How does the OS X 'heap' command-line tool collect its information?

Question

The OS X 'heap' command line utility can apparently list the various malloc zones and individual malloc'ed chunks of any running process. It does not require linking with any special debug library or has any debug environment variables set for the target process.

What basic mechanism does he use for this? All the malloc debugging APIs that I could detect should have hooks installed inside the process, special debug libraries, bound or debugged environment variables set before the process started. From what I can tell, the source code of the utility is not available, and numerous search queries on Google and Apple.com did not show anything useful.

I'm most interested in getting the actual amount of malloc'ed memory, since the resident size of the process can often be significantly pumped up from what is actually requested by the application code.

Thanks!

Answer 1

They use the malloc zone introspection API declared in /usr/include/malloc/malloc.h . Each malloc zone contains a pointer to the malloc_introspection_t structure, which provides an enumerator function that can be used to locate the memory areas reserved by the malloc zone and information about all the individual allocations in these regions.