I don’t know who is surprised by this. Apple broke their version of gdb, or more likely, modified the kernel noexec() function to disallow debugging iTunes, DVD Player, and anything else they want. I didn’t really expect DTrace to have full access to those areas either. That doesn’t mean it’s not completely wrong.

Apparently the problem isn’t that a lot of people want to debug iTunes, it’s that DTrace doesn’t work correctly when iTunes is running, no matter what you are tracing.

Landon Fuller has already written a small .kext that disables the NOATTACH method that the kernel is using, once again allowing full tracing and debugging. XNU is open source, it was only a matter of time anyway before someone figured it out.

http://landonf.bikemonkey.org/code/macosx/Leopard_PT_DENY_ATTACH.20080122.html