MacOS vm_read API seems flaky (no such process)

222 views Asked by At

I have some C code calling the Mach vm_read API to grab one or more words from the memory of a different process. I'm able to get it working sometimes (compiling with code signing and running under sudo), but other times, I get a kernel error "no such process" even though the process remains unchanged. Is this flakiness a known issue?

Code snippet below. This does not work (vm_read returns 1), but it looks identical to code which has in the past:

size_t PTR_SIZE = sizeof(void*);
size_t size = PTR_SIZE;

char* rbuffer = malloc(size);

vm_offset_t buffer_pointer;
mach_msg_type_number_t data_cnt;

kernret = vm_read(task, (vm_address_t)start_addr, size, &buffer_pointer, &data_cnt);
0

There are 0 answers