1

-Edit- Looks like using csrutil to disable system protection solved it. Is there a less extreme solution?

I'd like to see all the syscall/service calls my app makes to the OS. Below it doesn't seem to be logging any calls. I was expecting to see write and exit_group (or exit) like I see on linux using strace.

I compiled the assembly below with clang hello.s I ran sudo dtruss ./a.out and got this output

dtrace: system integrity protection is on, some features will not be available

SYSCALL(args)        = return
Hello

Assembly

$ cat hello.s 
    .global _main
    .align 2

    _main: mov X0, #1
    adr     X1, hello
    mov     X2, #13
    mov     X16, #4
    svc     0

    mov     X0, #0
    mov     X16, #1
    svc     0

    hello: .ascii  "Hello\n"

Why don't I see the write or exit(_group)?

Stan
  • 161
  • 8
  • @njuffa yes, tries those – Stan Dec 02 '22 at 23:16
  • Does disabling just dtruss controls in SIP solve it? See Alexander Ushakov's answer [here](https://stackoverflow.com/questions/33476432/is-there-a-workaround-for-dtrace-cannot-control-executables-signed-with-restri/33584192#33584192). – Gordon Davisson Dec 03 '22 at 00:56
  • @GordonDavisson that appears to work ty – Stan Dec 03 '22 at 01:37

0 Answers0