title: Reading memory from another process on Mac
body: <p>I'm building a library for reading memory that I'd like to expand to Mac OS.</p>
  <p>Among many other functions, the one main function used by many of the methods is <a href="https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-readprocessmemory" rel="nofollow noreferrer"><code>ReadProcessMemory</code></a>;</p>
  <pre class="lang-cs prettyprint-override"><code>[DllImport(&quot;kernel32.dll&quot;, SetLastError = true)]
  [return: MarshalAs(UnmanagedType.Bool)]
  static extern bool ReadProcessMemory(
      [In] IntPtr hProcess,
      [In] IntPtr lpBaseAddress,
      [Out] byte[] lpBuffer,
      [In] SIZE_T nSize,
      [Out] out SIZE_T lpNumberOfBytesRead
  );
  </code></pre>
  <p>I'm now wondering what the equivalent for this is on Mac. Looking around online (of course it's hardly documented at all), I think the method signature should look something like this;</p>
  <pre class="lang-cs prettyprint-override"><code>[DllImport(&quot;...&quot;)]
  [return: MarshalAs(UnmanagedType.I4)]
  static extern int vm_read_overwrite(
      [In] IntPtr target_task,
      [In] IntPtr address,
      [In] SIZE_T size,
      [Out] byte[] data,
      [Out] out SIZE_T outsize
  );
  </code></pre>
  <p><a href="https://developer.apple.com/documentation/kernel/1585371-vm_read_overwrite" rel="nofollow noreferrer"><code>vm_read_overwrite</code></a> is also what's used by <a href="https://github.com/rbspy/read-process-memory/blob/master/src/lib.rs#L155-L161" rel="nofollow noreferrer">several Rust libraries</a>.</p>
  <hr />
  <p>What library/package is <code>vm_read_overwrite</code> part of? Is the signature correct? Perhaps additionally, can I use conditional compilation to use the different functions, or do I have to use <code>RuntimeInformation.IsOSPlatform</code>?</p>