lsof常用语法:
检测本机端口开放 lsof -i:[port]
查找指定进程开放端口 lsof -aPi -p [pid]
查找所有监听端口 lsof -aPi
为什么自己编译？
目前没发现针对iOS10.x可用的lsof，我用它来查找进程占用的描述符，包括tcp端口
1.下载最新版本lsof
https://opensource.apple.com/tarballs/lsof/
2.Mac上解压后编译
根目录下有Makefile lsof/ lsof.plist
切换到lsof/下执行./Configure darwin（问题都选no），得到以下结果：
Configuring libproc-based Darwin lsof
This configuration step (the Inventory script) takes inventory of
the lsof distribution. The script runs for a minute or two while
it checks that all the subdirectories, information files, scripts,
header files and source files that should be present really are.
It's not absolutely necessary that you take inventory, but it's a
good idea to do it right after the lsof distribution has been
unpacked. Once the inventory has been taken, this script creates
the file ./.ck00MAN as a signal that the inventory step has been
done.
You can call the Inventory script directly at any time to take
inventory. You can inhibit the inventory step permanently by
creating the file ./.neverInv, and you can tell the Configure script
to skip the inventory and customization steps with the -n option.
Do you want to take inventory (y|n) [y]? n
rm -f ddev.c dfile.c dlsof.h dmnt.c dnode*.c dproc.c dproto.h dsock.c dstore.c dzfs.h kernelbase.h machine.h machine.h.old new_machine.h __lseek.s Makefile Makefile.zfs ./tests/config.cflags
rm -f ./tests/config.cc ./tests/config.xobj ./tests/config.ldflags
Testing C library for localtime() and strftime(), using cc ... npresent
ln -s dialects/darwin/libproc/dlsof.h dlsof.h
ln -s dialects/darwin/libproc/ddev.c ddev.c
ln -s dialects/darwin/libproc/dfile.c dfile.c
ln -s dialects/darwin/libproc/dmnt.c dmnt.c
ln -s dialects/darwin/libproc/dproc.c dproc.c
ln -s dialects/darwin/libproc/dproto.h dproto.h
ln -s dialects/darwin/libproc/dsock.c dsock.c
ln -s dialects/darwin/libproc/dstore.c dstore.c
ln -s dialects/darwin/libproc/dnetpolicy.c dnetpolicy.c
ln -s dialects/darwin/libproc/dchannel.c dchannel.c
ln -s dialects/darwin/libproc/dnexus.c dnexus.c
ln -s dialects/darwin/libproc/machine.h machine.h
Makefile and lib/Makefile created.
./tests/config.cc created
./tests/config.cflags created
./tests/config.ldflags created
./tests/config.xobj created
You may now customize the machine.h header file for this UNIX
dialect. The customizations will take effect when you compile
lsof. You may also choose to skip customization and proceed to
the compilation of lsof.
If you don't know if you need to customize or want to know more
about what you can customize, consult the 00DCACHE, 00FAQ, 00PORTING,
and 00README files of the lsof distribution. You might also find
it helpful to examine the machine.h header file for the dialect
you're customizing.
You don't need to use this procedure to customize lsof; you can
edit the machine.h header file directly. If you later decide you
want to use this procedure to customize machine.h, execute the
./Customize script.
Do you want to customize (y|n) [y]? #
执行make得到如下结果：
(cd lib; /Applications/Xcode.app/Contents/Developer/usr/bin/make DEBUG="-O" CFGF="-DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\"")
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o ckkv.o ckkv.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o cvfs.o cvfs.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o dvch.o dvch.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o fino.o fino.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o isfn.o isfn.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o lkud.o lkud.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o pdvn.o pdvn.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o prfp.o prfp.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o ptti.o ptti.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rdev.o rdev.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o regex.o regex.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rmnt.o rmnt.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rnam.o rnam.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rnch.o rnch.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o rnmh.o rnmh.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR="16.7.0" -O -c -o snpf.o snpf.c
ar cr liblsof.a ckkv.o cvfs.o dvch.o fino.o isfn.o lkud.o pdvn.o prfp.o ptti.o rdev.o regex.o rmnt.o rnam.o rnch.o rnmh.o snpf.o
ranlib liblsof.a
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o ddev.o ddev.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dfile.o dfile.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dmnt.o dmnt.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dproc.o dproc.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dsock.o dsock.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dstore.o dstore.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o arg.o arg.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o main.o main.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o misc.o misc.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o node.o node.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o print.o print.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o proc.o proc.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o store.o store.c
