/2022, 1:45 PMsharvil
08/02/2022, 1:52 PMAndrea
08/02/2022, 1:56 PMandrea@andrea-macbook ~ % ./pidpath 543
proc 543: /Applications/Google <http://Chrome.app/Contents/Frameworks/Google|Chrome.app/Contents/Frameworks/Google> Chrome Framework.framework/Versions/103.0.5060.134/Helpers/chrome_crashpad_handler %
andrea@andrea-macbook ~ % ./pidpath 883
proc 883: /Applications/Slack.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Helpers/chrome_crashpad_handler %
sharvil
08/02/2022, 1:59 PM<http://Console.app|Console.app>
/ Crash Report? EXC_BAD_ACCESS, code=2
seems to imply KERN_PROTECTION_FAILURE
which could be permissions relatedAndrea
08/02/2022, 2:04 PMsharvil
08/02/2022, 2:05 PMI thought about it too but I find out because the app, signed and notarised was crashingWhich app? Is the crash happening in osquery?
Andrea
08/02/2022, 2:13 PMsharvil
08/02/2022, 2:17 PMpid
doesn’t have a path in the filesystem (kinda zombie like process), but that’s far fetchedAndrea
08/02/2022, 2:24 PMsharvil
08/02/2022, 2:26 PMAndrea
08/02/2022, 2:30 PMsharvil
08/02/2022, 2:32 PMAndrea
08/02/2022, 2:35 PM