c++xcodemacosmemorymach

Retrieving the file path of a dynamic library loaded by a process on MacOS

Goal:

I want to retrieve the file paths of dynamic libraries loaded by a process.

My code:

struct task_dyld_info dyld_info;
mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
struct dyld_image_info dyld_image_info;
char path[PATH_MAX];

if (task_info(task, TASK_DYLD_INFO, (task_info_t) & dyld_info, & count) == KERN_SUCCESS) {
  printf("dyld_all_image_infos: %p\n", dyld_info.all_image_info_addr);
  printf("%d\n", dyld_info.all_image_info_size);

  struct dyld_all_image_infos * dyld_all_image_infos = (struct dyld_all_image_infos * ) dyld_info.all_image_info_addr;

  for (int i = 0; i < dyld_all_image_infos -> infoArrayCount; i++) {
    dyld_image_info = dyld_all_image_infos -> infoArray[i];
    printf("%s\n", dyld_image_info.imageFilePath);
    if (dyld_image_info.imageFilePath != NULL) {
      if (strstr(dyld_image_info.imageFilePath, "GameCore_XP2.dll") != NULL) {
        printf("Found GameCore_XP2.dll\n");
        printf("%s\n", dyld_image_info.imageFilePath);
        printf("%p\n", dyld_image_info.imageLoadAddress);
      }
    }
  }
}

Unfortunately Xcode gives me the following error at runtime: "Thread 1: EXC_BAD_ACCESS (code=1, address=0x4002e2804002d54)"

enter image description here

Solution

  • According to https://gist.github.com/xcxcxc/989018646b1f0f2f31f0873a32c4a658, you need to use vm_read to get that data.