mach_inject | interprocess code injection for Mac OS X | iOS library

Using a kext, you can certainly obtain the task handle to any process; this is the part that no longer works from user space since SIP. The task_t pointer in the kext can be converted to a special port using task_get_special_port(task, TASK_KERNEL_PORT, &task_port), which you can then send to a user space task using mach_msg_send_from_kernel(). Once you have the port in user space you can do the usual things such as allocating, reading & writing memory in the target task, etc. However, if the target task has very strict code signing flags set, any attempt to execute code in memory pages that aren't signed will fail by crashing the process. This means it won't work on most of Apple's own apps. Other methods than code injection may be easier and more secure, as you mentioned.