mach_msg_trap

Prototype

kern_return_t mach_msg_trap(/* 7 args */);

Returns: kern_return_t

Version history

Examples

mach_msg_header_t *hdr = (mach_msg_header_t *)buf;
hdr->msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND,
                                MACH_MSG_TYPE_MAKE_SEND_ONCE);
hdr->msgh_remote_port = remote;
hdr->msgh_local_port  = mach_reply_port();
hdr->msgh_size = sizeof(*hdr);
hdr->msgh_id   = 1000;

kern_return_t kr = mach_msg(hdr,
    MACH_SEND_MSG | MACH_RCV_MSG,
    hdr->msgh_size, sizeof(buf),
    hdr->msgh_local_port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);

Notes

mach_msg_trap is the original Mach IPC primitive: a single mach_msg_header_t-prefixed buffer is handed to the kernel, which copies it to the destination port's queue and optionally blocks waiting for a reply on a receive right. The MACH_SEND_MSG / MACH_RCV_MSG option bits select send, receive, or the combined send-then-receive RPC pattern used by MIG stubs. On macOS 12+ the libsyscall shim normally routes through mach_msg2_trap, which packs the descriptor metadata into registers; mach_msg_trap remains available for older binaries and direct callers. Almost every userspace-to-userspace and userspace-to-kernel call on macOS — POSIX, BSD shims aside — ultimately bottoms out here.

Detection

Mach IPC is opaque to Endpoint Security — there is no ES event for arbitrary mach_msg traffic. The DTrace mach_trap provider (mach_trap::mach_msg:entry) is the practical observation point, along with kdebug DBG_MACH_IPC traces and the lldb 'log enable lldb mach-ipc' family. Volume is extreme (millions per second on a busy system), so meaningful detection requires filtering on destination port name or message ID.

Related APIs