I wanted to use /proc/<pid>/map
directory in order to get info about virtual memory of a process (especially about its shared libraries). Since mac os doesn't have one I'm trying to find other ways. One of them seems to be sysctl
call but I don't quite understand how to use it for such purpose. Are there any examples? I know it also can be done via some mach_vm
interface calls but documentation is quite pour. Maybe you know any other ways of reading process memory? My mac os version is Darwin by the way.
Note: the purpose is to do this without using any utilities or fork/exec
calls. I also don't want any pseudofs
to be mounted.
macOS' virtual memory subsystem is in the Mach-inherited part of the kernel, so those APIs are definitely the ones to use. For inspecting regions, look at mach_vm_region()
(called vm_region
in the original Mach - you will find more documentation for that), for reading memory, use mach_vm_read()
.
You may also find the vmmap
command line utility to come in useful for exploration.