1 files changed, 28 insertions, 0 deletions
diff --git a/src/detection/swap/swap_apple.c b/src/detection/swap/swap_apple.c
new file mode 100644
index 0000000..40dda49
--- /dev/null
+++ b/src/detection/swap/swap_apple.c
@@ -0,0 +1,28 @@
+#include "swap.h"
+
+#include "common/sysctl.h"
+#include <mach/mach.h>
+
+const char* ffDetectSwap(FFlist* result) {
+    struct xsw_usage xsw;
+    size_t size = sizeof(xsw);
+    if (sysctl((int[]) { CTL_VM, VM_SWAPUSAGE }, 2, &xsw, &size, NULL, 0) != 0) {
+        return "Failed to read vm.swapusage";
+    }
+
+    if (xsw.xsu_total == 0) {
+        if (__builtin_available(macOS 26.0, *)) {
+            // "vm.compressor_mode" no longer exists in macOS 26.0
+        } else {
+            if (ffSysctlGetInt("vm.compressor_mode", 4) <= 2) {
+                return NULL; // Swap is disabled
+            }
+        }
+    }
+
+    FFSwapResult* swap = FF_LIST_ADD(FFSwapResult, *result);
+    ffStrbufInitStatic(&swap->name, xsw.xsu_encrypted ? "Encrypted" : "Normal");
+    swap->bytesTotal = xsw.xsu_total;
+    swap->bytesUsed = xsw.xsu_used;
+    return NULL;
+}