Skip to content


Switch branches/tags

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


Read all about the TrueTree concept here

TrueTree is more than just a pstree command for macOS. It is used to display a process tree for current running processes while using a hierarchy built on additoinal pids that can be collected from the operating system. The standard process tree on macOS that can be built with traditional pids and ppids is less than helpful on macOS due to all the XPC communication at play. The vast majority of processes end up having a parent process of launchd. TrueTree however displays a process tree that is meant to be useful to incident responders, threat hunters, researchers, and everything in between!

Major Update: Because of the ever changing features on macOS, since macOS 11 some features don't operate quite the same as they used to when I wrote the original blog post for TrueTree. Apple has introduced the addition of a new process "runningboardd" which ends up being the true parent of many processes. To get around this TrueTree was updated to use the Application Services framework which allowed for aquiring the true parent in some scenarios. However, this no longer allows for the aquiring of a true parent process if that parent process has terminated. Making it difficult to pinpoint some true parents such as the "open" command. A small price to pay to ensure TrueTree continues to operate across macOS releases. Some other signs of a true parent can often be found inside of the launchctl procinfo output. This might be taken into consideration in the future.

./TrueTree -h
--nocolor -> Do not color code items in output --notree -> Do not print tree format. Just print in list format --timestamps -> Include process timestamps --standard -> Print the standard Unix tree instead of TrueTree --sources -> Print the source of where each processes parent came from --version -> Print the TrueTree version number -o -> output to file

Note: Requires Root

Displays an enhanced process tree using the TrueTree concept

./TrueTree --standard
For tree output based on standard pids and ppids use --standard

./TrueTree --timestamps
For output in either format with process create time added use the --timestamps option

./TrueTree --sources
To show where each parent pid was aquired from use the --sources option


A command line tool for pstree-like output on macOS with additional pid capturing capabilities







No releases published


No packages published