Conclusion

Well you actually read all the way to the bottom of this paper! Hope it wasn't too boring. Things are changing a little on Mac OS X. The later releases (10.4.6) on Intel have new restrictions in place on the task_for_pid() function. These restrictions require you to be part of the "procmod" group or root in order to call the task_for_pid() mach trap. Luckily these restrictions are easily bypassable.

There is also mixed discussion (gossip) about whether or not Mach will be completely removed from Mac OS X in future. I have no idea how true (or not) this is though.

If you noticed any problems with the content, as I mentioned earlier, please email me at nemo@felinemenace.org and let me know. No pointless (unconstructive) criticism please though.

Thanks to everyone at felinemenace and pulltheplug for your ongoing support and friendship. Also thanks to anyone who proof read this paper for me and to the uninformed team for giving me the opportunity to publish this.