DTrace key logger - macos

Question

I have tried to see if I could get Brendan Gregg's sshkeysnoop.d to work on Mac OS X, but am having trouble. Is it possible to get this working? If so, how?
The error I am getting is:
dtrace: failed to compile script ./sshkeysnoop.d: line 40: probe description syscall::exec:return does not match any probes
Is it possible to do any other kind of key logging on Mac OS X using DTrace?

Answer 1

A couple things you can do to adapt scripts like this. First, you can ask dtrace what probe points it has:
$ sudo dtrace -l -f 'syscall::exec*'
ID PROVIDER MODULE FUNCTION NAME
18442 syscall execve entry
18443 syscall execve return
Second, you can trace all syscalls on a single process to see what's going on.
$ sudo dtruss ssh somewhere 2>dtrussout
Password: (type something here)
If you look through dtrussout you can see
read_nocancel(0x5, "a\0", 0x1) = 1 0
read_nocancel(0x5, "s\0", 0x1) = 1 0
read_nocancel(0x5, "d\0", 0x1) = 1 0
read_nocancel(0x5, "f\0", 0x1) = 1 0
read_nocancel(0x5, "\n\0", 0x1) = 1 0
With that knowledge, it's pretty easy to adapt the script.
$ diff sshkeysnoop.d{.orig,}
40c40
< syscall::exec:return, syscall::exece:return
---
> syscall::execve:return
51c51
< syscall::open:entry, syscall::open64:entry
---
> syscall::open:entry
58c58
< syscall::open:return, syscall::open64:return
---
> syscall::open:return
68c68
< syscall::read:entry
---
> syscall::read_nocancel:entry
75c75
< syscall::read:return
---
> syscall::read_nocancel:return

Answer 2

OS X does not have a syscall::exec DTrace probe. It does have a syscall::execve though. Similarly it doesn't have syscall::open64, which is also used in this script. However, even with replacing exec with execve and removing open64, the script doesn't function correctly.

Answer 3

Also make sure you are loading with the all option
kldload dtraceall
and not just
kldload dtrace
Or the syscalls are not going to get loaded.