MacMonitor/Sources/Telemetry/Process/MMProcessDetailInspector.m

#import "MMProcessDetailInspector.h"
#import <libproc.h>
#import <sys/proc_info.h>
#import <arpa/inet.h>

@implementation MMProcessDetailInspector

+ (NSDictionary<NSString *, id> *)summarizeInspectionResultsWithPID:(pid_t)pid
                                                            threads:(NSArray<NSDictionary<NSString *, id> *> *)threads
                                                                fds:(NSArray<NSDictionary<NSString *, id> *> *)fds
                                                            sockets:(NSArray<NSDictionary<NSString *, id> *> *)sockets {
    return @{
        @"pid": @(pid),
        @"threadCount": @(threads.count),
        @"openFDCount": @(fds.count),
        @"socketCount": @(sockets.count),
        @"threads": threads,
        @"fileDescriptors": fds,
        @"sockets": sockets
    };
}

static NSString *runStateString(int state) {
    switch (state) {
        case 1: return @"Running";
        case 2: return @"Stopped";
        case 3: return @"Waiting";
        case 4: return @"Uninterruptible";
        case 5: return @"Halted";
        default: return @"Unknown";
    }
}

static NSString *tcpStateString(int state) {
    switch (state) {
        case 0: return @"CLOSED";
        case 1: return @"LISTEN";
        case 2: return @"SYN_SENT";
        case 3: return @"SYN_RCVD";
        case 4: return @"ESTABLISHED";
        case 5: return @"CLOSE_WAIT";
        case 6: return @"FIN_WAIT_1";
        case 7: return @"CLOSING";
        case 8: return @"LAST_ACK";
        case 9: return @"FIN_WAIT_2";
        case 10: return @"TIME_WAIT";
        default: return @"UNKNOWN";
    }
}

+ (nullable NSDictionary<NSString *, id> *)inspectProcessWithPID:(pid_t)pid {
    if (pid <= 0) return nil;
    
    // 1. Enumerate threads
    uint64_t threadIds[512];
    int threadBytes = proc_pidinfo(pid, PROC_PIDLISTTHREADS, 0, threadIds, sizeof(threadIds));
    int threadCount = threadBytes / sizeof(uint64_t);
    
    NSMutableArray<NSDictionary<NSString *, id> *> *threads = [NSMutableArray arrayWithCapacity:threadCount];
    for (int t = 0; t < threadCount; t++) {
        uint64_t tid = threadIds[t];
        struct proc_threadinfo thi;
        if (proc_pidinfo(pid, PROC_PIDTHREADINFO, tid, &thi, sizeof(thi)) == sizeof(thi)) {
            [threads addObject:@{
                @"threadId": @(tid),
                @"userTimeNs": @(thi.pth_user_time),
                @"systemTimeNs": @(thi.pth_system_time),
                @"cpuPercent": @(thi.pth_cpu_usage),
                @"state": runStateString(thi.pth_run_state),
                @"priority": @(thi.pth_priority),
                @"currentPriority": @(thi.pth_curpri)
            }];
        }
    }
    
    // 2. Enumerate File Descriptors & Sockets
    NSMutableArray<NSDictionary<NSString *, id> *> *fdsList = [NSMutableArray array];
    NSMutableArray<NSDictionary<NSString *, id> *> *socketsList = [NSMutableArray array];
    
    int sz = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, NULL, 0);
    if (sz > 0) {
        struct proc_fdinfo *fds = malloc(sz);
        if (fds) {
            int actual = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, fds, sz);
            int fdCount = actual / sizeof(struct proc_fdinfo);
            
            for (int j = 0; j < fdCount; j++) {
                int fd = fds[j].proc_fd;
                uint32_t fdType = fds[j].proc_fdtype;
                
