ITADN

Consider using LLDB debugger APIs for tracing on MacOS

#52Openjyn514 创建于 2025-11-24
J
jyn514commented
Tracing using LD_PRELOAD on macOS has a bunch of caveats which you document on [your blog](https://neilmitchell.blogspot.com/2020/05/file-tracing.html?m=1). [This project](https://github.com/Mic92/strace-macos) uses [LLDB’s python API](https://github.com/Mic92/strace-macos?tab=readme-ov-file#architecture) to implement strace on macOS, as an alternative. Perhaps FSATrace could do something similar? That would remove really quite a lot of FSATrace’s current limitations. You note in your blog that strace-style tracking has higher overhead than LD_PRELOAD; that surprises me (isn’t interposing a function call also slow? I guess it doesn’t have to save and restore registers in the same way?), but if that’s the case, maybe it makes sense to use strace only for SIP binaries on Mac and statically-linked binaries on either of Mac/Windows? To clear, I am imagining using LLDB APIs on Mac and ptrace() on Linux. I know this is a large architectural change, I don’t mean to demand a lot of work from you. I’m thinking of using FSATrace in one of my own projects, in which case I might have time to help out here and there :)
2 条评论