Where did the /proc directory go in Mountain Lion?

I used to find the location of cached flash videos by lsof | grep Flash, the result is something like this

Google 38571 lamnk 74u REG 1,2 156826302 37061768 /Users/lamnk/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/.com.google.Chrome.KNc63e

Pepper flash player deleted the files so you can not see or copy them, but the process 38571 still hold the files open. Normally I can save the cached flash video by copying /proc/38571/fd/74 to another location. However on Mountain Lion I find out that /proc is not there anymore!

Is it possible to get another process to use these file handles and read the files that exist but lack a proper filesystem handle / inode structure? Do I need to configure /proc in 10.8 if the native tools won't work?

Solution 1:

/proc has never been included in any version of OS X (although Amit Singh wrote a version of procfs for OS X). You should, however, be able to get at it through /.vol instead. First, find the device number for the volume it lives on with something like stat -f%d /Users/lamnk (assuming you don't have your Library weirdly redirected to another volume). Then get its file ID (aka inode number) from the lsof command (370617680 in the example you gave). You can then reach it as /.vol/volumeid/fileid:

$ stat -f%d /Users/lamnk
234821716
$ lsof -c "Google Chrome" | grep "Pepper Data"
Google 38571 lamnk 74u REG 1,2 156826302 37061768 /Users/lamnk/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/.com.google.Chrome.KNc63e
$ cp /.vol/234821716/37061768 rawfile

EDIT: Apparently /.vol does not find unlinked-but-open files, even though they still exist on disk. Unfortunately, this means this trick won't work here. You might be able to do it with Amit Singh's procfs, but I haven't used it so I don't know if it'll do the trick either.