mach_vm_region_recurse, mapping memory and shared libraries on osx

Question

I\'m using vm_region_recurse_64 to map out the memory for a given process, vmmap style.

Trying to get a complete list of shared libraries loaded by the application by e

Answer 1

vmmap calls mach_vm_region_recurse() to list the memory regions.

In order to see the contents of submaps like the dyld shared cache at 0x90000000..0xa0000000, you'll need to look for regions with is_submap set, and then call mach_vm_region_recurse() again with the same address and a deeper nesting_depth.

Answer 2

vmmap(1) actually gets a listing of the Mach-O images loaded in the process, by inspecting DYLD tables left in the target address space.