{(void*) zone;}

If you ever wondered what the OS X equivalent to Window's ReadProcessMemory() and WriteProcessMemory() is you might had a rather sobering research experience on this topic.

After googling for all possible combinations of "read memory, OS X, ReadProcessMemory(), etc, ..." the only information I found were posts in forums where somebody with that problem only got answers like "Well! That sounds suspicious to me. You should not mess with another process' memory! brb calling the internet police you terrorist!"

After a rather frustrating search on that topic I remembered that there's a really good book about OS X internals and low level stuff that sounds like evil hacking stuff to the common Twitter-addicted iphone-"coder". It's "Mac OS X Internals: A Systems Approach" by Amit Singh.

So here it is:
ReadProcessMemory() -> vm_read_overwrite()
WriteProcessMemory() -> vm_write()

With these functions you can read from and write to a process' memory. (But you will need root to get a task handle for the process.)

The book does not tell you much about the functions so you have to google it yourself. But knowing what you have to look for you'll find sooner or later this very informative site:

http://www.brokenzipper.com/developer/howthecheatworks.html

The approach to alter/read another process memory is simple:

1. you make sure you have super user rights
2. you ask the kernel with task_for_pid() for a task handle for a given process' PID.
3. you use this task handle with vm_read() / vm_write()

Well the most difficult part is to find the right addresses to read from. And if you want to write into another process' memory ... well ... think twice if you really need to. Don't mess with other people's software and don't mess with your nerves.

Update: In case the article from brokenzipper.com should be down I have made a PDF printout that you can download here: vm_memory_functions_os_x.pdf (Please note the timestamp! Not intended - I swear!)