Arm64 Syscalls

1

__exit

Exits the current process with a given exit status.

rdi: int (exit status)

2

fork

Creates a new child process by duplicating the calling process.

rdi: pid_t (parent PID), rsi: int (flags)

3

read

Reads data from a file descriptor into a buffer.

rdi: unsigned int (fd), rsi: char* (buffer), rdx: size_t (count)

4

write

Writes data from a buffer to a file descriptor.

rdi: unsigned int (fd), rsi: const char* (buffer), rdx: size_t (count)

5

__open

Opens a file or device and returns a file descriptor.

rdi: const char* (filename), rsi: int (flags), rdx: int (mode)

6

close

Closes an open file descriptor.

rdi: unsigned int (fd)

7

__wait4

Waits for a child process to change state.

rdi: pid_t (child PID), rsi: int* (status), rdx: int (options)

9

_kernelrpc_mach_vm_allocate_trap

Allocates memory in the virtual memory space of a task (kernel trap).

rdi: void* (address), rsi: size_t (size), rdx: int (flags)

9

link

Creates a new hard link to an existing file.

rdi: const char* (existing path), rsi: const char* (link path)

10

__unlink

Deletes a file by removing its directory entry.

rdi: const char* (path)

11

_kernelrpc_mach_vm_deallocate_trap

Deallocates a range of memory in the virtual memory space of a task (kernel trap).

rdi: void* (address), rsi: size_t (size)

12

chdir

Changes the current working directory of the process.

rdi: const char* (path)

13

_kernelrpc_mach_vm_protect_trap

Changes the protection of a range of memory in the virtual memory space (kernel trap).

rdi: void* (address), rsi: size_t (size), rdx: int (protection flags)

13

fchdir

Changes the current working directory of the process using a file descriptor.

rdi: unsigned int (fd)

14

_kernelrpc_mach_vm_map_trap

Maps a region of memory into a task's virtual memory space (kernel trap).

rdi: void* (address), rsi: size_t (size), rdx: int (protection flags), r10: int (flags), r8: int (fd), r9: off_t (offset)

14

mknod

Creates a new file system node (file, device, or named pipe).

rdi: const char* (path), rsi: int (mode), rdx: unsigned dev

15

__chmod

Changes the permissions of a file or directory.

rdi: const char* (path), rsi: mode_t (mode)

15

_kernelrpc_mach_port_allocate_trap

Allocates a new Mach port (kernel trap).

rdi: unsigned int* (port)

16

_kernelrpc_mach_port_destroy_trap

Destroys a Mach port (kernel trap).

rdi: unsigned int (port)

16

chown

Changes the ownership of a file or directory.

rdi: const char* (path), rsi: uid_t (user), rdx: gid_t (group)

17

_kernelrpc_mach_port_deallocate_trap

Deallocates a Mach port (kernel trap).

rdi: unsigned int (port)

18

_kernelrpc_mach_port_mod_refs_trap

Modifies the reference count of a Mach port (kernel trap).

rdi: unsigned int (port), rsi: int (modification)

19

_kernelrpc_mach_port_move_member_trap

Moves a Mach port to a new member (kernel trap).

rdi: unsigned int (port), rsi: unsigned int (new member)

20

_kernelrpc_mach_port_insert_right_trap

Inserts a right to a Mach port (kernel trap).

rdi: unsigned int (port), rsi: int (right)

21

_kernelrpc_mach_port_insert_member_trap

Inserts a member to a Mach port (kernel trap).

rdi: unsigned int (port), rsi: unsigned int (member)

22

_kernelrpc_mach_port_extract_member_trap

Extracts a member from a Mach port (kernel trap).

rdi: unsigned int (port), rsi: unsigned int (member)

23

_kernelrpc_mach_port_construct_trap

Constructs a new Mach port (kernel trap).

rdi: unsigned int* (port)

23

setuid

Sets the user ID (UID) of the calling process.

rdi: uid_t (uid)

24

_kernelrpc_mach_port_destruct_trap

Destructs a Mach port (kernel trap).

rdi: unsigned int (port)

24

getuid

Retrieves the user ID (UID) of the calling process.

rdi: void*

25

geteuid

Retrieves the effective user ID (EUID) of the calling process.

rdi: void*

25

mach_reply_port

Retrieves the reply port for a Mach message.

rdi: void*

26

thread_self_trap

Returns the thread's self-reference (kernel trap).

rdi: void*

27

__recvmsg

Receives a message from a socket.

rdi: int (fd), rsi: void* (message), rdx: size_t (size), r10: int (flags), r8: struct sockaddr* (addr)

27

task_self_trap

Returns the task's self-reference (kernel trap).

rdi: void*

28

__sendmsg

Sends a message over a socket.

rdi: int (fd), rsi: const void* (message), rdx: size_t (size), r10: int (flags), r8: struct sockaddr* (addr)

28

host_self_trap

Retrieves the host's self-reference (kernel trap).

rdi: void*

29

__recvfrom

Receives data from a socket.

rdi: int (fd), rsi: void* (buffer), rdx: size_t (size), r10: struct sockaddr* (addr), r8: socklen_t* (addr_len)

30

__accept

Accepts a connection on a socket.

rdi: int (fd), rsi: struct sockaddr* (addr), rdx: socklen_t* (addr_len)

30

mach_msg_trap

Receives a Mach message (kernel trap).

rdi: void* (message), rsi: size_t (size), rdx: int (flags)

31

__getpeername

Retrieves the peer address for a socket.

rdi: int (fd), rsi: struct sockaddr* (addr), rdx: socklen_t* (addr_len)

31

mach_msg_overwrite_trap

Receives a Mach message with overwrite capability (kernel trap).

rdi: void* (message), rsi: size_t (size), rdx: int (flags)

32

__getsockname

Retrieves the socket address of a socket.

rdi: int (fd), rsi: struct sockaddr* (addr), rdx: socklen_t* (addr_len)

32

semaphore_signal_trap

Signals a semaphore (kernel trap).

rdi: unsigned int (semaphore)

33

access

Checks the accessibility of a file or directory.

rdi: const char* (path), rsi: int (mode)

33

semaphore_signal_all_trap

Signals all semaphores (kernel trap).

rdi: unsigned int (semaphore set)

34

chflags

Changes file flags for a file.

rdi: const char* (path), rsi: int (flags)

34

semaphore_signal_thread_trap

Signals a semaphore for a thread (kernel trap).

rdi: unsigned int (thread semaphore)

35

fchflags

Changes file flags for a file referenced by a file descriptor.

rdi: unsigned int (fd), rsi: int (flags)

35

semaphore_wait_trap

Waits for a semaphore (kernel trap).

rdi: unsigned int (semaphore)

36

semaphore_wait_signal_trap

Waits for a semaphore and signals upon completion (kernel trap).

rdi: unsigned int (semaphore)

36

sync

Synchronizes file system changes with disk.

