execve

Replaces the current process image with a new program loaded from a file.

Prototype

int execve(char *fname, char **argp, char **envp);

Returns: int

Arguments

Name	Type	Dir
fname	char	-
argp	char	-
envp	char	-

Version history

XNU tag	macOS	#
xnu-1456.1.26	macOS 10.6 Snow Leopard	59
xnu-1699.24.8	macOS 10.7 Lion	59
xnu-2050.18.24	macOS 10.8 Mountain Lion	59
xnu-2422.115.4	macOS 10.9 Mavericks	59
xnu-2782.40.9	macOS 10.10 Yosemite	59
xnu-3247.1.106	macOS 10.11 El Capitan	59
xnu-3789.1.32	macOS 10.12 Sierra	59
xnu-4570.1.46	macOS 10.13 High Sierra	59
xnu-4903.221.2	macOS 10.14 Mojave	59
xnu-6153.11.26	macOS 10.15 Catalina	59
xnu-7195.50.7.100.1	macOS 11.0 Big Sur	59
xnu-1486.2.11	—	59
xnu-1504.15.3	—	59
xnu-1504.3.12	—	59
xnu-1504.7.4	—	59
xnu-1504.9.17	—	59
xnu-1504.9.26	—	59
xnu-1504.9.37	—	59
xnu-1699.22.73	—	59
xnu-1699.22.81	—	59
xnu-1699.24.23	—	59
xnu-1699.26.8	—	59
xnu-1699.32.7	—	59
xnu-2050.22.13	—	59
xnu-2050.24.15	—	59
xnu-2050.48.11	—	59
xnu-2050.7.9	—	59
xnu-2050.9.2	—	59
xnu-2422.1.72	—	59
xnu-2422.100.13	—	59
xnu-2422.110.17	—	59
xnu-2422.90.20	—	59
xnu-2782.1.97	—	59
xnu-2782.10.72	—	59
xnu-2782.20.48	—	59
xnu-2782.30.5	—	59
xnu-3247.10.11	—	59
xnu-3248.20.55	—	59
xnu-3248.30.4	—	59
xnu-3248.40.184	—	59
xnu-3248.50.21	—	59
xnu-3248.60.10	—	59
xnu-3789.21.4	—	59
xnu-3789.31.2	—	59
xnu-3789.41.3	—	59
xnu-3789.51.2	—	59
xnu-3789.60.24	—	59
xnu-3789.70.16	—	59
xnu-4570.20.62	—	59
xnu-4570.31.3	—	59
xnu-4570.41.2	—	59
xnu-4570.51.1	—	59
xnu-4570.61.1	—	59
xnu-4570.71.2	—	59
xnu-4903.231.4	—	59
xnu-4903.241.1	—	59
xnu-4903.270.47	—	59
xnu-6153.101.6	—	59
xnu-6153.121.1	—	59
xnu-6153.141.1	—	59
xnu-6153.41.3	—	59
xnu-6153.61.1	—	59
xnu-6153.81.5	—	59
xnu-7195.101.1	—	59
xnu-7195.121.3	—	59
xnu-7195.141.2	—	59
xnu-7195.60.75	—	59
xnu-7195.81.3	—	59

Examples

exec with argv/envp

char *argv[] = {"/usr/bin/sw_vers", "-productVersion", NULL};
char *envp[] = {"PATH=/usr/bin", NULL};
execve(argv[0], argv, envp);
perror("execve");
_exit(127);

Notes

XNU resolves the executable through the image activator chain (Mach-O, fat, #! scripts), enforces AMFI signature checks, applies entitlements, and rebuilds the Mach task's VM map. File descriptors without FD_CLOEXEC survive; signal handlers reset to default but the signal mask is preserved. Failure leaves the calling process intact, but success never returns.

Detection

Endpoint Security delivers ES_EVENT_TYPE_NOTIFY_EXEC (and AUTH variant) with full argv, envp, and code-signing info. DTrace proc:::exec-success fires after AMFI accepts the binary.

Related APIs

forkposix_spawnexitwait4issetugid