iospidbsdsysctl

Get parent process information at runtime on iOS application

I'm trying to obtain some process information at runtime on iOS, particularly the parent process name. While I'm able to obtain the current process name, it seems that I can't to do the same for its parent.
Here is what I'm doing:

static inline bool is_debugserver_present() {
    int                 err;
    int                 mib[4];
    struct kinfo_proc   info;
    size_t              size;

    // Initialize the flags so that, if sysctl fails for some bizarre
    // reason, we get a predictable result.

    info.kp_proc.p_flag = 0;

    // Initialize mib, which tells sysctl the info we want, in this case
    // we're looking for information about a the parent process ID.

    mib[0] = CTL_KERN;
    mib[1] = KERN_PROC;
    mib[2] = KERN_PROC_PID;
    mib[3] = getppid();

    // Call sysctl.

    size = sizeof(info);
    int n = sizeof(mib) / sizeof(*mib);
    err = sysctl(mib, n, &info, &size, NULL, 0);

    return (strncmp(info.kp_proc.p_comm, "launchd", sizeof("launchd") - 1) != 0);
}

The problem is that the call to sysctl always return -1 thus an error. The parent process id obtained by getppid()is that same if I ask to the current process for its kp_eproc.e_ppid.
Am I missing something?

Solution

  • You cannot obtain the information of other processes since iOS 9. sysctl is sandboxed now. You can do this only in a iDevice previous iOS 9 or a Simulator.

    sysctl() retrieves system information for processes with appropriate privileges

    iOS apps are not permitted to see what other apps are running

    In iOS 9, the sandbox now prevents a process from accessing the kern.proc, kern.procargs, and kern.procargs2 values for other processes

    see: