ProcInfo - Process info/monitoring library for macOS

1. add the Proc Info library (lib/libprocInfo.a) and Apple's OpenBSM library (libbsm.tbd) to your Xcode Project
2. import the Proc Info library header file (procInfo.h)
3. instantiate a Proc Info object
4. a) to retrieve information about a running process invoke the init: method
   b) to enumerate existing processes invoke the currentProcesses method
   c) to monitor process events, declare a callback block and invoke the start: method

#import "procInfo.h"

//init proc info object
ProcInfo* procInfo = [[ProcInfo alloc] init];

//dump process info for process 1337
NSLog(@"process: %@", [[Process alloc] init:1337]);

//dump process info for all processes
for(Process* process in [procInfo currentProcesses])
    NSLog(@"new process: %@", process);

//block for process events
ProcessCallbackBlock block = ^(Process* process)
{
    if(process.type != EVENT_EXIT)
       NSLog(@"process start: %@\n", process);

    else
      NSLog(@"process exit: %d\n", process.pid);
};

//start monitoring
// ->block will be invoke upon process events!
[processInfo start:block];

Details

• retrieve information about arbitrary processes (by pid)
• retrieve information about all running processes
• monitor for process start & exit events

• need to track process creation events (e.g. RansomWhere? BlockBlock, etc)
• classify running processes (based on their cryptographic signatures)