rdi: void*

37

__kill

Sends a signal to a process or thread.

rdi: pid_t (pid), rsi: int (sig)

37

semaphore_timedwait_trap

Waits for a semaphore with a timeout (kernel trap).

rdi: unsigned int (semaphore), rsi: int (timeout)

38

semaphore_timedwait_signal_trap

Waits for a semaphore and signals upon completion with timeout (kernel trap).

rdi: unsigned int (semaphore), rsi: int (timeout)

39

getppid

Retrieves the parent process ID (PID) of the calling process.

rdi: void*

40

_kernelrpc_mach_port_guard_trap

Guards a Mach port (kernel trap).

rdi: unsigned int (port)

41

_kernelrpc_mach_port_unguard_trap

Unguards a Mach port (kernel trap).

rdi: unsigned int (port)

43

getegid

Retrieves the effective group ID (EGID) of the calling process.

rdi: void*

43

task_name_for_pid

Retrieves the task name for a given PID (kernel trap).

rdi: pid_t (pid)

44

task_for_pid

Retrieves the task for a given PID (kernel trap).

rdi: pid_t (pid)

45

pid_for_task

Retrieves the PID for a given task (kernel trap).

rdi: unsigned int (task)

46

__sigaction

Modifies the signal action for a given signal.

rdi: int (signal), rsi: struct sigaction* (action), rdx: struct sigaction* (old_action)

47

getgid

Retrieves the group ID (GID) of the calling process.

rdi: void*

47

macx_swapon

Enables swapping in macOS (mac-specific syscall).

rdi: const char* (path), rsi: int (flags)

48

macx_swapoff

Disables swapping in macOS (mac-specific syscall).

rdi: const char* (path)

48

sigprocmask

Sets or retrieves the signal mask of the calling process.

rdi: int (how), rsi: sigset_t* (set), rdx: sigset_t* (oset)

49

__getlogin

Retrieves the login name of the calling process.

rdi: void*

50

__setlogin

Sets the login name of the calling process.

rdi: const char* (name)

50

macx_triggers

A macOS-specific syscall for triggering system events.

rdi: int (event), rsi: void* (args)

51

acct

Turns process accounting on or off.

rdi: const char* (filename)

51

macx_backing_store_suspend

Suspends the backing store (macOS-specific).

rdi: void* (memory region)

52

macx_backing_store_recovery

Recovers the backing store (macOS-specific).

rdi: void* (memory region)

52

sigpending

Checks for pending signals in the calling process.

rdi: sigset_t* (set)

53

__sigaltstack

Sets or gets the alternate signal stack for the calling process.

rdi: stack_t* (stack), rsi: stack_t* (old_stack)

54

__ioctl

Performs input/output control operations.

rdi: unsigned int (fd), rsi: unsigned int (cmd), rdx: unsigned long (arg)

55

reboot

Reboots the system.

rdi: int (magic1), rsi: int (magic2), rdx: unsigned int (cmd), r10: void* (arg)

56

revoke

Revokes access to a file descriptor or file.

rdi: const char* (path)

57

symlink

Creates a symbolic link to a file.

rdi: const char* (target), rsi: const char* (link)

58

readlink

Reads the value of a symbolic link.

rdi: const char* (path), rsi: char* (buf), rdx: size_t (bufsiz)

58

swtch_pri

Switches the process with priority (macOS-specific).

rdi: int (priority), rsi: void* (task)

59

execve

Executes a program in the current process space.

rdi: const char* (filename), rsi: const char* const[] (argv), rdx: const char* const[] (envp)

59

swtch

Switches the current thread or process (macOS-specific).

rdi: void* (context)

60

syscall_thread_switch

Switches the current thread (macOS-specific).

rdi: void* (context)

60

umask

Sets the file mode creation mask.

rdi: mode_t (mask)

61

chroot

Changes the root directory for the calling process.

rdi: const char* (path)

61

clock_sleep_trap

Suspends the process for a specific duration (kernel trap).

rdi: unsigned int (time)

65

__msync

Synchronizes a file with disk to ensure all changes are written.

rdi: void* (addr), rsi: size_t (len), rdx: int (flags)

73

__munmap

Unmaps a region of memory previously mapped by mmap().

rdi: void* (addr), rsi: size_t (len)

74

__mprotect

Changes the memory protection of a region of memory.

rdi: void* (addr), rsi: size_t (len), rdx: int (prot)

75

madvise

Provides advice to the kernel about how memory is used by the calling process.

rdi: void* (addr), rsi: size_t (len), rdx: int (advice)

78

mincore

Checks whether pages of a memory region are in memory.

rdi: void* (addr), rsi: size_t (len), rdx: unsigned char* (vec)

79

getgroups

Retrieves the list of group IDs for the calling process.

rdi: size_t (gidsetsize), rsi: gid_t* (grouplist)

80

setgroups

Sets the list of group IDs for the calling process.

rdi: size_t (gidsetsize), rsi: gid_t* (grouplist)

81

getpgrp

Retrieves the process group ID (PGID) of the calling process.

rdi: void*

82

setpgid

Sets the process group ID for the calling process.

rdi: pid_t (pid), rsi: pid_t (pgid)

83

setitimer

Sets a timer to deliver signals after a specified time interval.

rdi: int (which), rsi: struct itimerval* (value), rdx: struct itimerval* (ovalue)

85

swapon

Activates a swap device to allow virtual memory paging.

rdi: const char* (path)

86

getitimer

Retrieves the current value of a timer set by setitimer().

rdi: int (which), rsi: struct itimerval* (value)

88

mach_timebase_info

Retrieves the timebase for mach time (kernel trap).

rdi: struct mach_timebase_info* (timebase_info)

89

getdtablesize

Retrieves the maximum number of file descriptors for the process.

rdi: void*

89

mach_wait_until

Suspends execution until a specified time (kernel trap).

rdi: uint64_t (time)

90

dup2

Duplicates one file descriptor to another, closing the second descriptor.

rdi: unsigned int (oldfd), rsi: unsigned int (newfd)

90

mk_timer_create

Creates a new timer (macOS-specific).

rdi: clockid_t (which_clock), rsi: struct sigevent* (event_spec), rdx: timer_t* (created_timer)

91

mk_timer_destroy

Destroys a timer (macOS-specific).

rdi: timer_t (timer)

92

__fcntl

Performs a file control operation on a file descriptor.

rdi: unsigned int (fd), rsi: unsigned int (cmd), rdx: unsigned long (arg)

92

mk_timer_arm

Arms a timer for execution (macOS-specific).

rdi: timer_t (timer), rsi: struct itimerspec* (new_setting), rdx: struct itimerspec* (old_setting)

93

__select

Waits for one or more file descriptors to become ready for I/O.

rdi: int (nfds), rsi: fd_set* (readfds), rdx: fd_set* (writefds), r10: fd_set* (exceptfds), r8: struct timeval* (timeout)

