https://www.macinternals.app/en/blog Latest from Blog en Mon, 25 May 2026 21:35:57 GMT https://www.macinternals.app/en/blog/apfs-clones-and-snapshots https://www.macinternals.app/en/blog/apfs-clones-and-snapshots clonefile, fclonefileat, fs_snapshot — three syscalls that let you copy 50 GB in 50 milliseconds. Here's what happens under each one, and what doesn't get copied. Mac Internals Tue, 26 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/apple-silicon-and-xnu https://www.macinternals.app/en/blog/apple-silicon-and-xnu What changed in XNU when Apple shipped its own ARM silicon — P/E cores, APRR page-permission switching, the AMX matrix coprocessor, and Rosetta 2. Mac Internals Tue, 26 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/driverkit https://www.macinternals.app/en/blog/driverkit Same IOKit object model, userland process. Why kexts are dying, what DriverKit gives you, and how a USB driver actually crosses the boundary. Mac Internals Tue, 26 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/macos-security-architecture https://www.macinternals.app/en/blog/macos-security-architecture Six interlocking layers — code signing, AMFI, entitlements, sandbox profiles, SIP, TCC, and the SEP — that together decide what code is allowed to do on a Mac. Mac Internals Tue, 26 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/signals-in-xnu https://www.macinternals.app/en/blog/signals-in-xnu POSIX says signals are per-process. Mach says everything is a thread. Here's how XNU bridges the two — pending masks, delivery threads, the AST mechanism, and exception ports. Mac Internals Tue, 26 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/xnu-scheduler https://www.macinternals.app/en/blog/xnu-scheduler Real-time, fixed-priority, timeshare, idle — four scheduling classes, 128 priorities, and a QoS layer on top. Here's how XNU picks a thread to put on a core. Mac Internals Tue, 26 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/inside-apfs https://www.macinternals.app/en/blog/inside-apfs Apple File System, the format under every modern Mac: how it lays out blocks, how it gets snapshots almost for free, and why your /System is read-only at the cryptographic level. Mac Internals Mon, 25 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/iokit-and-the-driver-model https://www.macinternals.app/en/blog/iokit-and-the-driver-model Embedded C++, an object tree, and matching dictionaries — IOKit is how every driver on macOS gets loaded, paired with hardware, and called. Mac Internals Mon, 25 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/mach-ports-and-messages https://www.macinternals.app/en/blog/mach-ports-and-messages Tasks, ports, messages, and rights — the IPC primitive that quietly carries every IPC on your Mac, from XPC to drag-and-drop. Mac Internals Mon, 25 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/the-bsd-personality https://www.macinternals.app/en/blog/the-bsd-personality Processes, file descriptors, signals, sockets — the FreeBSD-derived layer that sits on top of Mach and makes macOS pass POSIX. Mac Internals Mon, 25 May 2026 00:00:00 GMT https://www.macinternals.app/en/blog/virtual-memory-in-xnu https://www.macinternals.app/en/blog/virtual-memory-in-xnu Every macOS process gets a private address space it can't possibly afford. Here's how XNU gives it one anyway — pmap, vm_map, the compressor, and jetsam. Mac Internals Mon, 25 May 2026 00:00:00 GMT