ktrace doesn&#x27;t exist anymore on OS X as far as I know. You need to use dtrace, which means you need to write dtrace programs. Python&#x27;s dtrace interface would probably only let you load a dtrace program.<p>It might be possible to implement `maybe` as a dtrace program by instrumenting syscall entry and raising a signal or stopping the program immediately, which you can recover in your debugger (though I&#x27;m not sure if this actually stops the syscall). That said, I tried it and OS X doesn&#x27;t seem to allow &quot;destructive&quot; dtrace actions even as root with SIP disabled:<p><pre><code>    $ sudo dtrace -n &#x27;syscall::open:entry { stop(); }&#x27; -c &#x27;cat Makefile&#x27;
    dtrace: could not enable tracing: Destructive actions not allowed
    $ sudo dtrace -n &#x27;syscall::open:entry { raise(9); }&#x27; -c &#x27;cat Makefile&#x27;
    dtrace: could not enable tracing: Destructive actions not allowed
</code></pre>
Alternately you can use dynamorio, intel pin, qemu, or a quick instruction scan&#x2F;patch for SYSCALL to manually break on syscalls.<p>Either way you almost certainly will not be able to do this with python-ptrace alone. I filed an issue to write a `maybe` tool using Usercorn [1] (which supports OS X) with my VFS overlay work, which means writes could still succeed but be non-destructive.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;lunixbochs&#x2F;usercorn&#x2F;issues&#x2F;151" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;lunixbochs&#x2F;usercorn&#x2F;issues&#x2F;151</a>