| 2-2 | Sequence of GDB commands for generating a crash report | 61 |
| 2-3 | The structure of the Mach-O header (32-bit version) | 63 |
| 2-4 | A trivial C program to be compiled to an "empty" executable | 64 |
| 2-5 | Displaying the load commands in an executable's Mach-O header | 65 |
| 2-6 | Creating fat binaries | 66 |
| 2-8 | Compiling dynamic and static libraries | 69 |
| 2-9 | Using a custom initialization routine in a dynamic shared library | 70 |
| 2-10 | Using weak symbols on Mac OS X 10.2 and newer | 72 |
| 2-11 | Interposing a library function through dyld | 73 |
| 2-13 | Bundle structure of a Mac OS X framework | 83 |
| 2-16 | Listing the load commands in a Mach-O file | 87 |
| 2-17 | Printing libraries loaded in a program | 88 |
| 2-18 | Determining whether a Mach-O file is prebound | 89 |
| 2-26 | Using nibtool to view the contents of a nib file | 110 |
| 2-28 | Using precompiled headers | 123 |
| 2-29 | A trivial AppleScript program | 125 |
| 2-30 | Command-line interaction with the Disc Recording framework | 127 |
| 2-31 | Command-line interaction with the Disk Images framework | 127 |
| 2-32 | Using the sips command to resample an image and convert its format | 128 |
| 2-33 | Using the mdfind command to find files matching a given query | 129 |
| 2-35 | Using Authorization Services | 137 |
| 2-36 | Examining keychains using the security command | 140 |
| 2-37 | Interacting with Directory Services by using command-line tools | 141 |
| 2-38 | Using the scutil command to access the System Configuration dynamic store | 142 |
| 2-39 | An audit control file | 144 |
| 3-5 | Retrieving processor cache information using the sysctl command | 178 |
| 3-7 | Data prefetching in AltiVec | 187 |
| 3-9 | Retrieving and displaying the Timebase Register | 192 |
| 3-10 | Code template for inline assembly in the GNU assembler | 193 |
| 3-12 | Precision of the floating-point-estimate instruction on the G4 and the G5 | 200 |
| 3-16 | A trivial AltiVec program | 215 |
| 3-17 | Displaying the contents of the VRSAVE | 216 |
| 3-18 | A simple C function that calls another function | 228 |
| 3-19 | Assembly code depicting an indirect function call | 229 |
| 3-20 | Assembly code depicting a direct function call | 230 |
| 3-22 | Assembly listing for a C function with no arguments and an empty body | 233 |
| 3-25 | Printing a function call stack trace | 237 |
| 3-26 | A recursive function to compute factorials | 241 |
| 3-27 | Annotated assembly listing for the function shown in Figure 3-26 | 242 |
| 3-28 | A hardware-based compare-and-store function for the 970FX | 245 |
| 3-31 | Implementation of function rerouting by instruction patching | 250 |
| 3-32 | Function rerouting in action | 255 |
| 3-33 | Tracing an "empty" C program using amber | 257 |
| 3-34 | A C program with instructions that are illegal in user space | 257 |
| 3-35 | Tracing program execution with amber | 258 |
| 3-36 | Accounting for instructions traced by amber | 259 |
| 4-2 | Physical memory properties in the device tree of a PowerBook G4 | 294 |
| 4-3 | Physical memory properties in the device tree of a Power Mac G5 | 295 |
| 4-4 | Dumping NVRAM contents | 300 |
| 4-6 | The Towers of Hanoi: simulating recursion using a stack | 305 |
| 4-7 | The Towers of Hanoi: Forth code for animation | 306 |
| 4-8 | The Towers of Hanoi: Forth code for the program's core logic | 312 |
| 4-10 | Fabricating and using a mouse pointer in Open Firmware | 315 |
| 4-11 | AND and XOR masks for an X-shaped pointer | 317 |
| 4-12 | Pixel-addressable printing in Open Firmware made possible by stealing a font | 318 |
| 4-13 | A clock implemented in the Open Firmware environment | 321 |
| 4-14 | PPM image data for a 4x4-pixel image | 322 |
| 4-16 | A bootinfo file | 329 |
| 4-17 | Properties of the chosen device node as seen from Mac OS X | 334 |
