LUlunixbochs·Feb 10, 2016
ktrace doesn't exist anymore on OS X as far as I know. You need to use dtrace, which means you need to write dtrace programs. Python's dtrace interface would probably only let you load a dtrace program.
It might be possible to implement `maybe` as a dtrace program by instrumenting syscall entry and raising a signal or stopping the program immediately, which you can recover in your debugger (though I'm not sure if this actually stops the syscall). That said, I tried it and OS X doesn't seem to allow "destructive" dtrace actions even as root with SIP disabled:
$ sudo dtrace -n 'syscall::open:entry { stop(); }' -c 'cat Makefile'
dtrace: could not enable tracing: Destructive actions not allowed
$ sudo dtrace -n 'syscall::open:entry { raise(9); }' -c 'cat Makefile'
dtrace: could not enable tracing: Destructive actions not allow
Read the rest
ed
Alternately you can use dynamorio, intel pin, qemu, or a quick instruction scan/patch for SYSCALL to manually break on syscalls.
Either way you almost certainly will not be able to do this with python-ptrace alone. I filed an issue to write a `maybe` tool using Usercorn [1] (which supports OS X) with my VFS overlay work, which means writes could still succeed but be non-destructive.
[1] https://github.com/lunixbochs/usercorn/issues/151