Can I obtain a task in KEXT?

Question

Just wondering if it is possible to obtain a task for a given proc_t inside a kext. I have tried task_for_pid() which didn't work for some reason that I don't remember. I tried proc_task(proc_t p) from sys/proc.h but I can't load my kext since that function is not exported.

I guess that I'm doing something wrong but I can't quite figure out what. Assuming I can get the task for a process, I'd like to use some mach calls and allocate memory, write memory and whatnot but for that, I would need the task I believe.

Answer 1

I'm not aware of a public direct proc_t->task_t lookup KPI, unfortunately.

However, in some cases, you might be able to get away with using current_task() and holding on to that pointer for as long as you need it. Use task_reference and task_deallocate for reference counting (but don't hold references forever obviously, otherwise they'll never be freed). You can also access the kernel's task (corresponding to process 0) anytime via the global variable kernel_task.

Answer 2

After some research it would appear that it's not the case. There is proc_task() defined in proc.h but it's under the #ifdef KERNEL_PRIVATE. The KEXT will compile albeit the warning.

In order to use that function, you have to add the com.apple.kpi.private in the list of dependencies but even that will fail since you are most likely NOT Apple :)

Only Apple kexts may link against com.apple.kpi.private.

Anyway, the experiment was interesting in the sense that other APIs such as vm_read, vm_write etc. are not available to use inside a KEXT (which probably makes sense since they are declared in a vm_user.h and I suppose are reserved for user mode).