find macOS service and it's plist file

0x00:

find macOS service ‘s plist file.

com.apple.xxxx —> xxxx.plist

0x01 :

find all *.plist file and use grep to find target service, not the best way.

0x02 :

use procexp.

1
./procexp.universal all ports | service_name

0x03 :

this way is more complex than others, thx to brightiup :)

  1. step 1

    write a simple gadget, core logic as follow:

1
2
3
4
5
bootstrap_look_up(bs_port, render_service_name, &p);
...
mach_msg(&m.header, MACH_SEND_MSG | MACH_MSG_OPTION_NONE, sizeof(message), 0, 0, 0, 0);
...
getchar(); //do not exit untill we finish
  1. step 2

    get the pid of your gadget

  1. Step 3

    1
    sudo lsmp -p pid

now, you can get the service name according to mach port, then find the plist file by service name you found.