Advertisement
Guest User

Untitled

a guest
Dec 11th, 2015
91
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.75 KB | None | 0 0
  1. #!/usr/sbin/dtrace -C -s
  2.  
  3. #pragma D option quiet
  4.  
  5. proc:::exec-success
  6. {
  7. printf("\nEXECNAME: %s\n", execname);
  8.  
  9. this->isx64=(curproc->p_flag & P_LP64)!=0;
  10. #define SELECT_64_86(x64, x86) (this->isx64 ? (x64) : (x86))
  11. #define GET_POINTER(base, offset) (user_addr_t)SELECT_64_86(*(uint64_t*)((base)+sizeof(uint64_t)*(offset)), *(uint32_t*)((base)+sizeof(uint32_t)*(offset)))
  12.  
  13. this->ptrsize=SELECT_64_86(sizeof(uint64_t),sizeof(uint32_t));
  14. this->argc=curproc->p_argc;
  15.  
  16. this->isClean=SELECT_64_86(1, (curproc->p_dtrace_argv==(uregs[R_SP],sizeof(uint32_t),sizeof(uint32_t))));
  17. this->argv=(uint64_t)copyin(curproc->p_dtrace_argv,this->ptrsize*this->argc);
  18.  
  19. /* printf("%s with args:%d (%p, %p)\n",execname, this->argc, curproc->pdtraceargv, uregs\[R_SP\]); */
  20.  
  21. printf("EXEC: %s ", (0 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,0)) : "");
  22. printf("%s ", (1 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,1)) : "");
  23. printf("%s ", (2 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,2)) : "");
  24. printf("%s ", (3 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,3)) : "");
  25. printf("%s ", (4 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,4)) : "");
  26. printf("%s ", (5 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,5)) : "");
  27. printf("%s ", (6 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,6)) : "");
  28. printf("%s ", (7 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,7)) : "");
  29. printf("%s ", (8 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,8)) : "");
  30. printf("%s ", (9 < this->argc && this->isClean) ? copyinstr(GET_POINTER(this->argv,9)) : "");
  31. printf("\n");
  32.  
  33. #undef GET_POINTER
  34. #undef SELECT_64_86
  35. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement