Tracing Syscalls and Kernel Events (kdebug)¶

Want strace for iOS? pymobiledevice3 developer dvt core-profile-session parse-live prints every syscall of every process with its decoded arguments and paths, plus image loads and process and thread lifecycle, live and on a stock device. Here it watches the Settings app start, from its first open() onward:

$ pymobiledevice3 developer dvt core-profile-session parse-live --fs --process Preferences -c 60
2026-11-05 09:28:55 Studio-MacBook-Pro.local pymobiledevice3.__main__[45074] INFO Trying again over a no-root
userspace tunnel since it is a developer command on an iOS 17+ device (override with PYMOBILEDEVICE3_DEFAULT_F
ALLBACK, or --tunnel/--userspace/--native)
2026-11-05 09:28:56 Studio-MacBook-Pro.local pymobiledevice3.cli.developer.dvt.core_profile_session[45074] INF
O Receiving time information
              Time              |             Process             |   Event
2026-11-05 09:28:57.207760 Preferences(807)                  open("", O_RDONLY), fd: 3
2026-11-05 09:28:57.207803 Preferences(807)                  openat(3, "../../private/preboot/Cryptexes/OS", O
_RDONLY), fd: 4
2026-11-05 09:28:57.207947 Preferences(807)                  fstatat64(4, "System/Library/Caches/com.apple.dyl
d", 0x16b0a9bd0, 0)
2026-11-05 09:28:57.207993 Preferences(807)                  openat(4, "System/Library/Caches/com.apple.dyld",
 O_RDONLY), fd: 6
2026-11-05 09:28:57.213553 Preferences(807)                  stat64("/Applications/Preferences.app/Preferences
", 0x16b0a5ff8)
2026-11-05 09:28:57.213732 Preferences(807)                  open("/Applications/Preferences.app/Preferences",
 O_RDONLY), fd: 3
2026-11-05 09:28:57.214556 Preferences(807)                  open("/Applications/Preferences.app/Preferences",
 O_RDONLY), fd: 3
2026-11-05 09:28:57.240227 Preferences(807)                  getattrlist("/Applications/Preferences.app/Prefer
ences", 0x16b09fcc0, 0x16b09fd04, 1036)
2026-11-05 09:28:57.240263 Preferences(807)                  access("/Applications/Preferences.app", R_OK)
2026-11-05 09:28:57.240280 Preferences(807)                  open("/Applications/Preferences.app", O_RDONLY),
fd: 3
2026-11-05 09:28:57.240313 Preferences(807)                  open("/Applications/Preferences.app/Info.plist",
O_RDONLY), fd: 3
2026-11-05 09:28:57.240629 Preferences(807)                  getattrlist("/Applications/Preferences.app/Prefer
ences", 0x16b09fbf0, 0x16b09fc34, 1036)
2026-11-05 09:28:57.240641 Preferences(807)                  open_nocancel("/Applications/Preferences.app/XPCS
ervices", O_RDONLY | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.240649 Preferences(807)                  getattrlist("/Applications/Preferences.app/Resour
ces", 0x16b09fcb0, 0x16b09fcf4, 1036), errno: ENOENT(2)
2026-11-05 09:28:57.243226 Preferences(807)                  getattrlist("/Applications/Preferences.app/Prefer
ences", 0x16b09fc00, 0x16b09fc44, 1036)
2026-11-05 09:28:57.243255 Preferences(807)                  access("/Applications/Preferences.app", R_OK)
2026-11-05 09:28:57.243268 Preferences(807)                  open("/Applications/Preferences.app", O_RDONLY),
fd: 3
2026-11-05 09:28:57.243296 Preferences(807)                  open("/Applications/Preferences.app/Info.plist",
