#include <mach/mach_vm.h> not included by <mach/mach.h> — include it explicitly
mach/mach_vm.h
macro_mach_vm_user_
#define _mach_vm_user_
macromach_vm_MSG_COUNT
#define mach_vm_MSG_COUNT 30
functionmach_vm_allocate
extern kern_return_t mach_vm_allocate( vm_map_t target, mach_vm_address_t *address, /* inout */ mach_vm_size_t size, int flags )
If building for Sandbox, keep NAME unchanged
Allocate zero-filled memory in the address space
of the target task, either at the specified address,
or wherever space can be found (controlled by flags),
of the specified size. The address at which the
allocation actually took place is returned.
functionmach_vm_deallocate
extern kern_return_t mach_vm_deallocate( vm_map_t target, mach_vm_address_t address, mach_vm_size_t size )
Deallocate the specified range from the virtual
address space of the target virtual memory map.
functionmach_vm_protect
extern kern_return_t mach_vm_protect( vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, boolean_t set_maximum, vm_prot_t new_protection )
Set the current or maximum protection attribute
for the specified range of the virtual address
space of the target virtual memory map. The current
protection limits the memory access rights of threads
within the map; the maximum protection limits the accesses
that may be given in the current protection.
Protections are specified as a set of {read, write, execute}
*permissions*.
functionmach_vm_inherit
extern kern_return_t mach_vm_inherit( vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, vm_inherit_t new_inheritance )
Set the inheritance attribute for the specified range
of the virtual address space of the target address space.
The inheritance value is one of {none, copy, share}, and
specifies how the child address space should acquire
this memory at the time of a task_create call.
functionmach_vm_read
extern kern_return_t mach_vm_read( vm_map_read_t target_task, mach_vm_address_t address, mach_vm_size_t size, vm_offset_t *data, /* out */ mach_msg_type_number_t *dataCnt )
Returns the contents of the specified range of the
virtual address space of the target task. [The
range must be aligned on a virtual page boundary,
and must be a multiple of pages in extent. The
protection on the specified range must permit reading.]
functionmach_vm_read_list
extern kern_return_t mach_vm_read_list( vm_map_read_t target_task, mach_vm_read_entry_t data_list, /* inout */ natural_t count )
List corrollary to vm_read, returns mapped contents of specified
ranges within target address space.
functionmach_vm_write
extern kern_return_t mach_vm_write( vm_map_t target_task, mach_vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt )
Writes the contents of the specified range of the
virtual address space of the target task. [The
range must be aligned on a virtual page boundary,
and must be a multiple of pages in extent. The
protection on the specified range must permit writing.]
functionmach_vm_copy
extern kern_return_t mach_vm_copy( vm_map_t target_task, mach_vm_address_t source_address, mach_vm_size_t size, mach_vm_address_t dest_address )
Copy the contents of the source range of the virtual
address space of the target task to the destination
range in that same address space. [Both of the
ranges must be aligned on a virtual page boundary,
and must be multiples of pages in extent. The
protection on the source range must permit reading,
and the protection on the destination range must
permit writing.]
functionmach_vm_read_overwrite
extern kern_return_t mach_vm_read_overwrite( vm_map_read_t target_task, mach_vm_address_t address, mach_vm_size_t size, mach_vm_address_t data, mach_vm_size_t *outsize /* out */ )
Returns the contents of the specified range of the
virtual address space of the target task. [There
are no alignment restrictions, and the results will
overwrite the area pointed to by data - which must
already exist. The protection on the specified range
must permit reading.]
functionmach_vm_msync
extern kern_return_t mach_vm_msync( vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, vm_sync_t sync_flags )
▾
claude-fable-5, 2026-08-24 · not from Apple sources
Synchronizes the specified address range of the target task with its backing memory object, in the manner of msync(2).
sync_flags is the union of:
VM_SYNC_ASYNCHRONOUS initiate required pageouts and return immediately
VM_SYNC_SYNCHRONOUS wait until pageouts have completed
VM_SYNC_INVALIDATE flush cached pages; a later access faults the
data back in from the backing object
VM_SYNC_KILLPAGES with VM_SYNC_INVALIDATE, discard dirty pages
without writing them back
VM_SYNC_DEACTIVATE move the pages to the inactive queue
VM_SYNC_CONTIGUOUS fail with KERN_INVALID_ADDRESS unless the
entire range is mapped
At most one of VM_SYNC_ASYNCHRONOUS and VM_SYNC_SYNCHRONOUS may be specified.
functionmach_vm_behavior_set
extern kern_return_t mach_vm_behavior_set( vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, vm_behavior_t new_behavior )
Set the paging behavior attribute for the specified range
of the virtual address space of the target task.
