Mach_vm_region vs mach_vm_region_recurse

Question

What is the difference between mach_vm_region and mach_vm_region_recurse and in what situations would you use that?

Feature Declaration Signature:

 kern_return_t mach_vm_region ( vm_map_t target_task, mach_vm_address_t *address, mach_vm_size_t *size, vm_region_flavor_t flavor, vm_region_info_t info, mach_msg_type_number_t *infoCnt, mach_port_t *object_name ); kern_return_t mach_vm_region_recurse ( vm_map_t target_task, mach_vm_address_t *address, mach_vm_size_t *size, natural_t *nesting_depth, vm_region_recurse_info_t info, mach_msg_type_number_t *infoCnt ); 

What function should I use if I want ...

• Find all valid memory addresses for a process?
• find all the personal memory for the process?

Answer 1

The difference is that the vm_region_recurse_64 version allows you to view the contents of subframes . I will not pretend to be an expert on this topic, but, as far as I see, the most common place where you encounter sub-patterns is to move the memory in which the frames are displayed from the dyld cache (starting from SHARED_REGION_BASE_X86_64 = 0x00007FFF7000000 on x86_64 macs).

vm_region seems to return a subcap as a single area.

I think that inside the submap there may be private comparisons.

Here is an example:

  00007fff70000000-00007fff76c00000 vm_region 00007fff70000000-00007fff76c00000 vm_region_recurse_64 (depth=0, is_submap == TRUE) 00007fff7695b000-00007fff76a00000 vm_region_recurse_64 #1 (depth=1, is_submap == FALSE) 00007fff76a00000-00007fff76c00000 vm_region_recurse_64 #2 (depth=1, is_submap == FALSE) 

And this is how vmstat -interleaved -v reports this:

 map 00007fff70000000-00007fff76c00000 r--/rwx process-only submap unused split lib 00007fff7695b000-00007fff76999000 system shared library region not used by this process __DATA 00007fff76999000-00007fff7699a000 /usr/lib/system/libcompiler_rt.dylib unused split lib 00007fff7699a000-00007fff769a2000 system shared library region not used by this process __DATA 00007fff769a2000-00007fff769a3000 /usr/lib/system/libsystem_notify.dylib unused split lib 00007fff769a3000-00007fff76a00000 system shared library region not used by this process unused split lib 00007fff76a00000-00007fff76c00000 system shared library region not used by this process