Highlights
✨ Trace XPC, libdispatch and run loop activity of every process
core-profile-session parse-live can now trace the user space events every process emits, Apple's daemons and apps included, on a stock device: --xpc (messages sent and received, replies, transactions), --dispatch (Mach messages received through libdispatch, queue misuse) and --runloop (CoreFoundation run loop iterations, waits, sources, timers, observers and blocks). Like the other groups they add up, combine with --process, and are filtered by subclass on the device. live now names these events too, instead of printing bare hex ids.
pymobiledevice3 developer dvt core-profile-session parse-live --xpc --process SpringBoard✨ events shows what a trace will capture
core-profile-session events takes the same selection options as parse-live (--bsc, -cf/-sf, -s, -e and every group) and lists exactly the events parse-live prints with them, so you can check a filter before tracing. events TEXT finds an event name by text. It also makes a class filter's real behavior visible: only events pykdebugparser decodes are printed, so events -cf 0x29 is empty, while --xpc selects the same XPC events by id.
pymobiledevice3 developer dvt core-profile-session events -s open
pymobiledevice3 developer dvt core-profile-session events dlsym
pymobiledevice3 developer dvt core-profile-session parse-live -e DBG_DYLD_TIMING_DLSYMThe syscalls subcommand is removed: events lists every group (events --io) and syscall (events -s open) instead.
🐛 --fs and -s open no longer miss protected and SQLite opens
--fs now includes guarded_open_np and guarded_open_dprotected_np, which SQLite uses to open every database, journal and shared memory file, so --fs used to miss all SQLite opens. -s open and -s openat now also match their _dprotected_np variants (opens with a data protection class); tracing two app launches, 103 of 7,723 opens were protected and had been silently dropped. Call names in traces are also blue instead of bold, which dark terminal themes render as bright white (pykdebugparser 1.6.4).
🐛 Live core-profile streams start clean
pykdebugparser < 1.6.2 decoded the stale padding after the trace header as events, so every live core-profile-session stream started with garbage, and an unfiltered live crashed (year must be in 1..9999). pykdebugparser 1.6.4 is now required. A trace stream that ended could also block forever on a further read instead of ending.
📚 kdebug tracing guide
A new Tracing with kdebug guide covers what a trace contains, which events every process emits, how to select them, and what kdebug cannot show. The device-operator agent skill gained a matching "trace what the system is doing" recipe next to its syslog-first troubleshooting.
🐍 Python 3.15.0
Python 3.15 is final, so the chardet 7.6.0 exclusion, needed only against the 3.15 beta ABI, is dropped.
What's Changed
- dad276d core_profile_session: Match the _dprotected_np variants with -s (#2065) (@doronz88)
- 7cf946a skills: Point the tracing recipe at events with parse-live's options (#2065) (@doronz88)
- 08b375e core_profile_session: List what parse-live prints with events (#2065) (@doronz88)
- 11cb0d0 core_profile_session: Print the guarded opens in --fs (#2064) (@doronz88)
- 4e67f7e skills: Add live system tracing to the device-operator recipes (#2064) (@doronz88)
- d8b37d9 core_profile_session: Add --xpc, --dispatch and --runloop, and list every group with events (#2064) (@doronz88)
- 4020134 docs: Add a kdebug tracing guide (#2062) (@doronz88)
- c10208a dvt: Name user space events in core-profile-session live (#2062) (@doronz88)
- 28f0ecc dvt: Describe the core-profile header chunk as padded to 4 KiB (#2061) (@doronz88)
- a95915f ci: 3.15 is no longer a prerelease (#2060) (@doronz88)
- e004fda build: Drop the chardet 7.6.0 exclusion on Python 3.15 (#2060) (@doronz88)
- 7a958fa ci: Time out hung test jobs after 20 minutes (#2063) (@doronz88)
- 1b77541 core_profile_session_tap: Keep KdBufStream ended once the end is read (#2063) (@doronz88)
Full Changelog: v11.38.0...v11.39.0