The behavior value is one of {default, random, forward
sequential, reverse sequential} and indicates the expected
page reference pattern for the specified range.
functionmach_vm_map
extern kern_return_t mach_vm_map( vm_map_t target_task, mach_vm_address_t *address, /* inout */ mach_vm_size_t size, mach_vm_offset_t mask, int flags, mem_entry_name_port_t object, memory_object_offset_t offset, boolean_t copy, vm_prot_t cur_protection, vm_prot_t max_protection, vm_inherit_t inheritance )
Map a user-supplie memory object into the virtual address
space of the target task. If desired (anywhere is TRUE),
the kernel will find a suitable address range of the
specified size; else, the specific address will be allocated.
The beginning address of the range will be aligned on a virtual
page boundary, be at or beyond the address specified, and
meet the mask requirements (bits turned on in the mask must not
be turned on in the result); the size of the range, in bytes,
will be rounded up to an integral number of virtual pages.
The memory in the resulting range will be associated with the
specified memory object, with the beginning of the memory range
referring to the specified offset into the memory object.
The mapping will take the current and maximum protections and
the inheritance attributes specified; see the vm_protect and
vm_inherit calls for a description of these attributes.
If desired (copy is TRUE), the memory range will be filled
with a copy of the data from the memory object; this copy will
be private to this mapping in this target task. Otherwise,
the memory in this mapping will be shared with other mappings
of the same memory object at the same offset (in this task or
in other tasks). [The Mach kernel only enforces shared memory
consistency among mappings on one host with similar page alignments.
The user-defined memory manager for this object is responsible
for further consistency.]
functionmach_vm_machine_attribute
extern kern_return_t mach_vm_machine_attribute( vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, vm_machine_attribute_t attribute, vm_machine_attribute_val_t *value /* inout */ )
Set/Get special properties of memory associated
to some virtual address range, such as cachability,
migrability, replicability. Machine-dependent.
functionmach_vm_remap
extern kern_return_t mach_vm_remap( vm_map_t target_task, mach_vm_address_t *target_address, /* inout */ mach_vm_size_t size, mach_vm_offset_t mask, int flags, vm_map_t src_task, mach_vm_address_t src_address, boolean_t copy, vm_prot_t *cur_protection, /* out */ vm_prot_t *max_protection, /* out */ vm_inherit_t inheritance )
Map portion of a task's address space.
▾
claude-fable-5, 2026-08-24 · not from Apple sources
Maps a range of src_task's address space into target_task. With copy == FALSE the underlying memory is shared: stores through either mapping are visible in both tasks. With copy == TRUE the new mapping is a copy of the source as of the time of the call.
On entry *target_address is the requested location, constrained by the alignment bits in mask; with VM_FLAGS_ANYWHERE set in flags the kernel chooses the address and returns it. cur_protection and max_protection return the protections of the new mapping (see also mach_vm_remap_new, where they are inout and the source task port may be read-only). The source and target may be the same task, which makes this the standard way to alias memory within one address space.
functionmach_vm_page_query
extern kern_return_t mach_vm_page_query( vm_map_read_t target_map, mach_vm_offset_t offset, integer_t *disposition, /* out */ integer_t *ref_count /* out */ )
Give the caller information on the given location in a virtual
address space. If a page is mapped return ref and dirty info.
functionmach_vm_region_recurse
extern kern_return_t mach_vm_region_recurse( vm_map_read_t target_task, mach_vm_address_t *address, /* inout */ mach_vm_size_t *size, /* out */ natural_t *nesting_depth, /* inout */ vm_region_recurse_info_t info, /* out */ mach_msg_type_number_t *infoCnt )
▾
claude-fable-5, 2026-08-24 · not from Apple sources
Returns information about the region at or above the given address in the target task, like mach_vm_region, but descends into submaps.
