*OS Internals::Volume I - User Mode

Table of Contents

About This Book
Darwinism: The Evolution of *OS
- Ancestry : NeXTSTEP
- Genealogy
  - Darwin
  - Build Names & Numbers
- MacOS
- iOS
- TvOS
- WatchOS
- eOS (TouchBar)
- The i-Device simulators
E Pluribus Unum: Architecture of *OS
- Architecture, at a glance
- Interlude: Property lists
- Applications
- Frameworks
- Third Party Libraries
- System Libraries
- Kernel Interface
  - System Calls
  - Mach Traps
  - Machine-Specific Calls
  - Diagnostic Calls
- XNU (at a glance)
- Darwin Technologies (at a glance)
Promenade: A tour of the *OS Filesystems
- Partitioning
- Filesystems
- Disk Images
- Disk Arbitration
- ACLs & Attributes
- Directories

Experience Points: UX and System Services
- Spotlight
- QuickLook
- System Information
  - Darwin: sysctl
  - MacOS: AppleSystemInfo.framework & system_profiler
  - *OS: MobileGestalt
- System Configuration
- DUET
- Printing
- assistantd (Siri)
Automatic for the People: Application Services
- Application Installation
- LaunchServices
- Preferences
- Notifications
- User Notifications
- emond (MacOS)
- Apple Events
Mach-O-nations: The Mach-O File format
- Overture: Fat Binaries
- General Mach-O Concepts
- Mach-O FileTypes
- Header Flags
- Load Commands
In the darkness, bind them: dyld internals
- The role of the dynamic linker
- Program Startup
- dyld initialization
- Linking
- dyld Binding opcodes
- Rebasing
- CoreSymbolication.framework
- Interposing
- The Shared Library Cache
- Programmatic manipulation of Mach-O objects
- Remote inspection of dyld state

Parts of the Process: Threads and the Grand Central Dispatcher
- Processes
- Threads
  - Thread QoS
- Interlude: KEvents and KQueues
- Grand Central Dispatcher
  - Blocks
  - Dispatch Queues
  - Queue Attributes
  - Dispatch Objects
- Dispatch Sources
  - Implementation
  - Continuations
- Dispatching blocks
- Debugging libdispatch
In Memoriam: Process Memory Management
- On the same page
- libmalloc
  - The scalable (default) zone
  - Custom Zones
  - Zone APIs
  - Debugging
- In the Zone
  - Purgeable memory
  - The Nano Zone
- libplatform (os_alloc_once)
- libcache
- Memory Management APIs
  - POSIX/BSD APIs
  - mach vm_map
  - memory tags
- Memory Diagnostic Tools
- MacOS: Swap
- Darwin: Compressed RAM
- Under pressure:
  - MacOS: MemoryStatus
  - *OS: Jetsam
  - Programmatically responding to memory pressure
  - *OS: mmaintenanced

CFRun - RunLoopRun: The Runtime Environments
- CoreFoundation
  - CF* Objects
  - CFRunLoop Internals
- Objective-C
  - A Quick Refresher
  - The Objective-C Runtime
  - Objective-C object internals
  - the inner workings of Objc_msgSend
  - Tracing, and debugging Objective-C
  - Reversing and hooking Objective-C
- Swift
  - Swiftly evolving: Swift 1 through 4
  - objc-bridges
  - Closures
  - Mangling
  - Runtime internals
The Medium is the Message: Mach IPC (the user mode view)
- Ma-xioms
- Scenarios
- Message format
- The Mach Interface Generator
Ex Mach-ina: Mach Primitives
- Ports as object abstractions
- The host
- The host_priv
- The task
  - The task as a remote IPC namespace (port hijacking)
  - The task as a remote vm_map (code injection)
- The thread
- Special ports
- Exception ports
- The processor and processor set
- The clock
- Multi Node

eXPliCation: XPC internals
- Design Rationale
- XPC Domains
- XPC Data Types
- The Undocumented XPC Data Types
- NSXPC* and the bplist16
- GCD Integration
- Behind the scenes
- Tracing XPC
- XPC Subsystems and the xpc_bootstrap_pipe
The Alpha & Omega - Launchd
- mach_init and the days of yore
- Born Again: Launchd's reincarnation in libxpc
- ~~Angels~~ Agents & Daemons
- The many faces of launchd
- The __TEXT.__bs_plist property list
- User Space Reboot
- UserEventAgent and LaunchEvents
- launchctl
Follow Me: Process Tracing and Debugging
- proc_info
- stackshot
- sysdiagnose
- spindump
- MacOS: systemstats
- libtrace and os_log
  - diagnosticd
  - logd
- *OS: aggregated
- MacOS: DTrace
- kdebug & ktrace
- kperf & kpc
- fsevents
- Post Mortem:
  - Core dumps
  - Darwin 15: Corpses
  - Crash Reporting