Search code examples
macoskernel-extension

Can I obtain a task in KEXT?


Just wondering if it is possible to obtain a task for a given proc_t inside a kext. I have tried task_for_pid() which didn't work for some reason that I don't remember. I tried proc_task(proc_t p) from sys/proc.h but I can't load my kext since that function is not exported.

I guess that I'm doing something wrong but I can't quite figure out what. Assuming I can get the task for a process, I'd like to use some mach calls and allocate memory, write memory and whatnot but for that, I would need the task I believe.


Solution

  • I'm not aware of a public direct proc_t->task_t lookup KPI, unfortunately.

    However, in some cases, you might be able to get away with using current_task() and holding on to that pointer for as long as you need it. Use task_reference and task_deallocate for reference counting (but don't hold references forever obviously, otherwise they'll never be freed). You can also access the kernel's task (corresponding to process 0) anytime via the global variable kernel_task.