You will need to disable SIP (and library validation) to do this, because your code signature will not match the target process's, which is kind of what this is intended to prevent. This is also why you cannot attach a debugger to arbitrary processes when those protections are engaged. But once you turn that off, there's a lot you can do, here's one of my projects that might give you an idea of one way to do this: https://gist.github.com/a70d44951cb72f82efee3317d80ac07f