O_RDONLY), fd: 3
2026-11-05 09:28:57.243484 Preferences(807)                  getattrlist("/Applications/Preferences.app/Prefer
ences", 0x16b09fb30, 0x16b09fb74, 1036)
2026-11-05 09:28:57.243494 Preferences(807)                  open_nocancel("/Applications/Preferences.app/XPCS
ervices", O_RDONLY | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.243500 Preferences(807)                  getattrlist("/Applications/Preferences.app/Resour
ces", 0x16b09fbf0, 0x16b09fc34, 1036), errno: ENOENT(2)
2026-11-05 09:28:57.276082 Preferences(807)                  lstat64("/AppleInternal/Settings/SettingsComponen
tManifest.json"), errno: ENOENT(2)
2026-11-05 09:28:57.276111 Preferences(807)                  getattrlist("/Applications/Preferences.app/Prefer
ences", 0x16b0aa5c0, 0x16b0aa604, 1036)
2026-11-05 09:28:57.276120 Preferences(807)                  access("/Applications/Preferences.app", R_OK)
2026-11-05 09:28:57.276125 Preferences(807)                  open("/Applications/Preferences.app", O_RDONLY),
fd: 3
2026-11-05 09:28:57.276133 Preferences(807)                  open("/Applications/Preferences.app/Info.plist",
O_RDONLY), fd: 3
2026-11-05 09:28:57.276232 Preferences(807)                  getattrlist("/Applications/Preferences.app/Prefer
ences", 0x16b0aa4f0, 0x16b0aa534, 1036)
2026-11-05 09:28:57.276236 Preferences(807)                  open_nocancel("/Applications/Preferences.app/XPCS
ervices", O_RDONLY | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.276238 Preferences(807)                  getattrlist("/Applications/Preferences.app/Resour
ces", 0x16b0aa5b0, 0x16b0aa5f4, 1036), errno: ENOENT(2)
2026-11-05 09:28:57.279282 Preferences(807)                  openat(4294967294, "../private/var/preferences/Lo
gging/com.apple.diagnosticd.filter.plist", O_RDONLY | O_NONBLOCK | O_NOFOLLOW | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.279318 Preferences(807)                  openat(4294967294, "/System/Library/Preferences/L
ogging/Processes/com.apple.Preferences.plist", O_RDONLY | O_NONBLOCK | O_NOFOLLOW | O_CLOEXEC), errno: ENOENT(
2)
2026-11-05 09:28:57.279341 Preferences(807)                  openat(4294967294, "../private/var/preferences/Lo
gging/Processes/com.apple.Preferences.plist", O_RDONLY | O_NONBLOCK | O_NOFOLLOW | O_CLOEXEC), errno: ENOENT(2
)
2026-11-05 09:28:57.279434 Preferences(807)                  openat(4294967294, "../private/var/preferences/Lo
gging/com.apple.diagnosticd.filter.plist", O_RDONLY | O_NONBLOCK | O_NOFOLLOW | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.279488 Preferences(807)                  open("/private/var/containers/Shared/SystemGroup/
systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist", O_RDONLY), fd: 3
2026-11-05 09:28:57.280250 Preferences(807)                  open("/System/Library/CoreServices/SystemVersion.
plist", O_RDONLY), fd: 3
2026-11-05 09:28:57.280325 Preferences(807)                  open_nocancel("/Applications/Preferences.app", O_
RDONLY | O_CLOEXEC), fd: 3
2026-11-05 09:28:57.280402 Preferences(807)                  stat64("/Applications/Preferences.app", 0x16b0a9b
50)
2026-11-05 09:28:57.280411 Preferences(807)                  open_nocancel("/Applications/Preferences.app", O_
RDONLY | O_CLOEXEC), fd: 3
