filename of memory mapped libraries osx

Question

I need to get the filenames of all memory mapped libraries of the current application. Currently I'm going through all mapped libraries via vm_region. Sadly it doesn't provide information about the filename of the current region. Is there a way to get this information in c without doing popen on vmmap ?

Schreck

Does this post help? #1628498 – Studer

Answer 1

• For regular mmap-ed files you can use proc_regionfilename()
  • Note that you must provide a MAX_PATH-sized buffer to it.
  • implemented in apple's libc - libproc.c, the underlying syscall is proc_info.
• For libraries from dyld_shared_cache you get "/private/var/db/dyld/dyld_shared_cache_x86_64" as the path and need to find the actual library name.
  • https://code.google.com/p/psutil/issues/detail?id=260 speculates you can parse dyld_shared_cache_*.map file to get this info.
  • https://mcmap.net/q/1021911/-mach_vm_region_recurse-mapping-memory-and-shared-libraries-on-osx points to another implementation, http://newosxbook.com/src.jl?tree=listings&file=12-1-vmmap.c

Playful

Answer 2

Here's how you can use libproc.h and proc_pidinfo() to list the mmapped files:

#include <stdio.h>
#include <stdlib.h>
#include <libproc.h>

int main (int argc, char **argv) {
    if (argc < 2) exit(1);
    int pid = atoi(argv[1]);

    struct proc_regionwithpathinfo prwpi;
    uint64_t address = 0;
    uint64_t last_ino = 0;
    while (1) {
        int retval = proc_pidinfo(pid, PROC_PIDREGIONPATHINFO, address, &prwpi, sizeof(prwpi));
        if (retval <= 0) {
            break;
        }
        else if (retval < sizeof(prwpi)) {
            perror("proc_pidinfo");
            exit(1);
        }
        char *path = prwpi.prp_vip.vip_path;
        uint64_t ino = prwpi.prp_vip.vip_vi.vi_stat.vst_ino;

        if (path && path[0] && ino != last_ino) {
            printf("path is %s\n", path);
            last_ino = ino;
        }
        address = prwpi.prp_prinfo.pri_address + prwpi.prp_prinfo.pri_size;
    }
    return 0;
}

Enigmatic