Hi!
I am a bit baffled by the current state of dtrace. Usual probes like syscall are not present by default on Apple Silicon, and dtruss and countless other utilities do not work, even with SIP disabled and Permissive Security.
A precedent thread (https://developer.apple.com/forums/thread/692444) mentioning execsnoop was answered by mentioning the Kernel Debug Kit.
It is not clear to me what the KDKs provide that could make dtrace work again. If the intention is installing alternative kernels (development/kasan), those are not supported in Apple Silicon.
I know there are other ways of tracing the kernel but I'd like to know if officially dtrace is just legacy and unsupported or if there is actually a way to make it work. I need to examine some xnu memory structures and it's exhausting to not even know if I can use dtrace or not.