Skip to content
macsyscalls

Articles tagged: #mach

← Back to all articles
task_for_pid: macOS's most dangerous Mach trap
How task_for_pid works, why Apple gates it the way it does, and what its entitlement model means for security tooling on macOS.
machtask_for_pidsecuritycode-injection
Mach traps vs BSD syscalls: two kernels in one Mac
XNU is a Mach-3 microkernel with a BSD personality bolted on top. That hybrid is why macOS has two distinct syscall families — here's what each is for, and how they differ in practice.
xnumachbsdkernel