I have this piece of code in a Mac OS app which at runtime iterates through memory regions of a process. The purpose is finding where dyld is loaded and based on that i'm obtaining other info.
To achieve this goal i am calling vm_region_recurse_64 in a loop until it returns a non-zero result. I am also increasing depth each time a region is_submap, so i get to iterate child memory regions. With each region I store its start address and size allowing me to later inspect them, looking for a mach_header_64.
With this introduction let me describe the issue i'm seeing.
On Mac OS Monterey 12.5.1 (and older releases) starting at offset 0 inside a memory region, i will find the MH_MAGIC_64 which is 0xfeedfacf, and with a few bytes offset there will be the filetype of MH_DYLINKER. At that moment i know the current region is where dyld was loaded.
On Mac OS Ventura 13.0.1, the dyld cannot be found at the start of any memory region. Instead it can be found at an offset of 8kb inside one of the memory regions, which is unexpected.
I'm trying to understand what changed with Ventura and if that change can be flag-controlled in any way. Are there any set expectations about the offset where i should look? Or maybe verifying all addresses with increments of say, 1k until i find it (therefore it being memory aligned)? That's because sequentially iterating every byte of memory in every region is not a viable option.
And if i should drop this method, Is there a better way to get to that memory?
Thanks,