Can I use DTrace to view the arguments passed to strncpy?

I know I could write interposer to see the arguments passed to the strncpy library call, but it looks like this should be easy to do with DTrace.

+3
source share
1 answer

Here's a working version (tested only on Mac):


#!/usr/sbin/dtrace -s
pid$target::strncpy:entry
{
    printf( "%s( %X, %s, %lld )\n",
        probefunc,
        arg0,
        copyinstr(arg1),
        arg2 );
}

copyinstr required because the string comes from userland to the kernel.

+5
source

Source: https://habr.com/ru/post/1710214/


All Articles