使用 Homebrew Cask 安装 truetree

项目链接

• 主页

命令和别名

• TrueTree

项目历史

The project grew out of Jaron Bradley's February 2020 write-up of the 'TrueTree' concept: on macOS, launchd and XPC often make ordinary process trees look flat or misleading, so the tool uses additional operating-system process metadata to reconstruct more helpful ancestry.

Its README later documented platform drift: after macOS 11 introduced runningboardd behavior that changed parentage observations, TrueTree was updated to use Application Services for some true-parent discovery while accepting that some terminated parents can no longer be recovered.

采用历史

TrueTree appears to have remained a specialist macOS security tool rather than a broad Unix replacement for pstree. Its Homebrew cask packaging made a compiled release easy to install on analyst Macs, while the GitHub project stayed compact and focused.

使用方式

The tool is used from a root shell to print an enhanced process tree, optionally showing timestamps, parent-data sources, network information, or a standard PID/PPID tree for comparison.

In package-manager culture it is the kind of niche binary that belongs in a forensic or IR workstation bootstrap list: install it with Homebrew, run it during macOS triage, and compare its output with ps, Activity Monitor, and launchctl procinfo.

为什么软件包爱好者会关心

TrueTree matters to package nerds because it packages a very macOS-specific diagnostic idea as a single CLI. It is not a general-purpose process viewer; its value is that Homebrew users can install a purpose-built process-ancestry helper without compiling an Xcode project.

时间线

• 2020: The TrueTree concept is published for macOS threat hunting and incident response.
• 2024: GitHub shows TrueTree 0.8 as the latest release.

Related projects

• pstree and ps provide the traditional Unix process-tree baseline that TrueTree compares itself against.
• launchctl procinfo is the macOS source of several parentage clues described in the project write-up.

来源

• https://github.com/themittenmac/TrueTree
• https://themittenmac.com/the-truetree-concept/