| 4-18 | Retrieving a BSD device node's Open Firmware path | 341 |
| 4-22 | Using the EFI shell | 372 |
| 4-24 | Listing the partitions on a GPT-partitioned disk | 376 |
| 5-3 | The kernel's per-processor data table | 390 |
| 5-4 | The entry for the PowerPC 970FX in the processor-type table | 395 |
| 5-5 | Data structure and related definitions of a patch-table entry | 398 |
| 5-6 | The kernel's patch table | 399 |
| 5-7 | Flushing the L2 cache on the PowerPC 970FX | 404 |
| 5-9 | Calculating the PowerPC PTEG hash table size used by the kernel | 412 |
| 5-10 | Initialization of the kprintf() function | 417 |
| 5-13 | Initializing page frames during VM subsystem initialization | 425 |
| 5-15 | Loading a replacement panic user interface image into the kernel | 437 |
| 5-16 | Testing the panic user interface | 439 |
| 5-18 | Domain and protocol initialization | 451 |
| 5-19 | Mounting the root file system | 456 |
| 5-20 | Finding the root device with help from the I/O Kit | 457 |
| 5-21 | Doing the core work of finding the root device | 457 |
| 5-23 | A launchd configuration file | 474 |
| 5-24 | Creating a periodic launchd job | 476 |
| 5-26 | A trivial echo server called dummyd | 479 |
| 5-27 | The contents of the com.osxbook.dummyd.plist configuration file | 483 |
| 5-32 | Implementation of session creation and launching by launchd | 489 |
| 6-1 | Retrieving basic host information using Mach calls | 520 |
| 6-2 | Retrieving clock attributes and time values in Mach | 522 |
| 6-3 | Setting an alarm using Mach calls | 524 |
| 6-4 | Using Mach calls to retrieve scheduling and virtual memory statistics | 527 |
| 6-5 | The Mach-O segment containing the exception vectors in the kernel executable | 534 |
| 6-6 | The kernel's exception vectors | 535 |
| 6-7 | Trap vectors in Third Edition UNIX | 536 |
| 6-8 | Structure for a thread's machine-dependent state | 538 |
| 6-10 | Common code for exception processing | 544 |
| 6-14 | Passing a long long parameter in 32-bit and 64-bit ABIs | 564 |
| 6-16 | Details of the final dispatching of BSD system calls | 566 |
| 6-17 | System call data structures in Third Edition UNIX | 572 |
| 6-18 | Creating a user-space system call stub | 573 |
| 6-19 | Directly invoking a BSD system call | 575 |
| 6-20 | Multiple ways of retrieving a Mach task's self port | 577 |
| 6-21 | Mach trap table data structures and definitions | 579 |
| 6-22 | Mach trap table initialization | 580 |
| 6-23 | Setting up the pid_for_task() Mach trap | 582 |
| 6-24 | Testing the pid_for_task() Mach trap | 583 |
| 6-25 | Testing the Thread Info UFT | 588 |
| 6-26 | Testing the Facility Status UFT | 589 |
| 6-27 | Enabling the kernel's Blue Box support | 591 |
| 6-28 | Displaying the contents of the comm area | 597 |
| 6-29 | Initialization of the kprintf() function | 604 |
| 6-30 | Invocation of CHUD system-wide hooks for traps and ASTs | 607 |
| 6-31 | Invoking a disabled PowerPC-only system call | 608 |
| 6-32 | Implementing a kernel extension to register a PowerPC-only system call | 609 |
| 6-33 | Using kgmon and gprof for kernel profiling | 613 |
| 6-34 | Implementation of the profil() system call | 615 |
| 6-36 | Audit macros in the kernel and how they are used | 623 |
| 6-38 | kdebug tracing in the BSD system call handler | 627 |
| 6-39 | Using the kdebug facility in a program | 630 |
| 6-40 | Common header file for using the diagnostics system call interface | 642 |
| 6-41 | Retrieving boot-screen information using a diagnostics system call | 643 |
| 6-42 | Retrieving the physical address (if any) for a virtual address in the caller's address space | 644 |
| 6-43 | Retrieving physical memory using a diagnostics system call | 645 |
| 6-45 | Data structures for holding per-processor information | 652 |
