Apple Crippled Its DTrace Port

Linnen writes in to note that one of developers of Sun's open source system tracing tool, DTrace, has discovered that Apple crippled its port of the tool so that software like iTunes could not be traced. From Adam Leventhal's blog: "I let it run for a while, made iTunes do some work, and the result when I stopped the script? Nothing. The expensive DTrace invocation clearly caused iTunes to do a lot more work, but DTrace was giving me no output. Which started me thinking... did they? Surely not. They wouldn't disable DTrace for certain applications. But that's exactly what Apple's done with their DTrace implementation. The notion of true systemic tracing was a bit too egalitarian for their classist sensibilities..."

Comments

And as quick as it is reported

[Evets]

As quickly as the issue is reported, a hack comes out to resolve it. Gotta love how quickly the community can respond to these things.

It's worse, they have broken DTrace

[mzs]

Basically profile and tick are useless since they will not fire if a thread with PT_DENY_ATTACH is on proc. Perfectly good DTrace scripts simply will not work correctly on OS X.

Thanks Community, now fix Quicktime 7.4

[voidstin]

It's nice that Dtrace works again. But I'm betting a lot more people use After Effects or Premiere. The QT 7.4 update which enables movie rentals from iTunes breaks any render that takes longer than 10 minutes. Thank god DRM is here to protect me from the work I need to do. Wasn't apple supposed to me the machine for media professionals?

http://blogs.adobe.com/keyframes/2008/01/dont_update_to_quicktime_74.html

Re:The point of the article

[aberkvam]

Doh! "this feature actually does break iTunes" should have been "this feature actually does break DTrace". My bad.

Re:So what?

[SanityInAnarchy]

I've never seen Apple market OSX as a Unix system or even talk about the shell.

You obviously didn't look very hard.

Its main market is for an easy to use home computer and as a creative platform for video editing, graphic design and professional audio.

And software development. Or where did you think the developers of those video editors work and test their code?

If you want a command line you're fully in control of, use Linux or a BSD Unix.

No disagreement there, but it doesn't hurt to remind people that OS X is not that. People often leave Linux for OS X, claiming that it's basically an easier-to-use Linux than Linux, you still have all your stuff, etc. And you can always ssh to a Linux server to do real work.

It's a commercial OS and Apple will do what they like so long as its legal.

Why is this OK?

Re:One question:

[statusbar]

For now, yes... But apple has been in the process of creating cryptographically secure signing and verification of system applications. The next step for them will be to have system tools like this be executed ONLY if they are the unmodified, signed applications that apple originally released.

When that happens, it wouldn't matter if you recompile dtrace - your modified version would just not run.

for info on the current code signing specification from apple (which is pretty much benign for now), see:

• Code Signing

--jeffk++

Wow

[Lally Singh]

Mac haters really are drama queens, aren't they? Here, read this.

Leopard's DTrace isn't broken. Apple put in an API for a program to request that debugging & dtrace be disabled for it. Clearly it's there to keep FairPlay from being broken (too easily). Something that commercial developers could understandably want for their software, to prevent keygen hacks, etc.

The link I provide shows a simple way to get around it. Hell, debugging iTunes is directly encouraged in an Apple Technote (linked in the article).

As listed in the article I linked to, you can get around it by trapping the API call in gdb and disabling it.

Re:Wow

[ahl_at_sun]

Actually, Leopard's DTrace is broken, and that was the point of the blog post. Here's the issue: DTrace programs that would normally work and collect valid data will fail if a process is running with Apple's trace-me-not bit set. Forget tracing iTunes or other applications that don't want to be traced. It's that probes that should fire don't as an unintended side-effect of Apple's hack to obscure certain applications.

A much smarter approach would have been for Apple to deny visibility into such a process, but still allow a user to monitor system-level events (e.g. timers and system calls). This would have allowed for the (questionably motivated, and highly circumventable) protection while not damaging DTrace and correctly phrased queries.

Everyone needs to use this now

[Count Sessine]

The best thing to do now is to make DTrace as useless as possible until Apple removes this limitation.

Every developer reading this who cares about DTrace and wants to be able to use it for system-wide metrics should set the P_LNOATTACH flag in the next point release for their app. Apple won't like it, but if enough developers do it as a form of protest, it would effectively make DTrace/Instruments ineffective, eliminating a bullet-point feature from Leopard.

DTRACE

[ed.markovich]

Maybe everyone knows what dtrace is. I didn't. Then I watched this: link and now I do.

Old is New Again

[HumanEmulator]

Back in 2000, if you installed MacsBug on a Mac you couldn't play DVDs. When you opened the DVD Player you got an error message telling you a debugger was installed. In these pre-memory protection days, MacsBug was the only debugger low-level enough to catch a whole mess of problems. Unfortunately, MacsBug was loaded when the system booted, so the only way to play a DVD was to remove MacsBug and restart your machine.

Long time Mac developer ally Bare Bones Software (they have a great text editor) created a patch that "fixed" this limitation. AFAIK, Apple never said anything about their patch and just quietly let it exist. http://www.macobserver.com/news/00/april/000418/dvdplayerhelper.shtml

This whole message mess came about because Macrovision didn't want people disabling their protection on video-output (there were Macs you could literally plug into VCRs then), and I suspect it was also to guard the CSS "encryption."

When Blu-ray movies finally show up in Macs, this kind of thing is probably going to get a lot worse than patches to D-Trace.

Re:Not equivalent, no double standard

[nguy]

We are more forgiving of people who aren't more chronically evil, life just is that way, get over it.

But Jobs is chronically evil.