2023/10/09 2:25 *OS Internals::Volume I - User Mode

*OS Internals::Volume I - User Mode

Table of Contents
0. About This Book

1. Darwinism: The Evolution of *OS

Ancestry : NeXTSTEP

Genealogy
Darwin

Build Names & Numbers

MacOS

iOS

TvOS

WatchOS

eOS (TouchBar)

The i-Device simulators

2. E Pluribus Unum: Architecture of *OS

Architecture, at a glance

Interlude: Property lists

Applications

Frameworks

Third Party Libraries

System Libraries

Kernel Interface
System Calls

Mach Traps

Machine-Specific Calls

Diagnostic Calls

https://newosxbook.com/toc1.html 1/7
2023/10/09 2:25 *OS Internals::Volume I - User Mode

XNU (at a glance)

Darwin Technologies (at a glance)

3. Promenade: A tour of the *OS Filesystems

Partitioning

Filesystems

Disk Images

Disk Arbitration

ACLs & Attributes

Directories

4. Experience Points: UX and System Services

Spotlight

QuickLook

System Information
Darwin: sysctl

MacOS: AppleSystemInfo.framework & system_profiler

*OS: MobileGestalt

System Configuration

DUET

Printing

assistantd (Siri)

5. Automatic for the People: Application Services

Application Installation

LaunchServices

Preferences

Notifications

User Notifications

emond (MacOS)

Apple Events

https://newosxbook.com/toc1.html 2/7
2023/10/09 2:25 *OS Internals::Volume I - User Mode

6. Mach-O-nations: The Mach-O File format

Overture: Fat Binaries

General Mach-O Concepts

Mach-O FileTypes

Header Flags

Load Commands

7. In the darkness, bind them: dyld internals

The role of the dynamic linker

Program Startup

dyld initialization

Linking

dyld Binding opcodes

Rebasing

CoreSymbolication.framework

Interposing

The Shared Library Cache

Programmatic manipulation of Mach-O objects

Remote inspection of dyld state

8. Parts of the Process: Threads and the Grand Central Dispatcher

Processes

Threads
Thread QoS

Interlude: KEvents and KQueues

Grand Central Dispatcher

Blocks

Dispatch Queues

Queue Attributes

Dispatch Objects

Dispatch Sources

https://newosxbook.com/toc1.html 3/7
2023/10/09 2:25 *OS Internals::Volume I - User Mode

Implementation

Continuations

Dispatching blocks

Debugging libdispatch

9. In Memoriam: Process Memory Management

On the same page

libmalloc
The scalable (default) zone

Custom Zones

Zone APIs

Debugging

In the Zone
Purgeable memory

The Nano Zone

libplatform (os_alloc_once)

libcache

Memory Management APIs

POSIX/BSD APIs

mach vm_map

memory tags

Memory Diagnostic Tools

MacOS: Swap

Darwin: Compressed RAM

Under pressure:
MacOS: MemoryStatus

*OS: Jetsam

Programmatically responding to memory pressure

*OS: mmaintenanced

10. CFRun - RunLoopRun: The Runtime Environments

https://newosxbook.com/toc1.html 4/7
2023/10/09 2:25 *OS Internals::Volume I - User Mode

CoreFoundation
CF* Objects

CFRunLoop Internals

Objective-C
A Quick Refresher

The Objective-C Runtime

Objective-C object internals

the inner workings of Objc_msgSend

Tracing, and debugging Objective-C

Reversing and hooking Objective-C

Swift
Swiftly evolving: Swift 1 through 4

objc-bridges

Closures

Mangling

Runtime internals

11. The Medium is the Message: Mach IPC (the user mode view)
Ma-xioms

Scenarios

Message format

The Mach Interface Generator

12. Ex Mach-ina: Mach Primitives

Ports as object abstractions

The host

The host_priv

The task
The task as a remote IPC namespace (port hijacking)

The task as a remote vm_map (code injection)

The thread

Special ports

https://newosxbook.com/toc1.html 5/7
2023/10/09 2:25 *OS Internals::Volume I - User Mode

Exception ports

The processor and processor set

The clock

Multi Node

13. eXPliCation: XPC internals

Design Rationale

XPC Domains

XPC Data Types

The Undocumented XPC Data Types

NSXPC* and the bplist16

GCD Integration

Behind the scenes

Tracing XPC

XPC Subsystems and the xpc_bootstrap_pipe

14. The Alpha & Omega - Launchd

mach_init and the days of yore

Born Again: Launchd's reincarnation in libxpc

Angels Agents & Daemons

The many faces of launchd

The __TEXT.__bs_plist property list

User Space Reboot

UserEventAgent and LaunchEvents

launchctl

15. Follow Me: Process Tracing and Debugging

proc_info

stackshot

sysdiagnose

spindump

MacOS: systemstats

https://newosxbook.com/toc1.html 6/7
2023/10/09 2:25 *OS Internals::Volume I - User Mode

libtrace and os_log

diagnosticd

logd

*OS: aggregated

MacOS: DTrace

kdebug & ktrace

kperf & kpc

fsevents

Post Mortem:
Core dumps

Darwin 15: Corpses

Crash Reporting

https://newosxbook.com/toc1.html 7/7