svc · unix #197
mmap
Maps files or anonymous memory into the calling process's address space.
Prototype
user_addr_t mmap(caddr_t addr, size_t len, int prot, int flags, int fd, off_t pos);Returns: user_addr_t
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| addr | caddr_t | - | |
| len | size_t | - | |
| prot | int | - | |
| flags | int | - | |
| fd | int | - | |
| pos | off_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 197 |
| xnu-1486.2.11 | — | 197 |
| xnu-1504.15.3 | — | 197 |
| xnu-1504.3.12 | — | 197 |
| xnu-1504.7.4 | — | 197 |
| xnu-1504.9.17 | — | 197 |
| xnu-1504.9.26 | — | 197 |
| xnu-1504.9.37 | — | 197 |
Examples
C — anonymous RW page
void *p = mmap(NULL, 0x4000, PROT_READ | PROT_WRITE,
MAP_ANON | MAP_PRIVATE, -1, 0);
if (p == MAP_FAILED) { perror("mmap"); return 1; }C — JIT region (hardened runtime)
void *jit = mmap(NULL, 0x10000, PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_ANON | MAP_PRIVATE | MAP_JIT, -1, 0);
pthread_jit_write_protect_np(0); /* required on Apple Silicon */Notes
On macOS mmap(2) is a thin BSD wrapper that ultimately drives mach_vm_map() / mach_vm_allocate() on the calling task's vm_map. Anonymous mappings (MAP_ANON) are the standard substrate for malloc zones, dyld shared region overlays, and stack growth. Hardened runtime processes that need executable+writable pages must request MAP_JIT and hold the com.apple.security.cs.allow-jit entitlement; without it AMFI rejects the mapping and the kernel returns EACCES.
Detection
Endpoint Security exposes ES_EVENT_TYPE_NOTIFY_MMAP for file-backed maps, including the resolved vnode path and protection bits. DTrace's syscall::mmap:entry and the vminfo provider give per-region telemetry, and vmmap(1) / vm_region_recurse() let analysts enumerate live mappings post-hoc.