Search

Search syscalls, Mach traps, and articles.

Detecting syscall abuse with macOS Endpoint Security in 2026
Endpoint Security is the modern, supported path for syscall-level detection on macOS — but its event taxonomy doesn't map 1-to-1 with syscalls. Here's the practical mapping for security work.
task_for_pid: macOS's most dangerous Mach trap
How task_for_pid works, why Apple gates it the way it does, and what its entitlement model means for security tooling on macOS.
Tracing macOS syscalls with dtrace on Apple Silicon
A practical guide to using DTrace to trace BSD syscalls and Mach traps on modern macOS — including SIP requirements, working scripts, and what to do when Apple's syscall probes go missing.
Mach traps vs BSD syscalls: two kernels in one Mac
XNU is a Mach-3 microkernel with a BSD personality bolted on top. That hybrid is why macOS has two distinct syscall families — here's what each is for, and how they differ in practice.
How macOS syscalls work in 2026
What actually happens when an arm64 Mac program issues an SVC instruction — from the user-space stub down to the BSD syscall dispatcher and back.