lsof常用語法:
檢測本機(jī)端口開放 lsof -i:[port]
查找指定進(jìn)程開放端口 lsof -aPi -p [pid]
查找所有監(jiān)聽端口 lsof -aPi
為什么自己編譯?
目前沒發(fā)現(xiàn)針對iOS10.x可用的lsof贷帮,我用它來查找進(jìn)程占用的描述符氮惯,包括tcp端口
1.下載最新版本lsof
https://opensource.apple.com/tarballs/lsof/
2.Mac上解壓后編譯
根目錄下有Makefile
lsof/
lsof.plist
切換到lsof/
下執(zhí)行./Configure darwin
(問題都選no)袜匿,得到以下結(jié)果:
Configuring libproc-based Darwin lsof
This configuration step (the Inventory script) takes inventory of
the lsof distribution. The script runs for a minute or two while
it checks that all the subdirectories, information files, scripts,
header files and source files that should be present really are.
It's not absolutely necessary that you take inventory, but it's a
good idea to do it right after the lsof distribution has been
unpacked. Once the inventory has been taken, this script creates
the file ./.ck00MAN as a signal that the inventory step has been
done.
You can call the Inventory script directly at any time to take
inventory. You can inhibit the inventory step permanently by
creating the file ./.neverInv, and you can tell the Configure script
to skip the inventory and customization steps with the -n option.
Do you want to take inventory (y|n) [y]? n
rm -f ddev.c dfile.c dlsof.h dmnt.c dnode*.c dproc.c dproto.h dsock.c dstore.c dzfs.h kernelbase.h machine.h machine.h.old new_machine.h __lseek.s Makefile Makefile.zfs ./tests/config.cflags
rm -f ./tests/config.cc ./tests/config.xobj ./tests/config.ldflags
Testing C library for localtime() and strftime(), using cc ... npresent
ln -s dialects/darwin/libproc/dlsof.h dlsof.h
ln -s dialects/darwin/libproc/ddev.c ddev.c
ln -s dialects/darwin/libproc/dfile.c dfile.c
ln -s dialects/darwin/libproc/dmnt.c dmnt.c
ln -s dialects/darwin/libproc/dproc.c dproc.c
ln -s dialects/darwin/libproc/dproto.h dproto.h
ln -s dialects/darwin/libproc/dsock.c dsock.c
ln -s dialects/darwin/libproc/dstore.c dstore.c
ln -s dialects/darwin/libproc/dnetpolicy.c dnetpolicy.c
ln -s dialects/darwin/libproc/dchannel.c dchannel.c
ln -s dialects/darwin/libproc/dnexus.c dnexus.c
ln -s dialects/darwin/libproc/machine.h machine.h
Makefile and lib/Makefile created.
./tests/config.cc created
./tests/config.cflags created
./tests/config.ldflags created
./tests/config.xobj created
You may now customize the machine.h header file for this UNIX
dialect. The customizations will take effect when you compile
lsof. You may also choose to skip customization and proceed to
the compilation of lsof.
If you don't know if you need to customize or want to know more
about what you can customize, consult the 00DCACHE, 00FAQ, 00PORTING,
and 00README files of the lsof distribution. You might also find
it helpful to examine the machine.h header file for the dialect
you're customizing.
You don't need to use this procedure to customize lsof; you can
edit the machine.h header file directly. If you later decide you
want to use this procedure to customize machine.h, execute the
./Customize script.
Do you want to customize (y|n) [y]? #
執(zhí)行make得到如下結(jié)果:
(cd lib; /Applications/Xcode.app/Contents/Developer/usr/bin/make DEBUG="-O" CFGF="-DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\"")
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o ckkv.o ckkv.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o cvfs.o cvfs.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o dvch.o dvch.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o fino.o fino.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o isfn.o isfn.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o lkud.o lkud.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o pdvn.o pdvn.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o prfp.o prfp.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o ptti.o ptti.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rdev.o rdev.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o regex.o regex.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rmnt.o rmnt.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rnam.o rnam.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rnch.o rnch.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rnmh.o rnmh.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o snpf.o snpf.c
ar cr liblsof.a ckkv.o cvfs.o dvch.o fino.o isfn.o lkud.o pdvn.o prfp.o ptti.o rdev.o regex.o rmnt.o rnam.o rnch.o rnmh.o snpf.o
ranlib liblsof.a
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o ddev.o ddev.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dfile.o dfile.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dmnt.o dmnt.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dproc.o dproc.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dsock.o dsock.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dstore.o dstore.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o arg.o arg.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o main.o main.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o misc.o misc.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o node.o node.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o print.o print.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o proc.o proc.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o store.o store.c
