The OS X Kernel has been increasingly targeted by malicious players due to the shrinking attack surface. This presentation will include demonstrations and discuss attacks, such as function inlining, shadow syscall tables and DTrace hooks and their detection in memory with the Volatility Framework.