macOS ktrace“-t c”系统调用跟踪在较新的 macOS 上可用吗？

Question

有人知道是否有办法在 macOS 12+ 中通过

ktrace

只跟踪系统调用？ （显然这是禁用 SIP 的情况。）

过去可以通过以下方式跟踪系统调用：

sudo ktrace trace -s -S -t c -c ./some_binary

现在

-t

简直就是

Print times as Mach absolute timestamps, instead of the default local wall clock time.

Answer 1

-t trstr

的替代品似乎是

-f filter-desc

。新的过滤器更灵活，但使用起来可能更麻烦一些。这是手册页的内容：

-f filter-desc

Apply a filter description to the trace session, controlling which events
are traced.  See FILTER DESCRIPTIONS for details on the syntax of a
filter.  If no filter description is provided, all events will be traced.

FILTER DESCRIPTIONS

A filter description is a comma-separated list of class and subclass specifiers that indicate
which events should be traced.  A class specifier starts with ‘C’ and contains a single byte,
specified in either decimal or hex.  A subclass specifier starts with ‘S’ and takes two
bytes.  The high byte is the class and the low byte is the subclass of that class.

For example, this filter description would enable classes 1 and 37 and the subclasses 33 and
35 of class 5: ‘C1,C0x25,S0x0521,S0x0523’.  The ‘ALL’ filter description enables events from
all classes.

您可以过滤的可能值在 bsd/sys/kdebug.h 中定义。

因此，如果您对 BSD 系统调用感兴趣，那就是

-f C4

（第 4 类 =

DBG_BSD

）。 Mach 系统调用（又名陷阱）将是

-f S0x010c

（类 1 =

DBG_MACH

，子类

0c

=

DBG_MACH_EXCP_SC

）。

因此要显示 BSD 系统调用和 Mach 陷阱：

sudo ktrace trace -f C4,S0x010c -c ./some_binary

根据您的需求，您可能还需要

C2,C3

（

DBG_NETWORK

和

DBG_FSYSTEM

）。