mach_vm_region对mach_vm_region_recurse

Question

mach_vm_region和mach_vm_region_recurse有什么区别，在什么情况下您会使用哪种情况？

这些职能声明的签字如下：

kern_return_t mach_vm_region
(
    vm_map_t target_task,
    mach_vm_address_t *address,
    mach_vm_size_t *size,
    vm_region_flavor_t flavor,
    vm_region_info_t info,
    mach_msg_type_number_t *infoCnt,
    mach_port_t *object_name
);
kern_return_t mach_vm_region_recurse
(
    vm_map_t target_task,
    mach_vm_address_t *address,
    mach_vm_size_t *size,
    natural_t *nesting_depth,
    vm_region_recurse_info_t info,
    mach_msg_type_number_t *infoCnt
);

如果我想用哪种功能..。

1. 查找进程的所有有效内存地址？
2. 找到一个进程的所有私有内存？

Answer 1

区别在于，vm_region_recurse_64版本允许您查看子映射的内容。我不会假装是这个主题的专家，但据我所见，您遇到子映射的最常见的地方是遍历从dyld缓存映射框架的内存(从SHARED_REGION_BASE_X86_64 = 0x00007FFF7000000开始，在x86_64 macs上)。

vm_region似乎将子映射返回为单个区域。

我认为子映射中可以有私有映射。

下面是一个例子：

                       00007fff70000000-00007fff76c00000 vm_region
                       00007fff70000000-00007fff76c00000 vm_region_recurse_64    (depth=0, is_submap == TRUE)
                       00007fff7695b000-00007fff76a00000 vm_region_recurse_64 #1 (depth=1, is_submap == FALSE)
                       00007fff76a00000-00007fff76c00000 vm_region_recurse_64 #2 (depth=1, is_submap == FALSE)

下面是vmstat -interleaved -v报告的方式：

map                    00007fff70000000-00007fff76c00000 r--/rwx process-only submap
unused split lib       00007fff7695b000-00007fff76999000 system shared library region not used by this process
__DATA                 00007fff76999000-00007fff7699a000 /usr/lib/system/libcompiler_rt.dylib
unused split lib       00007fff7699a000-00007fff769a2000 system shared library region not used by this process
__DATA                 00007fff769a2000-00007fff769a3000 /usr/lib/system/libsystem_notify.dylib
unused split lib       00007fff769a3000-00007fff76a00000 system shared library region not used by this process
unused split lib       00007fff76a00000-00007fff76c00000 system shared library region not used by this process