I'd like to catch the system calls that an process is making, so I can
examine the system call and optionally handle it myself. Under
Linux and
Solaris, I can use ptrace() with the PTRACE_SYSCALL command, which
will
let the process run until it enters or exits a system call.
Is there an equivalent for Darwin? Using a KEXT to patch the system
call
table is really not an option...
PT_SYSCALL is, as you have probably noticed, not implemented for the
Darwin ptrace.
Remember that the binary compatibility layer guarantee made by Mac OS X
is at the framework boundary, *not* at the syscall layer. Direct
reference
to system calls is avoided wherever possible in user space; they are
in effect
just a convenient way of implementing what the frameworks offer and
can move around quite a bit from version to version.
As such, if you want to interpose and affect the outcome of
application calls
to system services, you should look to the dyld interpositioning
mechanisms.
For the most part you only need to worry about libSystem; other
frameworks
call it to make system calls. You may, however, also need to consider
intercepting Mach IPC depending on exactly what it is that you're
trying to do.
= Mike
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/darwin-dev/email@hidden