Constructing version.h
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o usage.o usage.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o util.o util.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dnetpolicy.o dnetpolicy.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dchannel.o dchannel.c
dchannel.c:52:7: error: use of undeclared identifier 'PROC_CHANNEL_TYPE_USER_PIPE'
case PROC_CHANNEL_TYPE_USER_PIPE:
^
dchannel.c:55:7: error: use of undeclared identifier 'PROC_CHANNEL_TYPE_KERNEL_PIPE'
case PROC_CHANNEL_TYPE_KERNEL_PIPE:
^
dchannel.c:58:7: error: use of undeclared identifier 'PROC_CHANNEL_TYPE_NET_IF'
case PROC_CHANNEL_TYPE_NET_IF:
^
dchannel.c:61:7: error: use of undeclared identifier 'PROC_CHANNEL_TYPE_FLOW_SWITCH'
case PROC_CHANNEL_TYPE_FLOW_SWITCH:
^
dchannel.c:78:16: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR'
if ((flags & (PROC_CHANNEL_FLAGS_MONITOR)) != 0) {
^
dchannel.c:80:17: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR'
if ((flags & (PROC_CHANNEL_FLAGS_MONITOR))
^
dchannel.c:81:10: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR'
== PROC_CHANNEL_FLAGS_MONITOR) {
^
dchannel.c:83:23: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR_TX'
} else if ((flags & PROC_CHANNEL_FLAGS_MONITOR_TX) != 0) {
^
dchannel.c:88:16: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_MONITOR_NO_COPY'
if ((flags & PROC_CHANNEL_FLAGS_MONITOR_NO_COPY) != 0) {
^
dchannel.c:93:15: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_EXCLUSIVE'
if ((flags & PROC_CHANNEL_FLAGS_EXCLUSIVE) != 0) {
^
dchannel.c:102:15: error: use of undeclared identifier 'PROC_CHANNEL_FLAGS_USER_PACKET_POOL'
if ((flags & PROC_CHANNEL_FLAGS_USER_PACKET_POOL) != 0) {
^
dchannel.c:123:24: error: variable has incomplete type 'struct channel_fdinfo'
struct channel_fdinfo ci;
^
dchannel.c:123:9: note: forward declaration of 'struct channel_fdinfo'
struct channel_fdinfo ci;
^
dchannel.c:131:31: error: use of undeclared identifier 'PROC_PIDFDCHANNELINFO'
nb = proc_pidfdinfo(pid, fd, PROC_PIDFDCHANNELINFO, &ci, sizeof(ci));
如上，下面着手解决这些错误，这些错误都是类型和值未定义，其实可以通过逆向mac自带lsof来还原，这里为了简便，直接将dchannel.c这些发生错误语句删掉，最终dchannel.c中的代码如下：
#include "lsof.h"
void process_channel(int pid, int32_t fd){}
再次执行make
(cd lib; /Applications/Xcode.app/Contents/Developer/usr/bin/make DEBUG="-O" CFGF="-DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\"")
make[1]: Nothing to be done for `all'.
Constructing version.h
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o usage.o usage.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dchannel.o dchannel.c
cc -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o dnexus.o dnexus.c
cc -o lsof -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O ddev.o dfile.o dmnt.o dproc.o dsock.o dstore.o arg.o main.o misc.o node.o print.o proc.o store.o usage.o util.o dnetpolicy.o dchannel.o dnexus.o -L./lib -llsof -lcurses
成功编译lsof的x86_64版本，可以直接在Mac上运行。下面来编译arm/arm64的版本make CC="$(xcrun --sdk iphoneos --find clang) -isysroot $(xcrun --sdk iphoneos --show-sdk-path) -arch armv7 -arch armv7s -arch arm64"得到如下结果：
(cd lib; /Applications/Xcode.app/Contents/Developer/usr/bin/make DEBUG="-O" CFGF="-DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\"")
make[1]: Nothing to be done for `all'.
Constructing version.h
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS11.0.sdk -arch armv7 -arch armv7s -arch arm64 -DHASIPv6 -mdynamic-no-pic -DHASUTMPX -DDARWINV=1600 -DHAS_STRFTIME -DLSOF_VSTR=\"16.7.0\" -O -c -o usage.o usage.c
In file included from usage.c:39:
In file included from ./lsof.h:213:
./dlsof.h:56:10: fatal error: 'netinet/tcp_fsm.h' file not found
#include <netinet/tcp_fsm.h>
^~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [usage.o] Error 1
该错误是iphone对应SDK /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/usr/include/缺少头文件导致，这些缺少的头文件从/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include拷贝即可，这些文件包括：
netinet/tcp_fsm.h
rpc/pmap_prot.h
libproc.h
sys/proc_info.h
sys/kern_control.h
net/route.h
再次make此时编译成功，执行file命令：
lsof: Mach-O universal binary with 3 architectures: [arm_v7: Mach-O executable arm_v7] [arm_v7s: Mach-O executable arm_v7s] [arm64: Mach-O 64-bit executable arm64]
lsof (for architecture armv7): Mach-O executable arm_v7
lsof (for architecture armv7s): Mach-O executable arm_v7s
lsof (for architecture arm64): Mach-O 64-bit executable arm64
拷贝到越狱iphone上执行，会出现killed: 9，需要对lsof进行签名：
创建文件entitlement.xml
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.springboard.debugapplications</key>
<true/>
<key>get-task-allow</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
<key>run-unsigned-code</key>
<true/>
</dict>
</plist>
执行签名：ldid -Sentitlement.xml lsof
此时再将lsof拷贝到越狱iphone上，可以执行了！
我自己用的放在git上https://github.com/lichao890427/codesegment/blob/master/lsof_10.x