93

mk_timer_cancel

Cancels a previously set timer (macOS-specific).

rdi: timer_t (timer)

95

fsync

Forces a file descriptor to synchronize with the underlying storage device.

rdi: unsigned int (fd)

96

__setpriority

Sets the scheduling priority for the calling process or thread.

rdi: int (which), rsi: int (who), rdx: int (priority)

97

socket

Creates a new socket for communication between processes.

rdi: int (domain), rsi: int (type), rdx: int (protocol)

98

__connect

Initiates a connection on a socket.

rdi: unsigned int (fd), rsi: struct sockaddr* (addr), rdx: socklen_t (addr_len)

100

getpriority

Retrieves the scheduling priority for a process or thread.

rdi: int (which), rsi: int (who)

104

__bind

Binds a socket to an address.

rdi: unsigned int (fd), rsi: struct sockaddr* (addr), rdx: socklen_t (addr_len)

105

setsockopt

Sets options for a socket, such as timeout or buffer size.

rdi: unsigned int (fd), rsi: int (level), rdx: int (optname), r10: const void* (optval), r8: socklen_t (optlen)

106

__listen

Marks a socket as a passive listening socket.

rdi: unsigned int (fd), rsi: int (backlog)

111

__sigsuspend

Waits for a signal to be delivered to the calling process.

rdi: sigset_t* (set)

117

getrusage

Retrieves resource usage information for the calling process.

rdi: int (who), rsi: struct rusage* (ru)

118

getsockopt

Retrieves options set on a socket.

rdi: unsigned int (fd), rsi: int (level), rdx: int (optname), r10: void* (optval), r8: socklen_t* (optlen)

120

readv

Reads data from multiple buffers into a file descriptor.

rdi: unsigned int (fd), rsi: struct iovec* (vec), rdx: unsigned int (vlen)

121

writev

Writes data from multiple buffers to a file descriptor.

rdi: unsigned int (fd), rsi: struct iovec* (vec), rdx: unsigned int (vlen)

122

__settimeofday

Sets the system time and date.

rdi: struct timeval* (tv), rsi: struct timezone* (tz)

123

fchown

Changes the ownership of a file referred to by a file descriptor.

rdi: unsigned int (fd), rsi: uid_t (user), rdx: gid_t (group)

124

__fchmod

Changes the permissions of a file referred to by a file descriptor.

rdi: unsigned int (fd), rsi: mode_t (mode)

126

__setreuid

Sets the real and effective user IDs.

rdi: uid_t (ruid), rsi: uid_t (euid)

127

__setregid

Sets the real and effective group IDs.

rdi: gid_t (rgid), rsi: gid_t (egid)

128

__rename

Renames a file or directory.

rdi: const char* (oldname), rsi: const char* (newname)

131

flock

Applies or removes an advisory lock on an open file.

rdi: unsigned int (fd), rsi: unsigned int (cmd)

132

mkfifo

Creates a named FIFO (First-In-First-Out) special file.

rdi: const char* (pathname), rsi: mode_t (mode)

133

__sendto

Sends data to a socket or a peer endpoint.

rdi: unsigned int (fd), rsi: void* (buff), rdx: size_t (len), r10: unsigned int (flags), r8: struct sockaddr* (addr), r9: int (addr_len)

134

shutdown

Shuts down one or both directions of communication on a socket.

rdi: unsigned int (fd), rsi: int (how)

135

__socketpair

Creates a pair of connected sockets for inter-process communication.

rdi: int (domain), rsi: int (type), rdx: int (protocol), r10: int* (usockvec)

136

mkdir

Creates a new directory.

rdi: const char* (pathname), rsi: mode_t (mode)

137

__rmdir

Removes an empty directory.

rdi: const char* (pathname)

138

utimes

Changes the access and modification times of a file.

rdi: const char* (path), rsi: struct timeval* (utimes)

139

futimes

Changes the access and modification times of a file referred to by a file descriptor.

rdi: unsigned int (fd), rsi: struct timeval* (utimes)

140

adjtime

Adjusts the system clock by a specified amount.

rdi: struct timeval* (delta), rsi: struct timeval* (olddelta)

142

__gethostuuid

Retrieves a unique identifier for the host.

rdi: void* (uuid)

147

setsid

Creates a new session and sets the process group.

rdi: void*

148

setquota

Sets the disk usage quota for a user or group.

rdi: const char* (path), rsi: int (uid), rdx: struct dqblk* (quota)

149

quota

Retrieves the disk usage quota for a user or group.

rdi: const char* (path), rsi: int (uid), rdx: struct dqblk* (quota)

151

getpgid

Retrieves the process group ID (PGID) of a process.

rdi: pid_t (pid)

152

setprivexec

Sets the privileges for a specific process (macOS-specific).

rdi: pid_t (pid), rsi: unsigned int (privileges)

153

pread

Reads data from a file descriptor at a specified offset.

rdi: unsigned int (fd), rsi: void* (buf), rdx: size_t (count), r10: off_t (pos)

154

pwrite

Writes data to a file descriptor at a specified offset.

rdi: unsigned int (fd), rsi: const void* (buf), rdx: size_t (count), r10: off_t (pos)

155

nfssvc

Makes an NFS (Network File System) call.

rdi: void* (args)

159

unmount

Unmounts a file system.

rdi: const char* (path), rsi: int (flags)

161

getfh

Retrieves the file handle for a file.

rdi: const char* (path), rsi: void* (fh)

165

quotactl

Controls disk quotas.

rdi: const char* (path), rsi: int (cmd), rdx: struct dqblk* (quota), r10: int (uid)

167

mount

Mounts a file system.

rdi: const char* (dir), rsi: const char* (type), rdx: unsigned long (flags), r10: void* (data)

169

csops

Executes a control operation on a process (macOS-specific).

rdi: pid_t (pid), rsi: unsigned int (cmd), rdx: void* (arg)

170

csops_audittoken

Retrieves the audit token for a process (macOS-specific).

rdi: pid_t (pid), rsi: void* (token)

173

waitid

Waits for a specific child process to change state.

rdi: int (which), rsi: pid_t (pid), rdx: siginfo_t* (infop), r10: int (options), r8: struct rusage* (ru)

178

__kdebug_trace_string

Sends a string to the kernel for debugging purposes (macOS-specific).

rdi: const char* (str), rsi: int (len)

179

__kdebug_trace64

Sends a 64-bit trace for debugging purposes (macOS-specific).

rdi: unsigned long (data), rsi: unsigned long (len)

180

__kdebug_trace

Sends a trace for debugging purposes (macOS-specific).

rdi: void* (trace), rsi: size_t (len)

181

setgid

Sets the group ID (GID) of the calling process.

rdi: gid_t (gid)

182

setegid

Sets the effective group ID (EGID) of the calling process.

rdi: gid_t (egid)

183

seteuid

Sets the effective user ID (EUID) of the calling process.