                if (fdType == PROX_FDTYPE_VNODE) {
                    struct vnode_fdinfowithpath vi;
                    if (proc_pidfdinfo(pid, fd, PROC_PIDFDVNODEPATHINFO, &vi, sizeof(vi)) == sizeof(vi)) {
                        NSString *path = [NSString stringWithUTF8String:vi.pvip.vip_path];
                        [fdsList addObject:@{
                            @"fd": @(fd),
                            @"type": @"File",
                            @"path": path ?: @"(unknown)"
                        }];
                    }
                } else if (fdType == PROX_FDTYPE_SOCKET) {
                    struct socket_fdinfo si;
                    if (proc_pidfdinfo(pid, fd, PROC_PIDFDSOCKETINFO, &si, sizeof(si)) == sizeof(si)) {
                        int family = si.psi.soi_family;
                        if (family == AF_INET || family == AF_INET6) {
                            char localIP[INET6_ADDRSTRLEN] = {0};
                            char remoteIP[INET6_ADDRSTRLEN] = {0};
                            int lport = 0, rport = 0;
                            NSString *proto = (si.psi.soi_type == SOCK_STREAM) ? @"TCP" : @"UDP";
                            NSString *state = @"NONE";
                            
                            if (family == AF_INET) {
                                inet_ntop(AF_INET, &si.psi.soi_proto.pri_in.insi_laddr.ina_46.i46a_addr4, localIP, sizeof(localIP));
                                inet_ntop(AF_INET, &si.psi.soi_proto.pri_in.insi_faddr.ina_46.i46a_addr4, remoteIP, sizeof(remoteIP));
                                lport = ntohs(si.psi.soi_proto.pri_in.insi_lport);
                                rport = ntohs(si.psi.soi_proto.pri_in.insi_fport);
                            } else {
                                inet_ntop(AF_INET6, &si.psi.soi_proto.pri_in.insi_laddr.ina_6, localIP, sizeof(localIP));
                                inet_ntop(AF_INET6, &si.psi.soi_proto.pri_in.insi_faddr.ina_6, remoteIP, sizeof(remoteIP));
                                lport = ntohs(si.psi.soi_proto.pri_in.insi_lport);
                                rport = ntohs(si.psi.soi_proto.pri_in.insi_fport);
                            }
                            
                            if (si.psi.soi_type == SOCK_STREAM) {
                                state = tcpStateString(si.psi.soi_proto.pri_tcp.tcpsi_state);
                            }
                            
                            NSDictionary<NSString *, id> *sockDict = @{
                                @"fd": @(fd),
                                @"protocol": proto,
                                @"localAddress": [NSString stringWithUTF8String:localIP],
                                @"localPort": @(lport),
                                @"remoteAddress": [NSString stringWithUTF8String:remoteIP],
                                @"remotePort": @(rport),
                                @"state": state
                            };
                            
                            [socketsList addObject:sockDict];
                            [fdsList addObject:@{
                                @"fd": @(fd),
                                @"type": @"Socket",
                                @"path": [NSString stringWithFormat:@"%@ %@:%d -> %@:%d", proto, [NSString stringWithUTF8String:localIP], lport, [NSString stringWithUTF8String:remoteIP], rport]
                            }];
                        } else {
                            [fdsList addObject:@{
                                @"fd": @(fd),
                                @"type": @"Socket (Unix/Other)",
                                @"path": @"Unix Domain Socket"
                            }];
                        }
                    }
                } else if (fdType == PROX_FDTYPE_PIPE) {
                    [fdsList addObject:@{
                        @"fd": @(fd),
                        @"type": @"Pipe",
                        @"path": @"FIFO/Pipe"
                    }];
                } else {
                    [fdsList addObject:@{
                        @"fd": @(fd),
                        @"type": @"Other",
                        @"path": @""
                    }];
                }
            }
            free(fds);
        }
    }
    
    return [MMProcessDetailInspector summarizeInspectionResultsWithPID:pid
                                                               threads:threads
                                                                   fds:fdsList
                                                               sockets:socketsList];
}

@end