site_archiver@lists.apple.com Delivered-To: darwin-dev@lists.apple.com See the dyld(1) man page for details on the environment variables. - Kevin On Jan 20, 2006, at 9:01 PM, Mike Smith wrote: PT_SYSCALL is, as you have probably noticed, not implemented for the Darwin ptrace. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.appl... If you're not trying to corral a hostile environment, a simple way to intercept syscalls is to override them at the Libsystem layer. Define your own functions in a dylib, and then se the DYLD_INSERT_LIBRARIES and DYLD_FORCE_FLAT_NAMESPACE environment variables. Here is a sample dylib that overrides some common syscalls: <http://cvs.opendarwin.org/cgi-bin/cvsweb.cgi/projects/darwinbuild/ darwintrace/> On Jan 20, 2006, at 12:02 PM, darwin-dev-request@lists.apple.com wrote: I'd like to catch the system calls that an process is making, so I can examine the system call and optionally handle it myself. Under Linux and Solaris, I can use ptrace() with the PTRACE_SYSCALL command, which will let the process run until it enters or exits a system call. Is there an equivalent for Darwin? Using a KEXT to patch the system call table is really not an option... Remember that the binary compatibility layer guarantee made by Mac OS X is at the framework boundary, *not* at the syscall layer. Direct reference to system calls is avoided wherever possible in user space; they are in effect just a convenient way of implementing what the frameworks offer and can move around quite a bit from version to version. As such, if you want to interpose and affect the outcome of application calls to system services, you should look to the dyld interpositioning mechanisms. For the most part you only need to worry about libSystem; other frameworks call it to make system calls. You may, however, also need to consider intercepting Mach IPC depending on exactly what it is that you're trying to do. = Mike This email sent to site_archiver@lists.apple.com