dtrace-tools/fileinput.d at master · dyjakan/dtrace-tools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
#!/usr/sbin/dtrace -s

/*
http://dyjakan.sigsegv.pl/tracking-input-with-dtrace-on-os-x.html

TODO:
    o Add time stamps and sort via them?
*/

#pragma D option destructive
#pragma D option quiet

BEGIN
{
    trackedfd[0] = 0;
    trackedmmap[0] = 0;
}

pid$target::__open:entry
/copyinstr(arg0) == "/Users/ad/Desktop/test.mp3"/
{
    self->fname = copyinstr(arg0);
    self->openok = 1;
}

pid$target::__open:return
/self->openok/
{
    trackedfd[arg1] = 1;
    printf("Opening %s with fd %#x\n", self->fname, arg1);
    self->fname = 0;
    self->openok = 0;
}

pid$target::read:entry
/trackedfd[arg0] == 1/
{
    self->rfd = arg0;
    self->rbuf = arg1;
    self->rsz = arg2;
}

pid$target::read:return
/self->rfd/
{
    printf("Reading from fd %#p to buf %#p size %#x\n", self->rfd, self->rbuf, self->rsz);
    tracemem(copyin(self->rbuf, arg1), 64);
    ustack(); printf("\n");
    self->rfd = 0;
    self->rbuf = 0;
    self->rsz = 0;
}

pid$target::close:entry
/trackedfd[arg0] == 1/
{
    trackedfd[arg0] = 0;
}