2026-11-05 09:28:57.280476 Preferences(807)                  open("/Applications/Preferences.app/Info.plist",
O_RDONLY | O_NONBLOCK), fd: 3
2026-11-05 09:28:57.280614 Preferences(807)                  stat64("/Applications/Preferences.app/Preferences
", 0x16b0aa1a0)
2026-11-05 09:28:57.280629 Preferences(807)                  open("/Applications/Preferences.app/Preferences",
 O_RDONLY), fd: 3
2026-11-05 09:28:57.280658 Preferences(807)                  open_nocancel("/System/Library/CoreServices/Syste
mVersion.bundle", O_RDONLY | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.280660 Preferences(807)                  stat64("/System/Library/CoreServices/SystemVersio
n.bundle", 0x16b0a9fc0), errno: ENOENT(2)
2026-11-05 09:28:57.280665 Preferences(807)                  open_nocancel("/System/Library/CoreServices/Syste
mVersion.bundle", O_RDONLY | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.280667 Preferences(807)                  stat64("/System/Library/CoreServices/SystemVersio
n.bundle", 0x16b0a9fc0), errno: ENOENT(2)
2026-11-05 09:28:57.280670 Preferences(807)                  open_nocancel("/System/Library/CoreServices/Syste
mVersion.bundle", O_RDONLY | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.280672 Preferences(807)                  stat64("/System/Library/CoreServices/SystemVersio
n.bundle", 0x16b0a9fc0), errno: ENOENT(2)
2026-11-05 09:28:57.280713 Preferences(807)                  open("SystemVersion.plist", O_RDONLY), fd: 3
2026-11-05 09:28:57.280738 Preferences(807)                  open_nocancel("/System/Library/CoreServices/Syste
mVersion.bundle", O_RDONLY | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.280740 Preferences(807)                  stat64("/System/Library/CoreServices/SystemVersio
n.bundle", 0x16b0a9fc0), errno: ENOENT(2)
2026-11-05 09:28:57.280744 Preferences(807)                  open_nocancel("/System/Library/CoreServices/Syste
mVersion.bundle", O_RDONLY | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.280745 Preferences(807)                  stat64("/System/Library/CoreServices/SystemVersio
n.bundle", 0x16b0a9fc0), errno: ENOENT(2)
2026-11-05 09:28:57.280749 Preferences(807)                  open_nocancel("/System/Library/CoreServices/Syste
mVersion.bundle", O_RDONLY | O_CLOEXEC), errno: ENOENT(2)
2026-11-05 09:28:57.280750 Preferences(807)                  stat64("/System/Library/CoreServices/SystemVersio
n.bundle", 0x16b0a9fc0), errno: ENOENT(2)
2026-11-05 09:28:57.282660 Preferences(807)                  lstat64("/Applications")
2026-11-05 09:28:57.282673 Preferences(807)                  lstat64("/Applications/Preferences.app")
2026-11-05 09:28:57.282687 Preferences(807)                  stat64("/Applications/Preferences.app", 0x16b0aa9
80)
2026-11-05 09:28:57.282691 Preferences(807)                  access("/Applications/Preferences.app", R_OK)
2026-11-05 09:28:57.291333 Preferences(807)                  stat64("/usr/lib/libobjc-trampolines.dylib", 0x10
4feaa00), errno: ENOENT(2)
2026-11-05 09:28:57.291404 Preferences(807)                  stat64("/private/preboot/Cryptexes/OS/usr/lib/lib
objc-trampolines.dylib", 0x104feaa00)
Read 67866 events, the kernel dropped events 0 times, 0 events were skipped to catch up