rdi: uid_t (euid)

184

__sigreturn

Returns from a signal handler and restores signal state.

rdi: void* (siginfo)

185

__chud

Provides various debugging and system tracing operations (macOS-specific).

rdi: void* (info)

187

fdatasync

Flushes file data to disk, but not metadata.

rdi: unsigned int (fd)

191

pathconf

Retrieves configurable file system parameters for a given file.

rdi: const char* (path), rsi: int (name)

192

fpathconf

Retrieves configurable file system parameters for a file descriptor.

rdi: unsigned int (fd), rsi: int (name)

194

__getrlimit

Retrieves the resource limits for the calling process.

rdi: unsigned int (resource), rsi: struct rlimit* (rlim)

195

__setrlimit

Sets the resource limits for the calling process.

rdi: unsigned int (resource), rsi: struct rlimit* (rlim)

196

getdirentries

Retrieves the directory entries for a directory.

rdi: unsigned int (fd), rsi: struct linux_dirent* (dirent), rdx: unsigned int (count)

197

__mmap

Maps a file or memory region into the process’s address space.

rdi: unsigned long (addr), rsi: unsigned long (len), rdx: unsigned long (prot), r10: unsigned long (flags), r8: unsigned long (fd), r9: unsigned long (off)

199

__lseek

Moves the file descriptor’s offset pointer.

rdi: unsigned int (fd), rsi: off_t (offset), rdx: unsigned int (whence)

200

truncate

Truncates a file to a specified length.

rdi: const char* (path), rsi: off_t (length)

201

ftruncate

Truncates a file referred to by a file descriptor.

rdi: unsigned int (fd), rsi: off_t (length)

202

__sysctl

Performs a system control operation, such as querying kernel parameters.

rdi: void* (name), rsi: unsigned int (namelen), rdx: void* (old), r10: size_t* (oldlenp), r8: void* (new), r9: size_t (newlen)

203

mlock

Locks a region of memory to prevent it from being swapped out.

rdi: void* (addr), rsi: size_t (len)

204

munlock

Unlocks a previously locked memory region.

rdi: void* (addr), rsi: size_t (len)

205

undelete

Restores a deleted file (macOS-specific).

rdi: const char* (path)

216

__open_dprotected_np

Opens a file with additional protections (macOS-specific).

rdi: const char* (path), rsi: int (flags), rdx: mode_t (mode)

220

__getattrlist

Retrieves the attributes of a file or directory (macOS-specific).

rdi: const char* (path), rsi: struct attrlist* (attrlist), rdx: unsigned int* (size)

221

__setattrlist

Sets the attributes of a file or directory (macOS-specific).

rdi: const char* (path), rsi: struct attrlist* (attrlist), rdx: unsigned int* (size)

222

getdirentriesattr

Retrieves directory entries along with extended attributes (macOS-specific).

rdi: unsigned int (fd), rsi: struct linux_direntattr* (dirent), rdx: unsigned int (count)

223

exchangedata

Exchanges data between two files (macOS-specific).

rdi: const char* (path1), rsi: const char* (path2)

225

searchfs

Searches the file system for files (macOS-specific).

rdi: const char* (dir), rsi: const char* (pattern), rdx: unsigned int (flags), r10: void* (result)

226

__delete

Deletes a file or directory (macOS-specific).

rdi: const char* (path)

227

__copyfile

Copies a file (macOS-specific).

rdi: const char* (src), rsi: const char* (dst)

228

fgetattrlist

Retrieves file attributes for a file descriptor (macOS-specific).

rdi: unsigned int (fd), rsi: struct attrlist* (attrlist), rdx: unsigned int* (size)

229

fsetattrlist

Sets file attributes for a file descriptor (macOS-specific).

rdi: unsigned int (fd), rsi: struct attrlist* (attrlist), rdx: unsigned int* (size)

230

poll

Waits for events on file descriptors (similar to select).

rdi: struct pollfd* (ufds), rsi: unsigned int (nfds), rdx: int (timeout)

231

watchevent

Watches for specific file system events (macOS-specific).

rdi: unsigned int (flags), rsi: const char* (path), rdx: void* (event)

232

waitevent

Waits for specific events (macOS-specific).

rdi: unsigned int (event)

233

modwatch

Modifies the file system watch settings (macOS-specific).

rdi: unsigned int (flags), rsi: const char* (path)

234

getxattr

Retrieves extended attributes of a file or directory.

rdi: const char* (path), rsi: const char* (name), rdx: void* (value), r10: size_t (size)

235

fgetxattr

Retrieves extended attributes of a file referred to by a file descriptor.

rdi: unsigned int (fd), rsi: const char* (name), rdx: void* (value), r10: size_t (size)

236

setxattr

Sets extended attributes for a file or directory.

rdi: const char* (path), rsi: const char* (name), rdx: const void* (value), r10: size_t (size), r8: int (flags)

237

fsetxattr

Sets extended attributes for a file referred to by a file descriptor.

rdi: unsigned int (fd), rsi: const char* (name), rdx: const void* (value), r10: size_t (size), r8: int (flags)

238

removexattr

Removes extended attributes from a file or directory.

rdi: const char* (path), rsi: const char* (name)

239

fremovexattr

Removes extended attributes from a file referred to by a file descriptor.

rdi: unsigned int (fd), rsi: const char* (name)

240

listxattr

Lists the extended attributes of a file or directory.

rdi: const char* (path), rsi: char* (list), rdx: size_t (size)

241

flistxattr

Lists the extended attributes of a file referred to by a file descriptor.

rdi: unsigned int (fd), rsi: char* (list), rdx: size_t (size)

242

fsctl

Performs file system control operations (macOS-specific).

rdi: unsigned int (cmd), rsi: const char* (path), rdx: void* (data)

243

__initgroups

Initializes the groups for a process (macOS-specific).

rdi: int (gidsetsize), rsi: gid_t* (grouplist)

244

__posix_spawn

Spawns a new process (POSIX-compatible).

rdi: const char* (filename), rsi: const char* const* (argv), rdx: const char* const* (envp), r10: unsigned int (flags), r8: struct posix_spawnattr* (attr), r9: struct posix_spawnfile_actions* (actions)

245

ffsctl

Performs file system specific control operations (macOS-specific).

rdi: unsigned int (cmd), rsi: const char* (path), rdx: void* (data)

247

nfsclnt

Makes an NFS (Network File System) client call.

rdi: void* (args)

248

fhopen

Opens a file using a file handle (macOS-specific).

rdi: void* (fh), rsi: int (flags)

250

minherit

Sets the memory inheritance attributes for a process (macOS-specific).

rdi: void* (addr), rsi: size_t (len), rdx: int (inherit)

251

__semsys

Performs semaphore system operations (macOS-specific).

rdi: unsigned int (cmd), rsi: void* (arg)

252

__msgsys

Performs message system operations (macOS-specific).