On entry, *nesting_depth is the maximum submap depth to descend; on return it holds the depth at which the returned entry was found. address and size return the bounds of the entry. info should point to a vm_region_submap_info_data_64_t with *infoCnt set to VM_REGION_SUBMAP_INFO_COUNT_64; among other fields it reports whether the entry is itself a submap (is_submap), its protections, and share mode.
Returns KERN_INVALID_ADDRESS when no region exists at or above the given address. This is the call underlying vmmap(1)-style address space listings.
functionmach_vm_region
extern kern_return_t mach_vm_region( vm_map_read_t target_task, mach_vm_address_t *address, /* inout */ mach_vm_size_t *size, /* out */ vm_region_flavor_t flavor, vm_region_info_t info, /* out */ mach_msg_type_number_t *infoCnt, mach_port_t *object_name /* out */ )
Returns information about the contents of the virtual
address space of the target task at the specified
address. The returned protection, inheritance, sharing
and memory object values apply to the entire range described
by the address range returned; the memory object offset
corresponds to the beginning of the address range.
[If the specified address is not allocated, the next
highest address range is described. If no addresses beyond
the one specified are allocated, the call returns KERN_NO_SPACE.]
function_mach_make_memory_entry
extern kern_return_t _mach_make_memory_entry( vm_map_t target_task, memory_object_size_t *size, memory_object_offset_t offset, vm_prot_t permission, mem_entry_name_port_t *object_handle, mem_entry_name_port_t parent_handle )
▾
claude-fable-5, 2026-08-24 · not from Apple sources
Creates a named memory entry: a send right representing a range of the target task's memory, which can later be mapped into this or another task with mach_vm_map.
The entry covers *size bytes starting at offset; both are rounded to page boundaries and *size returns the actual length. permission gives the maximum access permitted through the handle and may be augmented with the MAP_MEM_* flags from memory_object_types.h (e.g. MAP_MEM_NAMED_CREATE to back the entry with fresh memory, MAP_MEM_VM_COPY to snapshot the range). If parent_handle names an existing entry, the new entry is carved out of it instead of the task's address space.
Most callers use the mach_make_memory_entry_64() wrapper rather than this raw MIG routine.
functionmach_vm_purgable_control
extern kern_return_t mach_vm_purgable_control( vm_map_t target_task, mach_vm_address_t address, vm_purgable_t control, int *state /* inout */ )
Control behavior and investigate state of a "purgable" object in
the virtual address space of the target task. A purgable object is
created via a call to mach_vm_allocate() with VM_FLAGS_PURGABLE
specified. See the routine implementation for a complete
definition of the routine.
functionmach_vm_page_info
extern kern_return_t mach_vm_page_info( vm_map_read_t target_task, mach_vm_address_t address, vm_page_info_flavor_t flavor, vm_page_info_t info, /* out */ mach_msg_type_number_t *infoCnt )
▾
claude-fable-5, 2026-08-24 · not from Apple sources
Returns information about the page containing the given address in the target task.
flavor selects the information structure. With VM_PAGE_INFO_BASIC, info points to a vm_page_info_basic_data_t and *infoCnt is VM_PAGE_INFO_BASIC_COUNT; it reports the page's disposition (the VM_PAGE_QUERY_PAGE_* bits, as in mach_vm_page_query), reference count, backing object id and offset, and the submap depth of the mapping.
functionmach_vm_page_range_query
extern kern_return_t mach_vm_page_range_query( vm_map_read_t target_map, mach_vm_offset_t address, mach_vm_size_t size, mach_vm_address_t dispositions, mach_vm_size_t *dispositions_count /* inout */ )
▾
claude-fable-5, 2026-08-24 · not from Apple sources
Reports the disposition of every page in the given range of the target map.