| 6-46 | Causing an exception and retrieving the corresponding counter from the kernel | 653 |
| 6-47 | Maintenance of hardware exception counters in the kernel | 654 |
| 6-48 | Processing of low-tracing-related boot-time arguments during system startup | 656 |
| 6-49 | An example of low-trace record generation by kernel code | 658 |
| 6-50 | Control data structures for the VMM facility | 659 |
| 6-51 | A program to run machine code within a VM using the VMM facility | 663 |
| 6-52 | Result of running a sequence of machine instructions in a VM using the vmachmon32 program | 674 |
| 6-53 | Result of running a recursive factorial function within a VM using the vmachmon32 program | 676 |
| 7-2 | The processor set structure in the xnu kernel | 690 |
| 7-3 | The processor structure in the xnu kernel | 692 |
| 7-6 | Retrieving information about processors on the host | 696 |
| 7-7 | Out-of-line data received by a process from the kernel as a result of a Mach call | 699 |
| 7-8 | Starting and stopping a processor through the Mach processor interface | 700 |
| 7-9 | The task structure in the xnu kernel | 702 |
| 7-10 | The thread structure in the xnu kernel | 706 |
| 7-14 | Retrieving the current thread (shuttle) and the current activation on Mac OS X 10.3 and 10.4 | 716 |
| 7-15 | Blocking with and without continuations | 719 |
| 7-16 | Continuation-related aspects of the BSD uthread structure | 721 |
| 7-17 | The use of continuations in the implementation of the select() system call | 722 |
| 7-18 | The skeleton of the nfsiod program | 723 |
| 7-19 | Creating a Mach task | 728 |
| 7-20 | Creating a Mach thread | 730 |
| 7-21 | Retrieving detailed task and thread information from the kernel | 732 |
| 7-22 | Counting the number of system calls made by a process | 745 |
| 7-23 | The BSD proc structure | 747 |
| 7-24 | The BSD uthread structure | 748 |
| 7-26 | Registering handlers to be run before and after a fork() system call invocation | 750 |
| 7-28 | Verifying the values returned by the kernel in the case of a raw fork() system call | 754 |
| 7-30 | Verifying that the child borrows the parent's resources during a vfork() system call | 758 |
| 7-32 | Creating and running Java threads | 762 |
| 7-33 | Using the NSTask Cocoa class | 763 |
| 7-34 | Using the NSThread Cocoa class | 765 |
| 7-35 | Launching an application through the Carbon Process Manager | 767 |
| 7-36 | Using Carbon Multiprocessing Services | 769 |
| 7-37 | Creating Carbon Thread Manager threads | 772 |
| 7-39 | Real-time clock interrupt processing | 778 |
| 7-40 | System clock configuration | 781 |
| 7-41 | Converting between absolute- and clock-time intervals | 783 |
| 7-42 | Scheduler startup | 785 |
| 7-43 | Sampling the value of the scheduler tick | 786 |
| 7-44 | Timer call processing | 788 |
| 7-45 | The scheduler's bookkeeping function | 788 |
| 7-47 | The run queue structure | 792 |
| 7-48 | Important scheduling-related fields of the task and thread structures | 793 |
| 7-49 | Computation of the timesharing priority of a thread | 795 |
| 7-50 | User-space computation of sched_pri_shift and sched_tick_interval | 796 |
| 7-51 | Computation of the usage-to-priority conversion factor for timeshared priorities | 798 |
| 7-52 | Approximating multiplication by 5/8 as implemented in the scheduler | 800 |
| 7-53 | Experimenting with the THREAD_PRECEDENCE_POLICY scheduling policy | 803 |
| 7-54 | Experimenting with the THREAD_TIME_CONSTRAINT_POLICY scheduling policy | 807 |
| 7-55 | Recomputing a thread's priority on a scheduling-policy change | 810 |
| 7-56 | Structure for holding executable image parameters during the execve() system call | 812 |
| 7-58 | Creation of the user stack during the execve() system call | 820 |
| 7-59 | A Mach-O executable with a custom stack | 821 |
