Last active
September 21, 2018 11:20
-
-
Save leiless/b8a43dd1d4b11c7bef2ca682da2501a1 to your computer and use it in GitHub Desktop.
How to get XNU kernel vm address and its size
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <mach/mach_types.h> | |
| #include <mach/mach_vm.h> | |
| #include <libkern/libkern.h> | |
| extern vm_map_t kernel_map; /* exported com.apple.kpi.unsupported */ | |
| #define UNUSED(arg0, ...) (void) ((void) arg0, ##__VA_ARGS__) | |
| /* | |
| * see: | |
| * keywords: image | |
| * xnu/osfmk/vm/vm_user.c#mach_vm_region | |
| * xnu/bsd/kern/kern_core.c#coredump | |
| * xnu/bsd/kern/mach_loader.c#parse_machfile | |
| */ | |
| kern_return_t kext_start(kmod_info_t *ki, void *d) | |
| { | |
| kern_return_t e; | |
| mach_vm_address_t addr; | |
| mach_vm_size_t size; | |
| vm_region_top_info_data_t idata; | |
| mach_msg_type_number_t cnt = VM_REGION_BASIC_INFO_COUNT_64; | |
| UNUSED(ki, d); | |
| e = mach_vm_region(kernel_map, &addr, &size, | |
| VM_REGION_TOP_INFO, (vm_region_info_t) &idata, | |
| &cnt, NULL); | |
| UNUSED(idata, cnt); | |
| if (e == 0) { | |
| printf("@ kernel_map addr: %#018llx size: %#018llx\n", addr, size); | |
| } else { | |
| printf("@ mach_vm_region() failure errno: %d\n", e); | |
| } | |
| return KERN_SUCCESS; | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Sample output:
@ kernel_map addr: 0xffffff803cc78000 size: 0x0000000180000000