Re:Apple's new Processor Trace instrument is incredible
by astrange on Sunday August 17, 2025 @02:26PM
(#44933741)
The reason dtrace doesn't work by default is the kernel memory is locked down so nothing can write to it. There are no exceptions to this even if you're authorized.
(Or rather, the exception requires restarting the machine to turn the security off.)
The idea of dtrace is that you can do that, yes, but to that, you need to be authorized, and the things you can do are (supposed to be) limited to looking to see what’s happening in the system. You can read arguments, but can’t, for example, change the arguments of a system call or disable authorization checks on system calls.