title: Understanding output of dtruss
body: <p>Could anyone point me to a reference on how to understand/interpret the report outputted by dtruss (mac) or dtrace?</p>
  
  <p>I just tried dtruss on a simple program. For example, I got the following output:</p>
  
  <pre><code>PID/THRD  SYSCALL(args)          = return
  250/0x103c:  getattrlist("/Volumes/CORE/CORE.app\0", 0x7FFF5E8045D8, 0x7FFF5E804250)         = 0 0
  250/0x103c:  geteuid(0x7FFF5E8045E0, 0x0, 0x7FFF5E804A18)        = 501 0
  250/0x103c:  geteuid(0x7FFF5E805DF0, 0x0, 0x7FFF5E805E80)        = 501 0
  250/0x103c:  geteuid(0x7FFF5E805540, 0x0, 0x7FFF5E805770)        = 501 0
  250/0x103c:  getattrlist("/.vol/16777224/21\0", 0x7FFF5E8046D0, 0x7FFF5E803CF0)      = 0 0
  250/0x103c:  geteuid(0x7FFF5E805950, 0x0, 0x7FFF5E8059C8)        = 501 0
  250/0x103c:  __mac_syscall(0x7FFF8D22057C, 0x50, 0x7FFF5E805990)         = 0 0
  250/0x103c:  geteuid(0x7FFF5E805950, 0x0, 0x7FFF5E8059C8)        = 501 0
  250/0x103c:  __mac_syscall(0x7FFF8D22057C, 0x51, 0x7FFF5E8059A8)         = -1 Err#30
  250/0x103c:  geteuid(0x7FFF5E8057D0, 0x0, 0x7FFF5E805848)        = 501 0
  250/0x103c:  getattrlist("/.vol/16777224/21\0", 0x7FFF5E804960, 0x7FFF5E803F80)      = 0 0
  250/0x103c:  open("/.vol/16777224/21\0", 0x0, 0x1FF)         = 6 0
  250/0x103c:  geteuid(0x7FFF5E805790, 0x0, 0x7FFF5E805920)        = 501 0
  </code></pre>
  
  <p>I can see all these system calls taking hex parameters. But how am I supposed to decode these? How can find out what file it's actually trying to open, for example?</p>