5 ms·
Check out rwsnoop, included in macOS. It use Dtrace to trace the read/write syscalls. You need to turn off SIP for Dtrace though afaik.
by yehaaa 4y ago
Check out rwsnoop, included in macOS. It use Dtrace to trace the read/write syscalls. You need to turn off SIP for Dtrace though afaik.