Constructing version.h
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o usage.o usage.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o util.o util.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dnetpolicy.o dnetpolicy.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dchannel.o dchannel.c
dchannel.c:52:7: error: use of undeclared identifier 'PROC_CHANNEL_TYPE_USER_PIPE'
case PROC_CHANNEL_TYPE_USER_PIPE:
^
dchannel.c:55:7: error: use of undeclared identifier 'PROC_CHANNEL_TYPE_KERNEL_PIPE'
case PROC_CHANNEL_TYPE_KERNEL_PIPE:
^
dchannel.c:58:7: error: use of undeclared identifier 'PROC_CHANNEL_TYPE_NET_IF'
case PROC_CHANNEL_TYPE_NET_IF:
^
dchannel.c:61:7: error: use of undeclared identifier 'PROC_CHANNEL_TYPE_FLOW_SWITCH'
case PROC_CHANNEL_TYPE_FLOW_SWITCH:
^
dchannel.c:78:16: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR'
if ((flags & (PROC_CHANNEL_FLAGS_MONITOR)) != 0) {
^
dchannel.c:80:17: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR'
if ((flags & (PROC_CHANNEL_FLAGS_MONITOR))
^
dchannel.c:81:10: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR'
== PROC_CHANNEL_FLAGS_MONITOR) {
^
dchannel.c:83:23: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR_TX'
} else if ((flags & PROC_CHANNEL_FLAGS_MONITOR_TX) != 0) {
^
dchannel.c:88:16: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR_NO_COPY'
if ((flags & PROC_CHANNEL_FLAGS_MONITOR_NO_COPY) != 0) {
^
dchannel.c:93:15: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_EXCLUSIVE'
if ((flags & PROC_CHANNEL_FLAGS_EXCLUSIVE) != 0) {
^
dchannel.c:102:15: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_USER_PACKET_POOL'
if ((flags & PROC_CHANNEL_FLAGS_USER_PACKET_POOL) != 0) {
^
dchannel.c:123:24: error: variable has incomplete type 'struct channel_fdinfo'
struct channel_fdinfo ci;
^
dchannel.c:123:9: note: forward declaration of 'struct channel_fdinfo'
struct channel_fdinfo ci;
^
dchannel.c:131:31: error: use of undeclared identifier 'PROC_PIDFDCHANNELINFO'
nb = proc_pidfdinfo(pid, fd, PROC_PIDFDCHANNELINFO, &ci, sizeof(ci));
如上们何,下面著手解決這些錯(cuò)誤惭婿,這些錯(cuò)誤都是類型和值未定義箕昭,其實(shí)可以通過逆向mac自帶lsof來還原彬呻,這里為了簡便衣陶,直接將dchannel.c這些發(fā)生錯(cuò)誤語句刪掉,最終dchannel.c中的代碼如下:
#include "lsof.h"
void process_channel(int pid, int32_t fd){}
再次執(zhí)行make
(cd lib; /Applications/Xcode.app/Contents/Developer/usr/bin/make DEBUG="-O" CFGF="-DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\"")
make[1]: Nothing to be done for `all'.
Constructing version.h
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o usage.o usage.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dchannel.o dchannel.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dnexus.o dnexus.c
cc -o lsof -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O ddev.o dfile.o dmnt.o dproc.o dsock.o dstore.o arg.o main.o misc.o node.o print.o proc.o store.o usage.o util.o dnetpolicy.o dchannel.o dnexus.o -L./lib -llsof -lcurses
成功編譯lsof的x86_64版本废岂,可以直接在Mac上運(yùn)行祖搓。下面來編譯arm/arm64的版本make CC="$(xcrun --sdk iphoneos --find clang) -isysroot $(xcrun --sdk iphoneos --show-sdk-path) -arch armv7 -arch armv7s -arch arm64"
得到如下結(jié)果:
(cd lib; /Applications/Xcode.app/Contents/Developer/usr/bin/make DEBUG="-O" CFGF="-DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\"")
make[1]: Nothing to be done for `all'.
Constructing version.h
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS11.0.sdk -arch armv7 -arch armv7s -arch arm64 -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o usage.o usage.c
In file included from usage.c:39:
In file included from ./lsof.h:213:
./dlsof.h:56:10: fatal error: 'netinet/tcp_fsm.h' file not found
#include <netinet/tcp_fsm.h>
^~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [usage.o] Error 1
該錯(cuò)誤是iphone對應(yīng)SDK /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/usr/include/
缺少頭文件導(dǎo)致,這些缺少的頭文件從/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
拷貝即可湖苞,這些文件包括:
netinet/tcp_fsm.h
rpc/pmap_prot.h
libproc.h
sys/proc_info.h
sys/kern_control.h
net/route.h
再次make此時(shí)編譯成功拯欧,執(zhí)行file命令:
lsof: Mach-O universal binary with 3 architectures: [arm_v7: Mach-O executable arm_v7] [arm_v7s: Mach-O executable arm_v7s] [arm64: Mach-O 64-bit executable arm64]
lsof (for architecture armv7): Mach-O executable arm_v7
lsof (for architecture armv7s): Mach-O executable arm_v7s
lsof (for architecture arm64): Mach-O 64-bit executable arm64
拷貝到越獄iphone上執(zhí)行,會(huì)出現(xiàn)killed: 9
财骨,需要對lsof進(jìn)行簽名:
創(chuàng)建文件entitlement.xml
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.springboard.debugapplications</key>
<true/>
<key>get-task-allow</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
<key>run-unsigned-code</key>
<true/>
</dict>
</plist>
執(zhí)行簽名:ldid -Sentitlement.xml lsof
此時(shí)再將lsof拷貝到越獄iphone上镐作,可以執(zhí)行了!
我自己用的放在git上https://github.com/lichao890427/codesegment/blob/master/lsof_10.x