dispositions is the address, in the calling task, of a buffer receiving one integer per page (the VM_PAGE_QUERY_PAGE_* bits, as returned by mach_vm_page_query). On entry *dispositions_count is the capacity of the buffer in entries; on return, the number of entries written. A single call replaces a loop of mach_vm_page_query calls.
functionmach_vm_remap_new
extern kern_return_t mach_vm_remap_new( vm_map_t target_task, mach_vm_address_t *target_address, /* inout */ mach_vm_size_t size, mach_vm_offset_t mask, int flags, vm_map_read_t src_task, mach_vm_address_t src_address, boolean_t copy, vm_prot_t *cur_protection, /* inout */ vm_prot_t *max_protection, /* inout */ vm_inherit_t inheritance )
Map portion of a task's address space, {max, cur}_protection is inout.
functionmach_vm_range_create
extern kern_return_t mach_vm_range_create( vm_map_t target_task, mach_vm_range_flavor_t flavor, mach_vm_range_recipes_raw_t recipes, mach_msg_type_number_t recipesCnt )
was: mach_vm_deferred_reclamation_buffer_update_reclaimable_bytes()
▾
claude-fable-5, 2026-08-24 · not from Apple sources
Registers caller-defined virtual address ranges in the target task. flavor selects the recipe format: with MACH_VM_RANGE_FLAVOR_V1, recipes is an array of mach_vm_range_recipe_v1_t, each carrying a mach_vm_range_tag_t and the range's boundaries (see vm_types.h). Ranges tagged MACH_VM_RANGE_DATA are used to place later data allocations (heap, ObjC, malloc metadata) inside the registered window, separating them from other mappings for exploit-mitigation purposes.
Note: the comment on this routine in mach_vm.defs ("was: ...") is a stale leftover from an earlier interface.
functionmach_vm_update_pointers_with_remote_tags
extern kern_return_t mach_vm_update_pointers_with_remote_tags( vm_map_t target, mach_vm_offset_list_t in_pointer_list, mach_msg_type_number_t in_pointer_listCnt, mach_vm_offset_list_t out_pointer_list, /* out */ mach_msg_type_number_t *out_pointer_listCnt )
▾
claude-fable-5, 2026-08-24 · not from Apple sources
Rewrites a list of tagged pointers so that their tag bits match the tags currently applied to the corresponding memory of the target task (arm64 Memory Tagging Extension). in_pointer_list supplies the pointer values; out_pointer_list receives the updated values in the same order.
functionmach_vm_reallocate
extern kern_return_t mach_vm_reallocate( vm_map_t target_task, mach_vm_address_t src, mach_vm_size_t src_size, mach_vm_address_t *dst, /* inout */ mach_vm_size_t dst_size, mach_vm_offset_t align_mask, int options, int flags )
Relocate the pages of the source range of the specified map to a new range
of the given size in bytes within the same map.
macrosubsystem_to_name_map_mach_vm
#define subsystem_to_name_map_mach_vm { "mach_vm_allocate", 4800 },
{ "mach_vm_deallocate", 4801 },
{ "mach_vm_protect", 4802 },
{ "mach_vm_inherit", 4803 },
{ "mach_vm_read", 4804 },
{ "mach_vm_read_list", 4805 },
{ "mach_vm_write", 4806 },
{ "mach_vm_copy", 4807 },
{ "mach_vm_read_overwrite", 4808 },
{ "mach_vm_msync", 4809 },
{ "mach_vm_behavior_set", 4810 },
{ "mach_vm_map", 4811 },
{ "mach_vm_machine_attribute", 4812 },
{ "mach_vm_remap", 4813 },
{ "mach_vm_page_query", 4814 },
{ "mach_vm_region_recurse", 4815 },
{ "mach_vm_region", 4816 },
{ "_mach_make_memory_entry", 4817 },
{ "mach_vm_purgable_control", 4818 },
{ "mach_vm_page_info", 4819 },
{ "mach_vm_page_range_query", 4820 },
{ "mach_vm_remap_new", 4821 },
{ "mach_vm_range_create", 4825 },
{ "mach_vm_update_pointers_with_remote_tags", 4827 },
{ "mach_vm_reallocate", 4829 }