dtrace's curpsinfo->pr_psargs is neutered?
I'm trying to get the arguments to execve() but failing.
On a Mac, the job of strace is handled by DTrace scripts. I get it. It's awesome. The curpsinfo->pr_psargs char[] is supposed to have the process arguments. Apparently this works in all the Solaris examples. On the mac... not so much:
$ sudo dtrace -n 'syscall::exec*: {printf("%s",curpsinfo->pr_psargs)}'
dtrace: description 'syscall::exec*: ' matched 2 probes
CPU ID FUNCTION:NAME
0 17765 execve:entry bash
0 17766 execve:return emacs
1 17765 execve:entry emacs
1 17766 execve:return emacs-i386
1 17765 execve:entry emacs-i386
1 17766 execve:return perl
All of those calls had arguments. For giggles, try trace() instead of prinf()
$ sudo dtrace -n 'syscall::exec*: {trace(curpsinfo->pr_psargs)}'
dtrace: description 'syscall::exec*: ' matched 2 probes
CPU ID FUNCTION:NAME
1 17765 execve:entry
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
0: 65 6d 61 63 73 00 61 6c 00 73 6b 00 00 00 00 00 emacs.al.sk.....
10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
30: 00 00 00 00 00 46 04 04 00 00 00 00 01 00 00 00 .....F..........
40: 00 00 00 00 00 00 00 00 00 00 00 00 30 f9 13 07 ............0...
😟 Mac loses?! How do I make it un-lose?
On a Mac, the job of strace is handled by DTrace scripts. I get it. It's awesome. The curpsinfo->pr_psargs char[] is supposed to have the process arguments. Apparently this works in all the Solaris examples. On the mac... not so much:
$ sudo dtrace -n 'syscall::exec*: {printf("%s",curpsinfo->pr_psargs)}'
dtrace: description 'syscall::exec*: ' matched 2 probes
CPU ID FUNCTION:NAME
0 17765 execve:entry bash
0 17766 execve:return emacs
1 17765 execve:entry emacs
1 17766 execve:return emacs-i386
1 17765 execve:entry emacs-i386
1 17766 execve:return perl
All of those calls had arguments. For giggles, try trace() instead of prinf()
$ sudo dtrace -n 'syscall::exec*: {trace(curpsinfo->pr_psargs)}'
dtrace: description 'syscall::exec*: ' matched 2 probes
CPU ID FUNCTION:NAME
1 17765 execve:entry
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
0: 65 6d 61 63 73 00 61 6c 00 73 6b 00 00 00 00 00 emacs.al.sk.....
10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
30: 00 00 00 00 00 46 04 04 00 00 00 00 01 00 00 00 .....F..........
40: 00 00 00 00 00 00 00 00 00 00 00 00 30 f9 13 07 ............0...
😟 Mac loses?! How do I make it un-lose?
Mac, Mac OS X (10.5.6)