Steps

  • Boot into recovery mode and disable some of the System Integrity Protection (SIP) on Mac OS X

      csrutil enable --without dtrace

  • Note: SIP only blocks tracing of system executables that ship with MacOS (under /bin, /Systen, etc.)

  • dtrace works for all non-system executables (just make a copy)

      sudo cp $(which ping) .
  sudo codesign --remove-signature ./ping
  # verify
  codesign -dv ./ping
  sudo dtruss -t open_nocancel ./ping google.com
	
  csrutil status

References