Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

Working on a project to reverse-engineer Mail applications changes to keychain files. Using fs_usage I can see # of bytes written to keychain file, but I am unable to determine dynamically exactly what content is being changed

Thoughts, approaches very much appreciated/

thanks, LightworksGal

share|improve this question
You really should mention your OS on questions like these. From fs_usage, keychain and Mail, I infer Mac OS X, right? – Gilles Dec 10 '10 at 22:27

1 Answer

up vote 1 down vote accepted

ktrace or dtrace will let you see reads and writes to files on OSX (strace is the linux equivalent), among a lot more data you'll need to filter out.

share|improve this answer
Thanks, Sparr! Well answered. – LightworksGal Dec 10 '10 at 7:56
Is there an strace port to OSX? Natively I only know of dtrace. – Gilles Dec 10 '10 at 22:25
@Gilles edited my answer to point to ktrace instead of strace – Sparr Dec 11 '10 at 0:13
There is no ktrace on my OS X 10.6 system. It was replaced by dtrace in 10.5. support.apple.com/kb/TA24816 – mark4o Dec 11 '10 at 0:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.