HomeFreeBSD

MFC r256571:

Description

MFC r256571:
Add a function, memstr, which can be used to convert a buffer of
null-separated strings to a single string. This can be used to print the
full arguments of a process using execsnoop (from the DTrace toolkit) or
with the following one-liner:

dtrace -n 'syscall::execve:return {trace(curpsinfo->pr_psargs);}'

Note that this relies on the process arguments being cached via the struct
proc, which means that it will not work for argvs longer than
kern.ps_arg_cache_limit. However, the following rather non-portable
script can be used to extract any argv at exec time:

fbt::kern_execve:entry
{

printf("%s", memstr(args[1]->begin_argv, ' ',
    args[1]->begin_envv - args[1]->begin_argv));

}

The debug.dtrace.memstr_max sysctl limits the maximum argument size to
memstr().

Details

Provenance
markjAuthored on
Parents
rS269520: MFC r256571:
Branches
Unknown
Tags
Unknown

Event Timeline