Search code examples
cmacosdarwinprocfssysctl

Get /proc/<pid>/map info with sysctl call under mac os


I wanted to use /proc/<pid>/map directory in order to get info about virtual memory of a process (especially about its shared libraries). Since mac os doesn't have one I'm trying to find other ways. One of them seems to be sysctl call but I don't quite understand how to use it for such purpose. Are there any examples? I know it also can be done via some mach_vm interface calls but documentation is quite pour. Maybe you know any other ways of reading process memory? My mac os version is Darwin by the way. Note: the purpose is to do this without using any utilities or fork/exec calls. I also don't want any pseudofs to be mounted.


Solution

  • macOS' virtual memory subsystem is in the Mach-inherited part of the kernel, so those APIs are definitely the ones to use. For inspecting regions, look at mach_vm_region() (called vm_region in the original Mach - you will find more documentation for that), for reading memory, use mach_vm_read().

    You may also find the vmmap command line utility to come in useful for exploration.