Track UI Events and Network Activity in macOS Using Rust + SwiftUI
Most macOS apps are black boxes. You click a button, something happens—maybe a network request, maybe some system interaction—but it's hard to know what unless you own the source code. So I built a tool to watch. This post walks through a hybrid SwiftUI + Rust project that logs every button click and tracks network traffic tied to the clicked app. It combines: A SwiftUI frontend to simulate normal GUI interaction A Rust backend using CGEventTap and the macOS Accessibility API Per-process network inspection using the undocumented but powerful nettop No kernel extensions. No root. Just clever usage of system APIs and a bit of FFI. The full source code is available here. Why build this? Because reverse-engineering app behavior shouldn't require a debugger or Wireshark session. I wanted to: Trace which UI elements trigger which network activity Understand what apps do in response to input Have a working reference for macOS Accessibility APIs in Rust The Windows version of this tool relied on Win32 hooks and low-level TCP inspection via GetExtendedTcpTable. You can read that walkthrough here → This macOS build takes the same spirit to Apple's ecosystem—same goals, different APIs. Demo: From Click to Packet When a user clicks Button A, here's what gets logged:

Most macOS apps are black boxes. You click a button, something happens—maybe a network request, maybe some system interaction—but it's hard to know what unless you own the source code.
So I built a tool to watch.
This post walks through a hybrid SwiftUI + Rust project that logs every button click and tracks network traffic tied to the clicked app. It combines:
- A SwiftUI frontend to simulate normal GUI interaction
- A Rust backend using
CGEventTap
and the macOS Accessibility API - Per-process network inspection using the undocumented but powerful
nettop
No kernel extensions. No root. Just clever usage of system APIs and a bit of FFI.
The full source code is available here.
Why build this?
Because reverse-engineering app behavior shouldn't require a debugger or Wireshark session. I wanted to:
- Trace which UI elements trigger which network activity
- Understand what apps do in response to input
- Have a working reference for macOS Accessibility APIs in Rust
The Windows version of this tool relied on Win32 hooks and low-level TCP inspection via GetExtendedTcpTable.
You can read that walkthrough here →
This macOS build takes the same spirit to Apple's ecosystem—same goals, different APIs.
Demo: From Click to Packet
When a user clicks Button A, here's what gets logged: