How is it possible to inject to processes by executable names instead of PIDs?

[andrd3v]

I need an approach to automatic PID recoinnaissance so I could automate the injector in my app's backend. Is it attainable to do so with or without SIP?

[nkhmelni]

The following approach isn't restricted by SIP, yet you might need root privileges.

- (pid_t)findProcessByName:(NSString *)processName {
    if (!processName || processName.length == 0) return -1;

    const char *name = [processName UTF8String];
    pid_t *pids = NULL;
    int bufCount = 4096;
    int num = 0;

    for (;;) {
        pids = (pid_t *)realloc(pids, bufCount * sizeof(pid_t));
        if (!pids) return -1;

        num = proc_listallpids(pids, bufCount * sizeof(pid_t));
        if (num < 0) {
            free(pids);
            return -1;
        }
        if (num >= bufCount) {
            bufCount *= 2;
            continue;
        }
        break;
    }

    pid_t found = -1;
    char pathbuf[PROC_PIDPATHINFO_MAXSIZE];
    char namebuf[PROC_PIDPATHINFO_MAXSIZE];

    for (int i = 0; i < num; ++i) {
        pid_t pid = pids[i];
        if (pid <= 0) continue;

        int r = proc_pidpath(pid, pathbuf, sizeof(pathbuf));
        const char *bin_name = NULL;
        if (r > 0) {
            const char *b = strrchr(pathbuf, '/');
            bin_name = b ? b + 1 : pathbuf;
        } else {
            if (proc_name(pid, namebuf, sizeof(namebuf)) > 0)
                bin_name = namebuf;
        }

        if (bin_name) {
            if (strcasecmp(bin_name, name) == 0 || strcasestr(bin_name, name) != NULL) {
                found = pid;
                break;
            }
        }
    }

    free(pids);
    return found;
}