4 ms·
That's overkill for most things since it relies on being able to patch running kernel code, which is also the definition of an RCE exploit. I think it should w
by astrange 1y ago
That's overkill for most things since it relies on being able to patch running kernel code, which is also the definition of an RCE exploit.
I think it should work if you run `bputil -c`? Didn't try it though.
- viraptor 1y agoIt just doesn't work at all since M2. I've got a bug report open and confirmed and Apple officially does not care anymore. If you try to run it, it will crash your whole system.
- Someone 1y ago> That's overkill for most things since it relies on being able to patch running kernel code, which is also the definition of an RCE exploit. The idea of dtrace is that you can do that, yes, but to that, you need to be authorized, and the things you can do are (supposed to be) limited to looking to see what’s happening in the system. You can read arguments, but can’t, for example, change the arguments of a system call or disable authorization checks on system calls.
- astrange 1y agoThe reason dtrace doesn't work by default is the kernel memory is locked down so nothing can write to it. There are no exceptions to this even if you're authorized. (Or rather, the exception requires restarting the machine to turn the security off.)