> How is this instrumentation done? I guess the text segment is modified > in RAM when the pid provider is attached to the process?
Yes, when a probe is enabled a small thunk is dropped in that calls out to the DTrace pieces in the kernel and logs the event. USDT probes work similarly, but insert a no-op in the instruction stream since there’s no function/callsite to thunk on. -Ben _______________________________________________ Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) Please do not post admin requests or moderator comments to the list. Contact the moderators at cocoa-dev-admins(at)lists.apple.com Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com This email sent to arch...@mail-archive.com
