Memory (Apple): use sysctl instead of sysctlbyname

Author: CarterLi

src/detection/memory/memory_apple.c

@@ -1,30 +1,31 @@
 #include "memory.h"
-#include "common/sysctl.h"
 
 #include <string.h>
 #include <mach/mach.h>
+#include <sys/sysctl.h>
 
 void ffDetectMemory(FFMemoryStorage* ram)
 {
-    ram->bytesTotal = (uint64_t) ffSysctlGetInt64("hw.memsize", 0);
-    if(ram->bytesTotal == 0)
+    size_t length = sizeof(ram->bytesTotal);
+    if (sysctl((int[]){ CTL_HW, HW_MEMSIZE }, 2, &ram->bytesTotal, &length, NULL, 0))
     {
         ffStrbufAppendS(&ram->error, "Failed to read hw.memsize");
         return;
     }
 
-    uint32_t pagesize = (uint32_t) ffSysctlGetInt("hw.pagesize", 0);
-    if(pagesize == 0)
+    uint32_t pagesize;
+    length = sizeof(pagesize);
+    if (sysctl((int[]){ CTL_HW, HW_PAGESIZE }, 2, &pagesize, &length, NULL, 0))
     {
         ffStrbufAppendS(&ram->error, "Failed to read hw.pagesize");
         return;
     }
 
-    mach_msg_type_number_t count = HOST_VM_INFO_COUNT;
-    vm_statistics_data_t vmstat;
-    if(host_statistics(mach_host_self(), HOST_VM_INFO, (host_info_t) (&vmstat), &count) != KERN_SUCCESS)
+    mach_msg_type_number_t count = HOST_VM_INFO64_COUNT;
+    vm_statistics64_data_t vmstat;
+    if(host_statistics64(mach_host_self(), HOST_VM_INFO64, (host_info64_t) (&vmstat), &count) != KERN_SUCCESS)
     {
-        ffStrbufAppendS(&ram->error, "Failed to read vm statistics");
+        ffStrbufAppendS(&ram->error, "Failed to read host_statistics64");
         return;
     }
 

src/detection/swap/swap_apple.c

@@ -1,13 +1,13 @@
 #include "swap.h"
-#include "common/sysctl.h"
 
 #include <mach/mach.h>
+#include <sys/sysctl.h>
 
 void ffDetectSwap(FFMemoryStorage* swap)
 {
     struct xsw_usage xsw;
     size_t size = sizeof(xsw);
-    if(sysctlbyname("vm.swapusage", &xsw, &size, 0, 0) != 0)
+    if(sysctl((int[]){ CTL_VM, VM_SWAPUSAGE }, 2, &xsw, &size, NULL, 0) != 0)
     {
         ffStrbufAppendS(&swap->error, "Failed to read vm.swapusage");
         return;