ICloud – Safari: using dtrace to investigate iCloud Tab Sync

icloudsafari

I'm investigating how Safari syncs tabs through iCloud.

To start, I really want to know how Safari is updating its shared list of tabs, which means monitoring it or some background daemon for file creations and modifications. (My hypothesis being: when I open a new tab on my phone, iCloud sends a push to my Mac which updates Safari's "iCloud Tabs" list.)

I'm trying to use dtrace to monitor Safari's file opens, with something simple like:

sudo dtrace -n 'syscall::open*:entry /execname == "Safari"/ { printf ("%s", copyinstr(arg0)); }'

but dtrace prints out this error:

dtrace: error on enabled probe ID 7 (ID 160: syscall::open:entry): invalid user access in action #1 at DIF offset 24

(This is the same error as someone asked on Apple's forums)

Debugging a strange iTunes permissions problem with DTrace had information about a similar issue with iTunes, but I don't quite understand what backflips they performed in gdb to get iTunes to be dtrace-able.

  1. Can someone help me understand Debugging a strange iTunes permissions problem with DTrace: what's the error caused by, and what's the resolution?
  2. Do you have any additional knowledge/information about iCloud Tab syncing? What process syncs them? Where are they stored on-disk?

Best Answer

The file that contains the iCloud tabs is:

~/Library/SyncedPreferences/com.apple.Safari.plist

It's a binary file, so you can use plutil to convert a copy to JSON/XML for processing. I expected the syncing to be via bird but some light spelunking with brctl log -w and other light snooping don't reflect changes I make to the tab database. There are quite a few nice projects on github that parse this file in python, JS as well as a nice menu bar app:

Knowing where the data persists on disk shows that syncdefaultsd is the owning process:

sudo fsusage -w | grep com.apple.Safari

Sadly, that private framework and daemon are basically undocumented by Apple save for what you can glean from the launchd plist for the service.

Related Question