Get parent process information at runtime on iOS application

Question

I'm trying to obtain some process information at runtime on iOS, particularly the parent process name. While I'm able to obtain the current process name, it seems that I can't to do the same for its parent.
Here is what I'm doing:

static inline bool is_debugserver_present() {
    int                 err;
    int                 mib[4];
    struct kinfo_proc   info;
    size_t              size;

    // Initialize the flags so that, if sysctl fails for some bizarre
    // reason, we get a predictable result.

    info.kp_proc.p_flag = 0;

    // Initialize mib, which tells sysctl the info we want, in this case
    // we're looking for information about a the parent process ID.

    mib[0] = CTL_KERN;
    mib[1] = KERN_PROC;
    mib[2] = KERN_PROC_PID;
    mib[3] = getppid();

    // Call sysctl.

    size = sizeof(info);
    int n = sizeof(mib) / sizeof(*mib);
    err = sysctl(mib, n, &info, &size, NULL, 0);

    return (strncmp(info.kp_proc.p_comm, "launchd", sizeof("launchd") - 1) != 0);
}

The problem is that the call to sysctl always return -1 thus an error. The parent process id obtained by getppid()is that same if I ask to the current process for its kp_eproc.e_ppid.
Am I missing something?

On a clean iOS device, the `getppid()` returns `1` when no debugger is attached. If you attach XCode, you will get a different parent pid. It is likely to be the `/Developer/usr/bin/debugserver`. Did you try https://developer.apple.com/library/archive/qa/qa1361/_index.html? — rustyMagnet, Oct 12 '20 at 15:56

score 3 · Accepted Answer · edited Oct 12 '20 at 15:21

You cannot obtain the information of other processes since iOS 9. sysctl is sandboxed now. You can do this only in a iDevice previous iOS 9 or a Simulator.

sysctl() retrieves system information for processes with appropriate privileges

iOS apps are not permitted to see what other apps are running

In iOS 9, the sandbox now prevents a process from accessing the kern.proc, kern.procargs, and kern.procargs2 values for other processes

see:

WWDC Privacy Introduction
Privacy and your app (Page 29)

Get parent process information at runtime on iOS application

1 Answers1