3 ms·
You don't actually get PTRACE_SYSCALL on OS X, so you need to play with dtrace or dynamic recompilation to get this kind of tool.
by lunixbochs 11y ago
You don't actually get PTRACE_SYSCALL on OS X, so you need to play with dtrace or dynamic recompilation to get this kind of tool.
- OJFord 11y agoMy understanding is that support for the ktrace back-end is (/was/will be) upcoming for python-ptrace. Unfortunately I don't have the skills for that, but what I meant is that I hope someone will; then tools like `maybe` can presumably use python-ptrace in just the same way as other Unices?
- lunixbochs 11y agoktrace doesn't exist anymore on OS X as far as I know. You need to use dtrace, which means you need to write dtrace programs. Python's dtrace interface would probably only let you load a dtrace program. It might be possible to implement `maybe` as a dtrace program by instrumenting syscall entry and raising a signal or stopping the program immediately, which you can recover in your debugger (though I'm not sure if this actually stops the syscall). That said, I tried it and OS X doesn't seem to allow "destructive" dtrace actions even as root with SIP disabled: $ sudo dtrace -n 'syscall::open:entry { stop(); }' -c 'cat Makefile' dtrace: could not enable tracing: Destructive actions not allowed $ sudo dtrace -n 'syscall::open:entry { raise(9); }' -c 'cat Makefile' dtrace: could not enable tracing: Destructive actions not allowed Alternately you can use dynamorio, intel pin, qemu, or a quick instruction scan/patch for SYSCALL to manually break on syscalls. Either way you almost certainly will not be able to do this with python-ptrace alone. I filed an issue to write a `maybe` tool using Usercorn [1] (which supports OS X) with my VFS overlay work, which means writes could still succeed but be non-destructive. [1] https://github.com/lunixbochs/usercorn/issues/151 https://github.com/lunixbochs/usercorn/issues/151