rdi: unsigned int (cmd), rsi: void* (arg)

253

__shmsys

Performs shared memory system operations (macOS-specific).

rdi: unsigned int (cmd), rsi: void* (arg)

254

__semctl

Performs semaphore control operations (macOS-specific).

rdi: int (semid), rsi: int (semnum), rdx: int (cmd), r10: union semun (arg)

255

semget

Creates a new semaphore set.

rdi: key_t (key), rsi: int (nsems), rdx: int (semflg)

256

semop

Performs semaphore operations (wait/signal) on a semaphore set.

rdi: int (semid), rsi: struct sembuf* (sops), rdx: unsigned int (nsops)

258

__msgctl

Performs message control operations (macOS-specific).

rdi: int (msqid), rsi: int (cmd), rdx: void* (buf)

259

msgget

Creates or opens a message queue.

rdi: key_t (key), rsi: int (msgflg)

260

msgsnd

Sends a message to a message queue.

rdi: int (msqid), rsi: const void* (msgp), rdx: size_t (msgsz), r10: int (msgflg)

261

msgrcv

Receives a message from a message queue.

rdi: int (msqid), rsi: void* (msgp), rdx: size_t (msgsz), r10: int (msgflg), r8: long* (msgtyp)

262

shmat

Attaches a shared memory segment to the process's address space.

rdi: int (shmid), rsi: void* (shmaddr), rdx: int (shmflg)

263

__shmctl

Performs control operations on a shared memory segment (macOS-specific).

rdi: int (shmid), rsi: int (cmd), rdx: void* (buf)

264

shmdt

Detaches a shared memory segment from the process's address space.

rdi: void* (shmaddr)

265

shmget

Creates a shared memory segment or accesses an existing one.

rdi: key_t (key), rsi: size_t (size), rdx: int (shmflg)

266

__shm_open

Opens a shared memory object (macOS-specific).

rdi: const char* (name), rsi: int (oflags), rdx: mode_t (mode)

267

shm_unlink

Unlinks (removes) a shared memory object (macOS-specific).

rdi: const char* (name)

268

__sem_open

Opens a named semaphore (macOS-specific).

rdi: const char* (name), rsi: int (oflags), rdx: mode_t (mode), r10: unsigned int (value)

269

sem_close

Closes a semaphore (opened by sem_open).

rdi: sem_t* (sem)

270

sem_unlink

Unlinks a semaphore (removes it from the system).

rdi: const char* (name)

271

sem_wait

Waits for a semaphore to become available.

rdi: sem_t* (sem)

272

sem_trywait

Attempts to wait for a semaphore without blocking.

rdi: sem_t* (sem)

273

sem_post

Signals a semaphore, waking up any waiting threads.

rdi: sem_t* (sem)

274

__sysctlbyname

Retrieves or sets a system parameter by its name (macOS-specific).

rdi: const char* (name), rsi: void* (old), rdx: size_t* (oldlenp), r10: void* (new), r8: size_t (newlen)

277

__open_extended

Opens a file with extended protections (macOS-specific).

rdi: const char* (path), rsi: int (flags), rdx: mode_t (mode)

278

__umask_extended

Sets the file creation mask with extended permissions (macOS-specific).

rdi: mode_t (mask)

279

__stat_extended

Retrieves extended file information (macOS-specific).

rdi: const char* (path), rsi: struct stat_extended* (buf)

280

__lstat_extended

Retrieves extended information for a symbolic link (macOS-specific).

rdi: const char* (path), rsi: struct stat_extended* (buf)

281

__fstat_extended

Retrieves extended file status (macOS-specific).

rdi: unsigned int (fd), rsi: struct stat_extended* (buf)

282

__chmod_extended

Changes file permissions with extended attributes (macOS-specific).

rdi: const char* (path), rsi: mode_t (mode)

283

__fchmod_extended

Changes file permissions for a file descriptor with extended attributes (macOS-specific).

rdi: unsigned int (fd), rsi: mode_t (mode)

284

__access_extended

Checks file access permissions with extended attributes (macOS-specific).

rdi: const char* (path), rsi: int (mode)

285

__settid

Sets the thread ID (macOS-specific).

rdi: pid_t (tid)

286

__gettid

Retrieves the thread ID (macOS-specific).

rdi: pid_t* (tid)

287

__setsgroups

Sets supplementary groups for a process (macOS-specific).

rdi: int (gidsetsize), rsi: gid_t* (grouplist)

288

__getsgroups

Retrieves supplementary groups for a process (macOS-specific).

rdi: int (gidsetsize), rsi: gid_t* (grouplist)

289

__setwgroups

Sets the groups for a process (macOS-specific).

rdi: int (gidsetsize), rsi: gid_t* (grouplist)

290

__getwgroups

Retrieves the "wide" groups for a process (macOS-specific).

rdi: int (gidsetsize), rsi: gid_t* (grouplist)

291

__mkfifo_extended

Creates a FIFO (named pipe) with extended attributes (macOS-specific).

rdi: const char* (path), rsi: mode_t (mode)

292

__mkdir_extended

Creates a directory with extended attributes (macOS-specific).

rdi: const char* (path), rsi: mode_t (mode)

293

__identitysvc

Provides identity services (macOS-specific).

rdi: unsigned int (flags), rsi: const void* (input), rdx: void* (output)

294

__shared_region_check_np

Checks the shared region of memory (macOS-specific).

rdi: void* (address), rsi: size_t (size)

296

vm_pressure_monitor

Monitors memory pressure in the virtual machine (macOS-specific).

rdi: void* (args)

297

__psynch_rw_longrdlock

Acquires a long read lock on a resource (macOS-specific).

rdi: void* (resource), rsi: unsigned int (flags)

298

__psynch_rw_yieldwrlock

Yields a write lock on a resource (macOS-specific).

rdi: void* (resource), rsi: unsigned int (flags)

299

__psynch_rw_downgrade

Downgrades a read-write lock to a read lock (macOS-specific).

rdi: void* (resource), rsi: unsigned int (flags)

300

__psynch_rw_upgrade

Upgrades a read lock to a read-write lock (macOS-specific).

rdi: void* (resource), rsi: unsigned int (flags)

301

__psynch_mutexwait

Waits for a mutex (macOS-specific).

rdi: void* (mutex)

302

__psynch_mutexdrop

Drops a mutex (macOS-specific).

rdi: void* (mutex)

303

__psynch_cvbroad

Broadcasts a condition variable (macOS-specific).

rdi: void* (condvar)

304

__psynch_cvsignal

Signals a condition variable (macOS-specific).

rdi: void* (condvar)

305

__psynch_cvwait

Waits for a condition variable (macOS-specific).

rdi: void* (condvar)

306

__psynch_rw_rdlock

Acquires a read lock on a resource (macOS-specific).

rdi: void* (resource)

307

__psynch_rw_wrlock

Acquires a write lock on a resource (macOS-specific).

rdi: void* (resource)