| 7-61 | Dumping the Launch Services registration database | 829 |
| 7-62 | Example of a UTI declaration | 832 |
| 8-2 | A shell script for reading kernel virtual memory | 842 |
| 8-3 | Using the kvm(3) interface to read kernel memory | 844 |
| 8-4 | Determining the size of physical memory on a system | 846 |
| 8-11 | Grabbing a page from the free list | 873 |
| 8-12 | Reserving physical memory | 874 |
| 8-14 | Controlling memory inheritance | 894 |
| 8-15 | Protecting memory | 897 |
| 8-16 | Accessing another task's memory | 899 |
| 8-17 | Common header file for the shared memory client-server example | 902 |
| 8-18 | Source for the shared memory client | 903 |
| 8-19 | Source for the shared memory server | 905 |
| 8-20 | Examples of exported UBC routines | 915 |
| 8-21 | System-wide shared memory setup during bootstrapping | 923 |
| 8-24 | Using shared_region_map_file_np() | 936 |
| 8-25 | Loading a split-segment library in the global shared region | 939 |
| 8-27 | Reading the contents of the TWS subsystem's global user profile cache | 945 |
| 8-28 | TWS-related processing during the execve() system call | 947 |
| 8-29 | The malloc zones API | 952 |
| 8-31 | Scalable zone data structures | 955 |
| 8-33 | A program that performs tiny allocations | 960 |
| 8-36 | Determining the size of the largest single malloc() allocation | 968 |
| 8-37 | Allocating 2 petabytes of virtual memory | 970 |
| 8-38 | Implementing a version of the printf() function without using malloc() | 971 |
| 8-39 | Enumerating all malloc()-allocated pointers in a program | 972 |
| 8-40 | Displaying scalable-zone statistics | 974 |
| 8-41 | Logging malloc operations | 977 |
| 8-42 | Intercepting the malloc layer | 979 |
| 8-45 | Zone allocator functions | 988 |
| 8-46 | Printing sizes of kalloc zones supported in the kernel | 992 |
| 8-47 | Array of memory types supported by the BSD memory allocator | 998 |
| 8-55 | Using a 64-bit-only instruction | 1011 |
| 9-1 | System library wrappers around Mach messaging traps | 1033 |
| 9-3 | Descriptors for sending ports and out-of-line memory in Mach IPC messages | 1036 |
| 9-4 | Requesting the kernel to include the sender's security token in the message trailer | 1039 |
| 9-6 | The data structure for a task's IPC space | 1042 |
| 9-8 | IPC-related data structures associated with a Mach task | 1048 |
| 9-9 | IPC-related data structures associated with a Mach thread | 1051 |
| 9-11 | Listing the Mach ports and their attributes in a given process | 1055 |
| 9-15 | Displaying information about all known services in a bootstrap context | 1072 |
| 9-16 | A crash-resistant server | 1074 |
| 9-17 | launchd debug messages corresponding to a Mach server's initialization | 1077 |
| 9-18 | launchd debug messages corresponding to a Mach server's relaunch | 1078 |
| 9-19 | Common header file for the simple IPC client-server example | 1080 |
| 9-20 | Source for the simple IPC server | 1081 |
| 9-21 | Source for the simple IPC client | 1083 |
| 9-22 | Using a port set to receive request messages destined for multiple services | 1086 |
| 9-23 | Inserting port rights into an IPC space | 1088 |
| 9-24 | Sending out-of-line memory in an IPC message | 1091 |
| 9-25 | Sending port rights in an IPC message | 1093 |
| 9-26 | Common header file for the Miscellaneous Server and its client | 1100 |
| 9-27 | MIG specification file for the Miscellaneous Server | 1102 |
| 9-28 | Programmer-provided source for the Miscellaneous Server | 1103 |
| 9-29 | A client for accessing the services provided by the Miscellaneous Server | 1106 |
| 9-32 | Initialization of MIG subsystems during kernel bootstrap | 1111 |
| 9-33 | Exception ports at the host, task, and thread levels | 1113 |
| 9-34 | Initialization of exception handling during kernel bootstrap | 1114 |
