The most useful tool was dtrace... Until Apple killed it with M2.

That's overkill for most things since it relies on being able to patch running kernel code, which is also the definition of an RCE exploit.

I think it should work if you run `bputil -c`? Didn't try it though.

It just doesn't work at all since M2. I've got a bug report open and confirmed and Apple officially does not care anymore. If you try to run it, it will crash your whole system.

> That's overkill for most things since it relies on being able to patch running kernel code, which is also the definition of an RCE exploit.

The idea of dtrace is that you can do that, yes, but to that, you need to be authorized, and the things you can do are (supposed to be) limited to looking to see what’s happening in the system. You can read arguments, but can’t, for example, change the arguments of a system call or disable authorization checks on system calls.

The reason dtrace doesn't work by default is the kernel memory is locked down so nothing can write to it. There are no exceptions to this even if you're authorized.

(Or rather, the exception requires restarting the machine to turn the security off.)

Windows Performance Analyser is pretty amazing. Not the simplest tool to use, but not particularly hard. Bruce Dawson's blog (https://randomascii.wordpress.com) has lots of articles using it.