308

__psynch_rw_unlock

Unlocks a read-write lock on a resource (macOS-specific).

rdi: void* (resource)

309

__psynch_rw_unlock2

Unlocks a read-write lock on a resource (macOS-specific).

rdi: void* (resource)

310

getsid

Retrieves the session ID for the calling process.

rdi: pid_t* (sid)

311

__settid_with_pid

Sets the thread ID with a given PID (macOS-specific).

rdi: pid_t (tid), rsi: pid_t (pid)

312

__psynch_cvclrprepost

Clears a condition variable's pre-post state (macOS-specific).

rdi: void* (condvar)

313

aio_fsync

Performs an asynchronous file synchronization.

rdi: int (fd), rsi: int (flags)

314

aio_return

Retrieves the result of an asynchronous I/O operation.

rdi: struct io_event* (events)

315

aio_suspend

Suspends the calling thread until one or more asynchronous I/O operations complete.

rdi: struct io_event* (events), rsi: size_t (nr)

316

aio_cancel

Cancels an ongoing asynchronous I/O operation.

rdi: struct io_event* (events)

317

aio_error

Returns the error status for an asynchronous I/O operation.

rdi: struct io_event* (events)

318

aio_read

Performs an asynchronous read operation.

rdi: struct iocb* (iocb), rsi: struct io_event* (event)

319

aio_write

Performs an asynchronous write operation.

rdi: struct iocb* (iocb), rsi: struct io_event* (event)

320

lio_listio

Initiates a list of asynchronous I/O operations.

rdi: int (nr), rsi: struct iocb** (iocbpp), rdx: struct io_event* (event)

322

__iopolicysys

Performs a system operation related to I/O policies (macOS-specific).

rdi: int (op), rsi: void* (data), rdx: size_t (size)

323

__process_policy

Manages process policies (macOS-specific).

rdi: int (op), rsi: void* (data), rdx: size_t (size)

324

mlockall

Locks all pages in the process’s memory into RAM.

rdi: int (flags)

325

munlockall

Unlocks all pages previously locked into RAM.

327

issetugid

Checks if the calling process is in a user group (macOS-specific).

328

__pthread_kill

Sends a signal to a specific thread (macOS-specific).

rdi: pthread_t (thread), rsi: int (sig)

329

__pthread_sigmask

Blocks or unblocks signals for a specific thread (macOS-specific).

rdi: int (how), rsi: sigset_t* (set)

330

__sigwait

Waits for a signal to be delivered to the calling process (macOS-specific).

rdi: sigset_t* (set)

331

__disable_threadsignal

Disables thread signals (macOS-specific).

332

__pthread_markcancel

Marks a thread as canceled (macOS-specific).

333

__pthread_canceled

Checks if a thread was canceled (macOS-specific).

334

__semwait_signal

Waits for a semaphore to signal (macOS-specific).

rdi: sem_t* (sem)

336

__proc_info

Retrieves information about a process (macOS-specific).

rdi: pid_t (pid), rsi: void* (buf)

337

sendfile

Sends a file over a socket or to another process.

rdi: int (out_fd), rsi: int (in_fd), rdx: off_t* (offset), r10: size_t (count)

338

stat

Retrieves file status information (e.g., size, timestamps).

rdi: const char* (path), rsi: struct stat* (buf)

339

fstat

Retrieves status information for a file referred to by a file descriptor.

rdi: int (fd), rsi: struct stat* (buf)

340

lstat

Retrieves file status information for a symbolic link.

rdi: const char* (path), rsi: struct stat* (buf)

341

__stat64_extended

Retrieves extended file status information (macOS-specific).

rdi: const char* (path), rsi: struct stat64_extended* (buf)

342

__lstat64_extended

Retrieves extended information for a symbolic link (macOS-specific).

rdi: const char* (path), rsi: struct stat64_extended* (buf)

343

__fstat64_extended

Retrieves extended file status (macOS-specific).

rdi: int (fd), rsi: struct stat64_extended* (buf)

344

__getdirentries64

Retrieves the directory entries for a directory in a 64-bit environment.

rdi: int (fd), rsi: struct linux_dirent64* (dirent), rdx: unsigned int (count)

345

statfs

Retrieves file system statistics (e.g., space available, file count).

rdi: const char* (path), rsi: struct statfs* (buf)

346

fstatfs

Retrieves file system statistics for a file descriptor.

rdi: int (fd), rsi: struct statfs* (buf)

347

getfsstat

Retrieves the file system status for all mounted file systems.

rdi: struct statfs* (buf), rsi: unsigned int* (count)

348

__pthread_chdir

Changes the directory in a thread (macOS-specific).

rdi: const char* (path)

349

__pthread_fchdir

Changes the directory using a file descriptor in a thread (macOS-specific).

rdi: int (fd)

350

audit

Begins an audit session for a process.

rdi: int (mask)

351

auditon

Configures audit session settings.

rdi: int (cmd), rsi: void* (data)

353

getauid

Retrieves the audit user ID for the current session.

rdi: void* (uid)

354

setauid

Sets the audit user ID for the current session.

rdi: void* (uid)

357

getaudit_addr

Retrieves the address for the current audit session.

rdi: void* (address)

358

setaudit_addr

Sets the address for the current audit session.

rdi: void* (address)

359

auditctl

Controls audit settings, such as enabling or disabling auditing.

rdi: int (cmd), rsi: void* (data)

360

__bsdthread_create

Creates a new BSD thread (macOS-specific).

rdi: pthread_attr_t* (attr), rsi: void* (start_routine), rdx: void* (arg)

361

__bsdthread_terminate

Terminates a BSD thread (macOS-specific).

rdi: pthread_t (thread)

362

kqueue

Creates a new event queue for monitoring events in the system.

rdi: int (flags)

363

kevent

Waits for and returns events from an event queue.

rdi: int (kq), rsi: struct kevent* (kev), rdx: int (nevents), r10: struct timespec* (timeout)

364

__lchown

Changes the ownership of a file or directory by path (macOS-specific).

rdi: const char* (path), rsi: uid_t (user), rdx: gid_t (group)

365

__stack_snapshot

Creates a snapshot of the process's stack for debugging (macOS-specific).

rdi: void* (stack), rsi: size_t (size)

366

__bsdthread_register

Registers a BSD thread (macOS-specific).

rdi: pthread_t (thread)

367

__workq_open

Opens a work queue (macOS-specific).

rdi: int (flags)

368

__workq_kernreturn

Performs a work queue operation at the kernel level (macOS-specific).

rdi: void* (arg), rsi: size_t (size)

369

kevent64

Creates a 64-bit event queue and handles larger event sets (macOS-specific).

rdi: int (kq), rsi: struct kevent64* (kev), rdx: int (nevents), r10: struct timespec* (timeout)

370

__old_semwait_signal

Waits for a semaphore signal using an old syscall interface (macOS-specific).

