filename of memory mapped libraries osx

2019-06-23 17:45发布

问题:

I need to get the filenames of all memory mapped libraries of the current application. Currently I'm going through all mapped libraries via vm_region. Sadly it doesn't provide information about the filename of the current region. Is there a way to get this information in c without doing popen on vmmap ?

回答1:

  • For regular mmap-ed files you can use proc_regionfilename()
    • Note that you must provide a MAX_PATH-sized buffer to it.
    • implemented in apple's libc - libproc.c, the underlying syscall is proc_info.
  • For libraries from dyld_shared_cache you get "/private/var/db/dyld/dyld_shared_cache_x86_64" as the path and need to find the actual library name.
    • https://code.google.com/p/psutil/issues/detail?id=260 speculates you can parse dyld_shared_cache_*.map file to get this info.
    • https://stackoverflow.com/a/15714052/1026 points to another implementation, http://newosxbook.com/src.jl?tree=listings&file=12-1-vmmap.c