On Thu, Nov 13 2014 at 01:33, Quinn \"The Eskimo!\" wrote:
No it is not. The kernel does not keep a copy of the arguments passed to the process.
Hey Quinn, So is there a way to get access to the process' memory from a kext (eg, reading p->user_stack seems like it would get me what I want)? Or is the suggested approach to use a userland daemon with kqueue() listener listing for NOTE_EXEC and then use libproc or sysctl KERN_PROCARGS to access argv? I 'spose I'll go try to hack this up. Cheers, peter _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.... This email sent to site_archiver@lists.apple.com