rdi: sem_t* (sem)

371

____old_semwait_signal_nocancel

Non-cancelable version of semwait_signal (macOS-specific).

rdi: sem_t* (sem)

372

__thread_selfid

Retrieves the unique thread ID (macOS-specific).

rdi: pthread_t* (thread)

373

ledger

Manages a ledger, used for tracking resource usage (macOS-specific).

rdi: int (action), rsi: void* (data)

374

kevent_qos

Handles events with Quality of Service (QoS) in macOS (macOS-specific).

rdi: int (kq), rsi: struct kevent* (kev), rdx: int (nevents), r10: struct timespec* (timeout)

380

__mac_execve

Executes a program with macOS security checks (macOS-specific).

rdi: const char* (filename), rsi: const char** (argv), rdx: const char** (envp)

381

__mac_syscall

A system call wrapper for macOS security policies (macOS-specific).

rdi: int (cmd), rsi: void* (arg1), rdx: void* (arg2), r10: void* (arg3)

382

__mac_get_file

Retrieves macOS security information for a file (macOS-specific).

rdi: const char* (path), rsi: void* (buf)

383

__mac_set_file

Sets macOS security information for a file (macOS-specific).

rdi: const char* (path), rsi: void* (buf)

384

__mac_get_link

Retrieves macOS security information for a symbolic link (macOS-specific).

rdi: const char* (path), rsi: void* (buf)

385

__mac_set_link

Sets macOS security information for a symbolic link (macOS-specific).

rdi: const char* (path), rsi: void* (buf)

386

__mac_get_proc

Retrieves macOS security information for a process (macOS-specific).

rdi: pid_t (pid), rsi: void* (buf)

387

__mac_set_proc

Sets macOS security information for a process (macOS-specific).

rdi: pid_t (pid), rsi: void* (buf)

388

__mac_get_fd

Retrieves macOS security information for a file descriptor (macOS-specific).

rdi: int (fd), rsi: void* (buf)

389

__mac_set_fd

Sets macOS security information for a file descriptor (macOS-specific).

rdi: int (fd), rsi: void* (buf)

390

__mac_get_pid

Retrieves macOS security information for a process by PID (macOS-specific).

rdi: pid_t (pid), rsi: void* (buf)

396

__read_nocancel

Reads data from a file descriptor, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: void* (buf), rdx: size_t (count)

397

__write_nocancel

Writes data to a file descriptor, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: const void* (buf), rdx: size_t (count)

398

__open_nocancel

Opens a file descriptor, non-cancelable version (macOS-specific).

rdi: const char* (pathname), rsi: int (flags), rdx: mode_t (mode)

399

__close_nocancel

Closes a file descriptor, non-cancelable version (macOS-specific).

rdi: int (fd)

400

__wait4_nocancel

Waits for a child process, non-cancelable version (macOS-specific).

rdi: pid_t (pid), rsi: int* (status), rdx: int (options)

401

__recvmsg_nocancel

Receives a message from a socket, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: struct msghdr* (msg), rdx: int (flags)

402

__sendmsg_nocancel

Sends a message over a socket, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: struct msghdr* (msg), rdx: int (flags)

403

__recvfrom_nocancel

Receives data from a socket, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: void* (buf), rdx: size_t (len), r10: int (flags), r8: struct sockaddr* (addr), r9: int* (addr_len)

404

__accept_nocancel

Accepts a connection on a socket, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: struct sockaddr* (addr), rdx: int* (addr_len)

405

__msync_nocancel

Synchronizes file data to disk, non-cancelable version (macOS-specific).

rdi: void* (addr), rsi: size_t (len), rdx: int (flags)

406

__fcntl_nocancel

Performs a file control operation, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: int (cmd), rdx: unsigned long (arg)

407

__select_nocancel

Waits for file descriptors to be ready for I/O, non-cancelable version (macOS-specific).

rdi: int (nfds), rsi: fd_set* (readfds), rdx: fd_set* (writefds), r10: fd_set* (exceptfds), r8: struct timeval* (timeout)

408

__fsync_nocancel

Forces file data to synchronize to disk, non-cancelable version (macOS-specific).

rdi: int (fd)

409

__connect_nocancel

Initiates a socket connection, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: struct sockaddr* (addr), rdx: socklen_t (addr_len)

410

__sigsuspend_nocancel

Waits for a signal to be delivered, non-cancelable version (macOS-specific).

rdi: const sigset_t* (mask)

411

__readv_nocancel

Reads data from multiple buffers, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: const struct iovec* (iov), rdx: int (iovcnt)

412

__writev_nocancel

Writes data from multiple buffers, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: const struct iovec* (iov), rdx: int (iovcnt)

413

__sendto_nocancel

Sends data to a socket, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: const void* (buf), rdx: size_t (len), r10: unsigned int (flags), r8: struct sockaddr* (addr), r9: int (addr_len)

414

__pread_nocancel

Reads data from a file at a specified offset, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: void* (buf), rdx: size_t (len), r10: off_t (offset)

415

__pwrite_nocancel

Writes data to a file at a specified offset, non-cancelable version (macOS-specific).

rdi: int (fd), rsi: const void* (buf), rdx: size_t (len), r10: off_t (offset)

416

__waitid_nocancel

Waits for a child process to change state, non-cancelable version (macOS-specific).

rdi: int (which), rsi: pid_t (pid), rdx: siginfo_t* (infop), r10: int (options), r8: struct rusage* (ru)

417

__poll_nocancel

Waits for events on file descriptors, non-cancelable version (macOS-specific).

rdi: struct pollfd* (fds), rsi: nfds_t (nfds), rdx: int (timeout)

418

__msgsnd_nocancel

Sends a message to a message queue, non-cancelable version (macOS-specific).

rdi: int (msqid), rsi: const void* (msg), rdx: size_t (msgsz), r10: int (msgflg)

419

__msgrcv_nocancel

Receives a message from a message queue, non-cancelable version (macOS-specific).

rdi: int (msqid), rsi: void* (msg), rdx: size_t (msgsz), r10: long (msgtyp), r8: int (msgflg)

420

__sem_wait_nocancel

Waits for a semaphore, non-cancelable version (macOS-specific).

rdi: sem_t* (sem)

421

__aio_suspend_nocancel

Suspends asynchronous I/O operations, non-cancelable version (macOS-specific).

rdi: struct aio_context* (ctx), rsi: long (min_nr), rdx: long (nr), r10: struct io_event* (events)

422

____sigwait_nocancel

Waits for a signal to be delivered, non-cancelable version (macOS-specific).

rdi: const sigset_t* (set)

423

__semwait_signal_nocancel

Waits for a semaphore to signal, non-cancelable version (macOS-specific).

rdi: sem_t* (sem)

424

__mac_mount

Performs a mount operation with macOS-specific security checks.

rdi: const char* (dev_name), rsi: const char* (dir_name), rdx: const char* (type), r10: unsigned long (flags), r8: void* (data)

