7

你mach_vm_region会mach_vm_region_recurse在哪些情况下使用哪种？

函数声明的签名是：

kern_return_t mach_vm_region
(
    vm_map_t target_task,
    mach_vm_address_t *address,
    mach_vm_size_t *size,
    vm_region_flavor_t flavor,
    vm_region_info_t info,
    mach_msg_type_number_t *infoCnt,
    mach_port_t *object_name
);
kern_return_t mach_vm_region_recurse
(
    vm_map_t target_task,
    mach_vm_address_t *address,
    mach_vm_size_t *size,
    natural_t *nesting_depth,
    vm_region_recurse_info_t info,
    mach_msg_type_number_t *infoCnt
);

如果我想，我应该使用哪个功能...

  1. 找到进程的所有有效内存地址？
  2. 找到一个进程的所有私有内存？
4

1 回答 1

4

不同之处在于该vm_region_recurse_64版本允许您查看submaps的内容。我不会假装是这个主题的专家，但据我所知，您遇到子图的最常见的地方是在遍历从 dyld 缓存映射框架的内存时（从x86_64 macs上的SHARED_REGION_BASE_X86_64=开始） 0x00007FFF7000000）。

vm_region 似乎将子图作为单个区域返回。

我认为子图中可以有私有映射。

这是一个例子：

                       00007fff70000000-00007fff76c00000 vm_region
                       00007fff70000000-00007fff76c00000 vm_region_recurse_64    (depth=0, is_submap == TRUE)
                       00007fff7695b000-00007fff76a00000 vm_region_recurse_64 #1 (depth=1, is_submap == FALSE)
                       00007fff76a00000-00007fff76c00000 vm_region_recurse_64 #2 (depth=1, is_submap == FALSE)

以下是vmstat -interleaved -v报告的方式：

map                    00007fff70000000-00007fff76c00000 r--/rwx process-only submap
unused split lib       00007fff7695b000-00007fff76999000 system shared library region not used by this process
__DATA                 00007fff76999000-00007fff7699a000 /usr/lib/system/libcompiler_rt.dylib
unused split lib       00007fff7699a000-00007fff769a2000 system shared library region not used by this process
__DATA                 00007fff769a2000-00007fff769a3000 /usr/lib/system/libsystem_notify.dylib
unused split lib       00007fff769a3000-00007fff76a00000 system shared library region not used by this process
unused split lib       00007fff76a00000-00007fff76c00000 system shared library region not used by this process
于 2013-06-18T00:12:57.777 回答