My understanding is that support for the ktrace back-end is (/was/will be) upcoming for python-ptrace. Unfortunately I don't have the skills for that, but what I meant is that I hope someone will; then tools like `maybe` can presumably use python-ptrace in just the same way as other Unices?
ktrace doesn't exist anymore on OS X as far as I know. You need to use dtrace, which means you need to write dtrace programs. Python's dtrace interface would probably only let you load a dtrace program.
It might be possible to implement `maybe` as a dtrace program by instrumenting syscall entry and raising a signal or stopping the program immediately, which you can recover in your debugger (though I'm not sure if this actually stops the syscall). That said, I tried it and OS X doesn't seem to allow "destructive" dtrace actions even as root with SIP disabled:
$ sudo dtrace -n 'syscall::open:entry { stop(); }' -c 'cat Makefile'
dtrace: could not enable tracing: Destructive actions not allowed
$ sudo dtrace -n 'syscall::open:entry { raise(9); }' -c 'cat Makefile'
dtrace: could not enable tracing: Destructive actions not allowed
Alternately you can use dynamorio, intel pin, qemu, or a quick instruction scan/patch for SYSCALL to manually break on syscalls.
Either way you almost certainly will not be able to do this with python-ptrace alone. I filed an issue to write a `maybe` tool using Usercorn [1] (which supports OS X) with my VFS overlay work, which means writes could still succeed but be non-destructive.