425

__mac_get_mount

Retrieves macOS-specific mount information.

rdi: const char* (dir_name), rsi: void* (buf), rdx: size_t* (size)

426

__mac_getfsstat

Retrieves macOS-specific file system status.

rdi: void* (buf), rsi: size_t* (bufsize)

427

__fsgetpath

Retrieves the file system path for a file (macOS-specific).

rdi: int (fd), rsi: void* (buf), rdx: size_t (len)

428

audit_session_self

Retrieves information about the current audit session (macOS-specific).

rdi: void* (buf), rsi: size_t (len)

429

audit_session_join

Joins an existing audit session (macOS-specific).

rdi: void* (buf), rsi: size_t (len)

430

fileport_makeport

Creates a file port for inter-process communication (macOS-specific).

rdi: void* (port), rsi: int (type)

431

fileport_makefd

Creates a file port from a file descriptor (macOS-specific).

rdi: int (fd), rsi: void* (port)

432

audit_session_port

Retrieves the port for an audit session (macOS-specific).

rdi: void* (port)

433

pid_suspend

Suspends the execution of a process (macOS-specific).

rdi: pid_t (pid), rsi: int (flags)

434

pid_resume

Resumes the execution of a suspended process (macOS-specific).

rdi: pid_t (pid)

435

pid_hibernate

Puts a process into hibernation mode (macOS-specific).

rdi: pid_t (pid)

436

pid_shutdown_sockets

Shuts down sockets in a process (macOS-specific).

rdi: pid_t (pid)

438

__shared_region_map_and_slide_np

Maps and slides a shared region in memory (macOS-specific).

rdi: void* (addr), rsi: size_t (size), rdx: int (prot), r10: int (flags)

439

kas_info

Retrieves information about the kernel address space (macOS-specific).

rdi: void* (info)

440

memorystatus_control

Controls memory status settings for processes (macOS-specific).

rdi: int (action), rsi: int (pid), rdx: void* (args)

441

__guarded_open_np

Opens a file with guarded access (macOS-specific).

rdi: const char* (path), rsi: int (flags), rdx: mode_t (mode)

442

guarded_close_np

Closes a file with guarded access (macOS-specific).

rdi: int (fd)

443

guarded_kqueue_np

Performs a kqueue operation with guarded access (macOS-specific).

rdi: int (fd), rsi: struct kevent* (ev), rdx: int (nchanges)

444

change_fdguard_np

Changes the file descriptor guard (macOS-specific).

rdi: int (fd), rsi: int (flags)

446

proc_rlimit_control

Controls process resource limits (macOS-specific).

rdi: pid_t (pid), rsi: int (resource), rdx: struct rlimit* (rlim)

447

connectx

Establishes a connection over a socket using extended parameters (macOS-specific).

rdi: int (fd), rsi: struct sockaddr* (addr), rdx: socklen_t (addr_len), r10: unsigned int (flags)

448

disconnectx

Disconnects from a socket using extended parameters (macOS-specific).

rdi: int (fd), rsi: unsigned int (flags)

449

peeloff

Peels off a socket from a specific connection (macOS-specific).

rdi: int (fd), rsi: int (flags)

450

socket_delegate

Delegates a socket for system-wide use (macOS-specific).

rdi: int (fd), rsi: unsigned int (flags)

451

__telemetry

Performs telemetry-related operations (macOS-specific).

rdi: int (event_id), rsi: void* (data), rdx: size_t (data_size)

452

proc_uuid_policy

Manages process UUID policies (macOS-specific).

rdi: uuid_t* (uuid), rsi: int (policy_type), rdx: void* (args)

453

memorystatus_get_level

Retrieves the memory status level for a process (macOS-specific).

rdi: pid_t (pid), rsi: int* (status_level)

454

system_override

Overrides system settings (macOS-specific).

rdi: int (action), rsi: void* (settings)

455

vfs_purge

Purges data from the virtual file system (macOS-specific).

rdi: int (action), rsi: void* (args)

456

__sfi_ctl

Controls the Secure File Integrity (SFI) system (macOS-specific).

rdi: int (cmd), rsi: void* (args)

457

__sfi_pidctl

Controls Secure File Integrity (SFI) for a specific PID (macOS-specific).

rdi: pid_t (pid), rsi: int (cmd), rdx: void* (args)

458

__coalition

Manages system resource coalitions (macOS-specific).

rdi: void* (coalition), rsi: int (action)

459

__coalition_info

Retrieves information about a system resource coalition (macOS-specific).

rdi: void* (coalition_info)

460

necp_match_policy

Matches network extension control policies (macOS-specific).

rdi: void* (policy), rsi: size_t (policy_size)

461

getattrlistbulk

Retrieves multiple file attributes in bulk (macOS-specific).

rdi: void* (dirfd), rsi: void* (attr_list), rdx: size_t (count)

463

__openat

Opens a file relative to a directory file descriptor (macOS-specific).

rdi: int (dirfd), rsi: const char* (path), rdx: int (flags), r10: mode_t (mode)

464

__openat_nocancel

Opens a file relative to a directory file descriptor, non-cancelable (macOS-specific).

rdi: int (dirfd), rsi: const char* (path), rdx: int (flags), r10: mode_t (mode)

465

__renameat

Renames a file relative to a directory file descriptor (macOS-specific).

rdi: int (old_dirfd), rsi: const char* (old_name), rdx: int (new_dirfd), r10: const char* (new_name)

466

faccessat

Checks file access permissions relative to a directory file descriptor (macOS-specific).

rdi: int (dirfd), rsi: const char* (path), rdx: int (mode)

467

fchmodat

Changes file permissions relative to a directory file descriptor (macOS-specific).

rdi: int (dirfd), rsi: const char* (path), rdx: mode_t (mode)

468

fchownat

Changes file ownership relative to a directory file descriptor (macOS-specific).

rdi: int (dirfd), rsi: const char* (path), rdx: uid_t (user), r10: gid_t (group)

470

fstatat

Retrieves file status relative to a directory file descriptor (macOS-specific).

rdi: int (dirfd), rsi: const char* (path), rdx: struct stat* (statbuf)

471

linkat

Creates a hard link relative to a directory file descriptor (macOS-specific).

rdi: int (dirfd), rsi: const char* (old_path), rdx: int (new_dirfd), r10: const char* (new_name)

472

__unlinkat

Deletes a file relative to a directory file descriptor (macOS-specific).

rdi: int (dirfd), rsi: const char* (path), rdx: int (flags)

473

readlinkat

Reads a symbolic link relative to a directory file descriptor (macOS-specific).

rdi: int (dirfd), rsi: const char* (path), rdx: char* (buf), r10: size_t (bufsize)

474

symlinkat

Creates a symbolic link relative to a directory file descriptor (macOS-specific).

rdi: const char* (old_name), rsi: int (dirfd), rdx: const char* (new_name)