News, info, and opinion by Mac users, for Mac users.

January 24, 2008

security

Apple messes with DTrace

Posted Jan. 24, ’08, 7:52 AM PT by Derik DeLong
Category | Security

Developers, administrators, and all around geeks like to have insights into their computers and their operation that would make psychologists’ heads spin. DTrace helps with that. It even has a Mac OS X port. Sounds great until you find out that it was modified to ignore processes with a specific flag.

The expensive DTrace invocation clearly caused iTunes to do a lot more work, but DTrace was giving me no output. Which started me thinking… did they? Surely not. They wouldn’t disable DTrace for certain applications.

But that’s exactly what Apple’s done with their DTrace implementation.

The working conclusion is that Apple has done this in an attempt to slow DRM cracking, but no real explanation has been given other than the code comment:

If the thread on which this probe has fired belongs to a process marked P_LNOATTACH then this enabling is not permitted to observe it. Move along, nothing to see here.

Conspiracy theorists are rubbing their hands in glee. Thankfully, Landon Fuller is back yet again with a hack to re-enable DTrace. Hopefully now that it’s been exposed, Apple will have a change of heart about this dubious flag.


2 Comments

fletcher Author Profile Page said:

I find it hard to know why I should care. As I understand it DTrace is a valuable tool for a developer to use on their own products. I'm not particularly concerned if Apple has made it harder for crackers to work through their code.

January 24, 2008 10:12 AM
Adam Leventhal said:

@fletcher: if you read the article, you'll understand why you should care. It doesn't just undermine DTrace for iTunes but for other uses which have nothing to do with examining iTunes or other sensitive applications.

January 24, 2008 1:20 PM

Leave a comment

 



Visit other IDG sites: