[0x0a] Reversing Shorts :: Apple's Cross-Process Communication (XPC)
Channel: jiska
Date: 2022-11-13

XPC is a mechanism on iOS and macOS that enables processes to exchange data. Especially on Apple-internal implementations, it's used excessively. Simple features are often split across daemons and apps, with components implemented separately. In this video, we'll follow XPC communication across daemons to see what happens when we play a sound on an AirTag.

Full playlist of reversing shorts: https://www.youtube.com/playlist?list=PLkOopkYm0fCV45i_n8z5LSUL3QBXNAP2G

xpcspy: https://github.com/hot3eed/xpcspy
AirTag Frida script: https://github.com/seemoo-lab/airtag/blob/main/scripts/hook_durian.js

Chapters:
00:00 - Introduction
00:21 - PacketLogger
00:55 - XPC and xpcspy
01:18 - xpcspy on bluetoothd
02:02 - xpcspy on Find My app
02:39 - xpcspy on searchpartyd
03:24 - frida-trace on AirTag implementation
04:01 - Let's play AirTechno
04:54 - XPC in general
05:40 - Outro