Search code examples
macosdriverkitmacos-system-extension

How to overwrite portions of a DriverKit OSData internal buffer?


The documentation of OSData says that "...You can add bytes to them and overwrite portions of the byte array.". I can see a method to append bytes, but I don't understand how I am able to overwrite a portion of the buffer.

Another option would be to use IONewZero to allocate a number of elements of the type I need. I my case I just need this for ints.

Example:

T* dataBuffer = IONewZero(T, SIZE);

And then deallocate with:

IOSafeDeleteNULL(dataBuffer_, T, SIZE);

What are the advantages of using an OSData object compared to the solution with IONewZero / IOSafeDeleteNULL?


Solution

  • I think the documentation might just be copy-pasted from the kernel variant of OSData. I've seen that in a bunch of places, especially USBDriverKit.

    OSData is mostly useful for dealing with plist-like data structures (i.e. setting and getting properties on service objects) in conjunction with the other OSTypes: OSArray, OSDictionary, OSNumber, etc. It's also used for in-band (<= 4096 byte) "struct" arguments of user client external methods.

    The only use I can see outside of those scenarios is when you absolutely have to reference-count a blob of data. But it's certainly not a particularly convenient or efficient container for data-in-progress. If you subsequently need to send the data to a device or map it to user space, IOBufferMemoryDescriptor is probably a better choice (and also reference counted) though it's even more heavyweight.