osx mountain lion - Handling process information from a KEXT -

inside kext, need processing either proc_t or pid. if go pid route, sysctl() of sorts.

unfortunately, can't either. proc_t undefined , sysctl() isn't either. sysctlbyname() can called kinfo_proc isn't defined. if try use proc_t, compiler complains forward definition of [struct proc]

i'm assuming sysctl() there used in user mode there way can use proc_t? tried use xnu/osfmk/bsd include dir won't compile because of redefinitions , other errors.

it's little disconcerting , i'm still trying wrap head around can , cannot do. surely can done don't quite know how.

ok, i'm going try , take stab @ question think you're asking.

as you've discovered, proc_t pointer opaque struct proc. don't write off though, there various functions operate on such pointers, don't need gain direct access struct (which helps maintain binary compatibility). of these declared in sys/proc.h in kernel.framework - i.e. /system/library/frameworks/kernel.framework/versions/a/headers/sys/proc.h. mention pid , parent pid, there following:

/* returns pid of given process */ extern int proc_pid(proc_t); /* returns pid of parent of given process */ extern int proc_ppid(proc_t); 

there functions going other way - getting proc_t pid etc.

note these functions part of bsd portion of kernel, kext needs declare dependency on bsd kpi bundle in info.plist. (look kextlibs tool if haven't come across yet)

coming windows, you'll have used reading header files , source codes instead of documentation. of osx kernel api undocumented.