| 9-36 | Delivery of Mach exceptions | 1120 |
| 9-37 | Processing of unresolved kernel traps | 1121 |
| 9-38 | An exception handler for "fixing" illegal instructions | 1123 |
| 9-39 | Signal notification of asynchronous I/O completion | 1133 |
| 9-42 | Common header file for the descriptor-passing client-server implementation | 1150 |
| 9-43 | Implementation of the descriptor-passing server | 1150 |
| 9-44 | Implementation of the descriptor-passing client | 1153 |
| 9-45 | Working with POSIX semaphores | 1157 |
| 9-46 | Working with POSIX shared memory | 1161 |
| 9-48 | Common header file for the Distributed Objects client-server example | 1167 |
| 9-49 | Server source for the Distributed Objects client-server example | 1167 |
| 9-50 | Client source for the Distributed Objects client-server example | 1169 |
| 9-51 | Exception-handling macros in the Foundation framework | 1171 |
| 9-52 | AppleScript program to speak the system version | 1173 |
| 9-53 | AppleScript program for opening and tiling Terminal application windows | 1175 |
| 9-54 | Sending Apple Events to the Finder from a C program | 1177 |
| 9-55 | A program for posting distributed notifications (NSNotification) | 1182 |
| 9-56 | A program for observing distributed notifications (NSNotification) | 1183 |
| 9-57 | Common header file for defining notification names | 1185 |
| 9-58 | Program for posting notify(3) notifications | 1186 |
| 9-59 | Receiving notifications through multiple mechanisms | 1187 |
| 9-60 | Monitoring a file through notify(3) | 1191 |
| 9-61 | Using the kqueue() and kevent() system calls to watch for file events | 1194 |
| 9-62 | A program for posting Core Foundation distributed notifications | 1198 |
| 9-63 | A program for observing Core Foundation distributed notifications | 1199 |
| 9-65 | A CFMessagePort server | 1204 |
| 9-66 | A CFMessagePort client | 1205 |
| 9-67 | A CFSocket client | 1207 |
| 9-68 | Using a CFRunLoopTimer | 1209 |
| 9-70 | Using locks in the kernel | 1217 |
| 9-71 | The Mach lock set interface | 1218 |
| 9-72 | Using Mach semaphores | 1220 |
| 9-73 | Internal structure of a Mach semaphore | 1222 |
| 9-74 | The structure of a Mac OS X funnel | 1225 |
| 9-75 | Automatic funnel use in a thread-unsafe file system | 1227 |
| 10-3 | The main function of the IOWorkLoop class | 1247 |
| 10-4 | Using IOWorkLoop in a driver | 1248 |
| 10-5 | The kmod_info structure | 1254 |
| 10-6 | The contents of a simple kernel extension bundle | 1260 |
| 10-7 | Excerpt from the build output of a Universal kernel extension | 1261 |
| 10-8 | Implementation of libkmodc++.a | 1263 |
| 10-9 | Declaration of the kmod_info structure for an I/O Kit driver kernel module | 1264 |
| 10-10 | Implementation of libkmod.a | 1265 |
| 10-11 | Declaration of the kmod_info structure for a generic kernel module | 1266 |
| 10-13 | Source for the DummySysctl kernel extension | 1273 |
| 10-15 | Implementing sysctl nodes | 1277 |
| 10-16 | An I/O Kit driver's personality and dependencies | 1281 |
| 10-17 | The driver personality of the BootCache kernel extension | 1282 |
| 10-18 | An excerpt from the iPod driver's property list file | 1283 |
| 10-19 | Header file for the DummyDriver I/O Kit driver | 1284 |
| 10-20 | Implementation of the DummyDriver I/O Kit driver's class | 1285 |
| 10-23 | Programmatically rotating a framebuffer | 1290 |
| 10-24 | Accessing framebuffer memory | 1293 |
| 10-25 | Retrieving the list of firmware variables from the I/O Registry | 1295 |
| 10-26 | Retrieving information about loaded kernel extensions | 1296 |
| 10-28 | Opening a connection to the motion sensor service object | 1301 |
| 10-29 | Invoking a user client method given an IOService connection handle | 1302 |
| 10-30 | Listing PCI devices in the system | 1303 |
| 10-31 | Retrieving the computer's serial number and model information | 1304 |
