Detect which app is currently running on iOS using sysctl

Question

I have currently implemented a simple activity monitor to watch all running processes on iOS.

To retrieve a list of all running processes, I do this:

size_t size;
struct kinfo_proc *procs = NULL;
int status;
NSMutableArray *killedProcesses = [[NSMutableArray alloc] init];

int mib[4] = { CTL_KERN, KERN_PROC, KERN_PROC_ALL, 0 };

status  = sysctl(mib, 4, NULL, &size, NULL, 0);
procs   = malloc(size);
status  = sysctl(mib, 4, procs, &size, NULL, 0);

// now, we have a nice list of processes

And if I want more information about a specific process, I'll do:

struct kinfo_proc *proc;
int mib[5] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, pidNum, 0 };
int count;
size_t size = 0;

// ask the proc size
if(sysctl(mib, 4, NULL, &size, NULL, 0) < 0) return -1;

// allocate memory for proc
proc = (struct kinfo_proc *)malloc(size);

sysctl(mib, 4, proc, &size, NULL, 0);

All the extra proc info I want is now stored in proc.

I notice that apps won't be killed by the OS. Even when an app is not used for a long time (longer than 10 min.) it will remain in the process list. Even when I query what "state" the process has (proc->kp_proc.p_stat), it returns "running".

My question is: does anybody know a method to detect which PID is currently running/actively used (maybe: increasing cpu time? running time? cpu ticks etc.) ??

Smoothbore

First, I have a question for you. When the value of p_stat is 2, does this means this process is running? When I run on simulator, I found some of the process have a p_stat value of 5. In addition, I found that all the values for tick or cpu time are 0. It seems that these values are never stat in darwin. I don't know whether it is the same in free BSD. – Stroud

Nope. Values don't seem to change anywhere... so no indication of a running process from sysctl so far – Smoothbore

@Smoothbore Do you know how to figure out when the process is in foreground or background? – Macmullin

@JamesLaurenstin I am also interested in knowing this if you ever figure it out. – Fiesta

I don't think this is possible at all. I've done so much research on this subject. The only way I can think of is by abusing the undocumented SpringBoard API. – Smoothbore

how can we calculate memory used by the process? – Anatol

@hackerdiehack, do you have any info/links to share on private APIs to query the springboard? Private APIs are ok for my (non appstore) application. – Pneumo

Answer 1

Answering the "currently running" part of your question:

I used the code from this answer Can we retrieve the applications currently running in iPhone and iPad

Looked after the k_proc declarations here: http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/bsd/sys/proc.h

With trial and error found out that the processes with the p_flag set to 18432 is the currently running application (in this case this test).

See the first link, and replace the inner of the for cycle with:

if (process[i].kp_proc.p_flag == 18432){

                        NSString * processID    = [[NSString alloc] initWithFormat:@"%d", process[i].kp_proc.p_pid];
                        NSString * processName  = [[NSString alloc] initWithFormat:@"%s", process[i].kp_proc.p_comm];
                        NSString * status       = [[NSString alloc] initWithFormat:@"%d",process[i].kp_proc.p_flag ];

                        NSDictionary * dict = [[NSDictionary alloc] initWithObjects:[NSArray arrayWithObjects:processID, processName,status, nil]
                                                                            forKeys:[NSArray arrayWithObjects:@"ProcessID", @"ProcessName",@"flag", nil]];

                        [array addObject:dict];

}

Ure

that doesn't seem to work for me... how do you check this? I tried the following: kp_proc.p_flag == 18432 – Smoothbore

unfortunately, this only returns the current app that is being debugged :/ – Smoothbore