From a1fde6f92248eaed8606c1e4e8bb18dd8776a78c Mon Sep 17 00:00:00 2001
From: Linus Dierheimer <Linus@Dierheimer.de>
Date: Mon, 5 Sep 2022 02:46:53 -0700
Subject: [PATCH] MacOS memory support

---
 src/detection/memory/memory_apple.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/detection/memory/memory_apple.c b/src/detection/memory/memory_apple.c
index 5dc287005..6e8bf2682 100644
--- a/src/detection/memory/memory_apple.c
+++ b/src/detection/memory/memory_apple.c
@@ -1,7 +1,22 @@
 #include "memory.h"
+#include "common/settings.h"
+
+#include <mach/mach.h>
 
 void ffDetectMemoryImpl(FFMemoryResult* memory)
 {
+    memory->bytesTotal = (uint64_t) ffSettingsGetAppleInt64("hw.memsize", 0);
+
     memory->bytesUsed = 0;
-    memory->bytesTotal = 0;
+
+    uint32_t pagesize = (uint32_t) ffSettingsGetAppleInt("hw.pagesize", 0);
+    if(pagesize == 0)
+        return;
+
+    mach_msg_type_number_t count = HOST_VM_INFO_COUNT;
+    vm_statistics_data_t vmstat;
+    if(host_statistics(mach_host_self(), HOST_VM_INFO, (host_info_t) (&vmstat), &count) != KERN_SUCCESS)
+        return;
+
+    memory->bytesUsed = ((uint64_t) vmstat.active_count + vmstat.wire_count) * pagesize;
 }