| 10-32 | Retrieving temperature sensor readings | 1306 |
| 10-33 | Retrieving the MAC addresses of Ethernet interfaces in the system | 1309 |
| 10-34 | Personality and dependency list for the SimpleCryptoDisk I/O Kit driver | 1311 |
| 10-35 | Header file for the SimpleCryptoDisk I/O Kit driver | 1312 |
| 10-36 | Source for the SimpleCryptoDisk I/O Kit driver | 1314 |
| 10-37 | Reading the contents of cleartext storage directly from the storage medium | 1320 |
| 10-38 | Using encrypted storage with the SimpleCryptoDisk filter scheme driver | 1321 |
| 10-41 | Periodic delivery of log messages to readers of the log device | 1327 |
| 10-44 | A simple C function | 1339 |
| 10-45 | Stabs-encoded debugging information in an assembly file | 1340 |
| 11-1 | Using ioctl operations to display information about a disk device | 1346 |
| 11-2 | Listing a disk's partitions | 1348 |
| 11-5 | Using Disk Arbitration to obtain a disk's description | 1355 |
| 11-6 | Expressing dissent against a mount operation | 1357 |
| 11-7 | Monitoring the appearance and disappearance of storage devices | 1359 |
| 11-9 | The Mac OS X block and character device switch structures | 1364 |
| 11-15 | Displaying information about all available file system types | 1380 |
| 11-16 | Vnode operations vectors in the VFS layer | 1383 |
| 11-17 | Initialization of vnode operations vectors during bootstrap | 1385 |
| 11-22 | Retrieving and setting an MDItem attribute | 1412 |
| 11-25 | A file system change logger based on the fsevents mechanism | 1422 |
| 11-26 | Programmatically launching the Spotlight search window | 1431 |
| 11-27 | Pseudocode for creating and running a Spotlight query using the MDQuery interface | 1433 |
| 11-28 | A program for executing raw Spotlight queries | 1435 |
| 11-29 | A program to create and set an ACL | 1443 |
| 11-35 | Common header file for the vnode-level file system activity monitor | 1455 |
| 11-36 | Source for the vnode-level file system activity monitor kernel extension | 1457 |
| 11-37 | Source for the user-space retrieval program for the vnode-level file system activity monitor | 1464 |
| 12-7 | The contents of an HFS+ volume header | 1494 |
| 12-8 | Finder information contained in the volume header of a boot volume | 1499 |
| 12-10 | The contents of a master directory block | 1503 |
| 12-11 | Hinting to the file system where to look for free space on a volume | 1507 |
| 12-12 | Examining allocation block consumption on a volume | 1508 |
| 12-15 | Using the Carbon File Manager API to convert a CNID to a Unix pathname | 1516 |
| 12-16 | The contents of a Catalog B-Tree's header node | 1518 |
| 12-18 | The contents of an Extents Overflow B-Tree's header node | 1523 |
| 12-20 | Programmatically setting an extended attribute | 1527 |
| 12-26 | Examining the HFS+ private metadata folder and hard-link creation | 1549 |
| 12-27 | Use of the private metadata folder for storing unlinked busy files | 1552 |
| 12-28 | A Python program to resolve an alias | 1555 |
| 12-29 | A Perl program to create a file with eight fragments on an HFS+ volume | 1559 |
| 12-33 | Viewing VFS event notifications using kqueue/kevent | 1572 |
| 12-34 | Querying a volume's capabilities | 1576 |
| A-1 | Using the bless command to view boot-related information in the volume header | 1589 |
| A-2 | Using command-line tools to display partitioning-related information | 1590 |
| A-3 | Compiling an "empty" C program on the x86, PowerPC, and 64-bit PowerPC | 1592 |
| A-4 | Running a program both natively and under Rosetta | 1593 |
| A-5 | Testing a nonexecutable stack on the x86 version of Mac OS X | 1595 |
| A-6 | Setting up a newly created thread's state on the x86 version of Mac OS X | 1596 |
| A-7 | Invoking a system call on the x86 version of Mac OS X | 1597 |