svc · unix #539
task_read_for_pid
Returns a read-flavor task port for the given PID — sufficient for memory inspection but not modification.
Prototype
int task_read_for_pid(mach_port_name_t target_tport, int pid, mach_port_name_t *t);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| target_tport | mach_port_name_t | - | |
| pid | int | - | |
| t | mach_port_name_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 539 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 539 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 539 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 539 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 539 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 539 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 539 |
| xnu-10002.41.9 | — | 539 |
| xnu-10002.61.3 | — | 539 |
| xnu-10002.81.5 | — | 539 |
| xnu-10063.101.15 | — | 539 |
| xnu-10063.121.3 | — | 539 |
| xnu-10063.141.1 | — | 539 |
| xnu-11215.41.3 | — | 539 |
| xnu-11215.61.5 | — | 539 |
| xnu-11215.81.4 | — | 539 |
| xnu-11417.121.6 | — | 539 |
| xnu-11417.140.69 | — | 539 |
| xnu-12377.101.15 | — | 539 |
| xnu-12377.41.6 | — | 539 |
| xnu-12377.61.12 | — | 539 |
| xnu-12377.81.4 | — | 539 |
| xnu-7195.101.1 | — | 539 |
| xnu-7195.121.3 | — | 539 |
| xnu-7195.141.2 | — | 539 |
| xnu-7195.60.75 | — | 539 |
| xnu-7195.81.3 | — | 539 |
| xnu-8019.61.5 | — | 539 |
| xnu-8019.80.24 | — | 539 |
| xnu-8020.101.4 | — | 539 |
| xnu-8020.121.3 | — | 539 |
| xnu-8020.140.41 | — | 539 |
| xnu-8792.61.2 | — | 539 |
| xnu-8792.81.2 | — | 539 |
| xnu-8796.101.5 | — | 539 |
| xnu-8796.121.2 | — | 539 |
| xnu-8796.141.3 | — | 539 |
Notes
Added in macOS 11.3 alongside the read/inspect split, this flavor grants mach_vm_read, mach_vm_region, thread_get_state, and equivalent introspective calls without permitting writes, thread creation, or exception-port hijacking. Debuggers that only need to symbolicate stacks (sample, leaks, heap, vmmap) request the read port to stay outside SIP's get-task-allow gate where possible. Authorization rules mirror task_for_pid (taskgated + AMFI + entitlement check), but the surface area exposed is far narrower.
Detection
Endpoint Security exposes ES_EVENT_TYPE_NOTIFY_GET_TASK_READ and the AUTH variant on macOS 11.3+. Pre-11.3 systems do not support this trap. DTrace mach_trap probe covers what ES cannot.