Strace-macOS: A clone of the strace command for macOS

Summary

A system call tracer for macOS using the LLDB debugger API. Status: Beta - Core functionality works, but some features are still in development. Features Works with SIP enabled - Unlike dtruss , doesn't require disabling System Integrity Protection - Unlike , doesn't require disabling System Integrity Protection Pure Python implementation - No kernel extensions or compiled components - No kernel extensions or compiled components Multiple output formats - JSON Lines and strace-compatible text output - JSON Lines and strace-compatible text output Syscall filtering - Filter by syscall name or category ( -e trace=file , -e trace=network ) - Filter by syscall name or category ( , ) Symbolic decoding - Automatically decodes flags, error codes, and struct fields - Automatically decodes flags, error codes, and struct fields Color output - Syntax highlighting when output is a TTY - Syntax highlighting when output is a TTY Summary statistics - Time/call/error counts with -c Installation With Nix Flakes # Run directly nix run github:Mic92/strace-macos -- ls # Install to profile nix profile install github:Mic92/strace-macos Manual Installation strace-macos requires macOS system Python (has LLDB bindings): # Install directly from GitHub /usr/bin/python3 -m pip install --user git+https://github.com/Mic92/strace-macos # Then run (if ~/Library/Python/3.x/bin is in PATH) strace /usr/local/bin/git status # or any homebrew-installed binary # Or run directly from repository without installing git clone https://github.com/Mic92/strace-macos cd strace-macos /usr/bin/python3 -m strace_macos /usr/local/bin/git status Usage Trace a command # Basic usage (use non-system binaries like homebrew or nix-installed) strace /usr/local/bin/git status # Output to file strace -o trace.txt /usr/local/bin/git status # JSON output strace --json /usr/local/bin/git status > trace.jsonl # Filter syscalls by name strace -e trace=open,close /usr/local/bin/git status # Filter by category* strace -e trace=file ...