kdebug is the kernel's event tracing facility: the kernel and many system libraries record fixed-size events into it, and a trace session collects them from every process at once. It needs no entitlement, no jailbreak and no change to the traced processes, so it is the main way to watch what platform binaries (daemons, SpringBoard, Apple's apps) do on a stock device.

pymobiledevice3 developer dvt core-profile-session drives the same trace sessions as Instruments. Like every DVT command it needs Developer Mode, plus a mounted DeveloperDiskImage on iOS < 17 (see Developer Mode and DDI); on iOS 17+ the CLI sets up the tunnel by itself. CLI recipes lists more examples; this guide covers what is in a trace and how to get at it.

Commands¶

Command	Prints
`parse-live`	Decoded traces (strace-like): syscalls with their arguments and paths, dyld image loads, process and thread lifecycle. Selects events by group and name (`--fs`, `--xpc`, `-s`, `-e`, ...; see below).
`live`	Every raw event: time, event name, start/end, thread, process and the four raw arguments. Selects events by class and subclass.
`callstacks-live`	User space call stacks sampled from the running threads.
`save`	The raw trace, to parse later.
`stackshot`	The call stacks of every thread of every process, once.

Event ids¶

Every event is a 32-bit debugid:

| class (8) | subclass (8) | code (14) | function (2) |

The class names the component (0x04 BSD, 0x29 XPC, ...), the subclass a part of it, and the function bits mark whether the event starts (1) or ends (2) an interval. The eventid is the debugid without the function bits, and is what trace codes name (0x29000044 is XPC_connection_send_message).

live filters on the device by class (-cf 0x29) and by class and subclass together (-sf 0x0301, the class in the high byte), which also keeps the device from sending what is filtered out:

# XPC and libdispatch events of every process
pymobiledevice3 developer dvt core-profile-session live -cf 0x29 -cf 0x2e

# file lookups only (VFS_LOOKUP lives in class 0x03, subclass 0x01)
pymobiledevice3 developer dvt core-profile-session live -sf 0x0301

Selecting events in parse-live¶

Option	Selects
`--fs`, `--net`, `--proc`, `--io`, `--mem`, `--signal`, `--cred`, `--sync`, `--mach`	A group of syscalls and Mach traps
`--dyld`	dyld image loads and timing (`dlopen`, `dlsym`, ...)
`--xpc`, `--dispatch`, `--runloop`	The XPC, libdispatch and CoreFoundation run loop events of every process, printed as their name and raw arguments
`-s NAME`	One syscall, with its `_nocancel` variant (`-s open`)
`-e NAME`	One event, by its trace code name (`-e DBG_DYLD_TIMING_DLSYM`)

They all add up, and --process narrows the result to one process. The device filters by subclass at best, so the host drops the rest right after decoding. events takes the same options and lists exactly the events parse-live prints with them (events --fs, events -s open), and events dlsym finds a name by text. A class or subclass filter (--bsc, -cf, -sf, --dyld) prints only the events pykdebugparser (the library that decodes the trace) knows: events -cf 0x29 lists nothing, while --xpc selects the same XPC events by id.

# the XPC traffic of SpringBoard
pymobiledevice3 developer dvt core-profile-session parse-live --xpc --process SpringBoard

# every dlsym, in every process
pymobiledevice3 developer dvt core-profile-session events dlsym
pymobiledevice3 developer dvt core-profile-session parse-live -e DBG_DYLD_TIMING_DLSYM

Events every process emits¶

These are recorded by the kernel or by system libraries in every process, gated only by the trace session's class filter. They were all seen in traces of an iPhone on iOS 27.2.

Class	Source	Events	What they show
`0x03`	kernel	`VFS_LOOKUP`	The full path of every file lookup, in every process
`0x04`	kernel	BSD syscalls	Every syscall with its arguments (`parse-live` decodes them)
`0x07`	kernel	thread and process lifecycle	New threads, execs and thread names
`0x1f`	dyld	image map (`DYLD_uuid_map_a/b`) and timing	The UUID and load address of every image of every process, and dyld's launch phases
`0x29`	libxpc	`XPC_*`	Messages sent and received, transactions, the process becoming dirty or clean
`0x2e`	libdispatch	`DISPATCH_MACH_MSG_hdr_move`, `DISPATCH_PERF_*`	Mach messages received through dispatch, queue misuse
`0x21`, `0x14`	CoreFoundation	`CFRL_*`	Run loop iterations, waits, sources, timers, observers and blocks

The XPC events carry a per-connection id and the message size (on the end of a send), not the service name. The run loop events show when a main thread is busy and with what kind of callout, which helps find hangs.

callstacks-live samples user space call stacks of the same processes. It prints them as raw addresses; the dyld image map above tells which image each one falls in.

Events that need a setting¶

Some system libraries emit events only when a setting enables them, on top of the trace's class filter.

Class	Source	Enabled by
`0x33`	libsystem_malloc: every `malloc`, `calloc`, `realloc`, `free` (zone, size, pointer)	The `MallocTracing` environment variable, read when the process starts
`0x2b` (subclasses `0x1d`, `0x13`, `0x29`)	Network.framework, libquic, CFNetwork and BoringSSL: connections, TLS handshakes, QUIC packet protection	networkd's `enable_signposts` setting, which only networkd's privileged clients can set

MallocTracing can be passed to apps, including Apple's own, by launching them through pymobiledevice3:

pymobiledevice3 developer dvt launch --kill-existing --env MallocTracing=1 com.apple.Preferences
pymobiledevice3 developer dvt core-profile-session live -cf 0x33

Launching only works for apps. Daemons and SpringBoard are started by launchd with launchd's environment, so there is no way to pass them MallocTracing on a stock device. CoreDevice can spawn arbitrary executables with an environment, but only on Apple internal builds.

What kdebug does not show¶

Mach message send and receive in the kernel (MACH_IPC_msg_send/_recv): the iOS 27.2 release kernel does not emit them. The XPC and libdispatch events cover most of that traffic from user space.
Message contents, XPC service names and TLS plaintext: no event carries them.