Track UI Events and Network Activity in macOS Using Rust + SwiftUI

Most macOS apps are black boxes. You click a button, something happens—maybe a network request, maybe some system interaction—but it's hard to know what unless you own the source code. So I built a tool to watch. This post walks through a hybrid SwiftUI + Rust project that logs every button click and tracks network traffic tied to the clicked app. It combines: A SwiftUI frontend to simulate normal GUI interaction A Rust backend using CGEventTap and the macOS Accessibility API Per-process network inspection using the undocumented but powerful nettop No kernel extensions. No root. Just clever usage of system APIs and a bit of FFI. The full source code is available here. Why build this? Because reverse-engineering app behavior shouldn't require a debugger or Wireshark session. I wanted to: Trace which UI elements trigger which network activity Understand what apps do in response to input Have a working reference for macOS Accessibility APIs in Rust The Windows version of this tool relied on Win32 hooks and low-level TCP inspection via GetExtendedTcpTable. You can read that walkthrough here → This macOS build takes the same spirit to Apple's ecosystem—same goals, different APIs. Demo: From Click to Packet When a user clicks Button A, here's what gets logged:

Apr 13, 2025 - 17:42
 0
Track UI Events and Network Activity in macOS Using Rust + SwiftUI

Blog Post Cover Image

Most macOS apps are black boxes. You click a button, something happens—maybe a network request, maybe some system interaction—but it's hard to know what unless you own the source code.

So I built a tool to watch.

This post walks through a hybrid SwiftUI + Rust project that logs every button click and tracks network traffic tied to the clicked app. It combines:

  • A SwiftUI frontend to simulate normal GUI interaction
  • A Rust backend using CGEventTap and the macOS Accessibility API
  • Per-process network inspection using the undocumented but powerful nettop

No kernel extensions. No root. Just clever usage of system APIs and a bit of FFI.

The full source code is available here.

Why build this?

Because reverse-engineering app behavior shouldn't require a debugger or Wireshark session. I wanted to:

  • Trace which UI elements trigger which network activity
  • Understand what apps do in response to input
  • Have a working reference for macOS Accessibility APIs in Rust

The Windows version of this tool relied on Win32 hooks and low-level TCP inspection via GetExtendedTcpTable.
You can read that walkthrough here →

This macOS build takes the same spirit to Apple's ecosystem—same goals, different APIs.

Demo: From Click to Packet

When a user clicks Button A, here's what gets logged: