find macOS service and it's plist file

0x00:

find macOS service ‘s plist file.

com.apple.xxxx —> xxxx.plist

0x01 :

find all *.plist file and use grep to find target service, not the best way.

0x02 :

use procexp.

./procexp.universal all ports | service_name

0x03 :

this way is more complex than others, thx to brightiup :)

1. step 1

   write a simple gadget, core logic as follow:

bootstrap_look_up(bs_port, render_service_name, &p);
...
mach_msg(&m.header, MACH_SEND_MSG | MACH_MSG_OPTION_NONE, sizeof(message), 0, 0, 0, 0);
...
getchar(); //do not exit untill we finish

2. step 2

   get the pid of your gadget

3. Step 3

   sudo lsmp -p pid

now, you can get the service name according to mach port, then find the plist file by service name you found.