File Manager

003 File Manager

Current Path: /usr/libexec/dwatch

📁 ..
📄 chmod(1.65 KB)
📄 errno(1.22 KB)
📄 fchmodat(1.65 KB)
📄 io(3.09 KB)
📄 io-done(3.09 KB)
📄 io-start(3.09 KB)
📄 ip(1.76 KB)
📄 ip-receive(1.76 KB)
📄 ip-send(1.76 KB)
📄 kill(1.19 KB)
📄 lchmod(1.65 KB)
📄 nanosleep(1.44 KB)
📄 open(1.48 KB)
📄 openat(1.48 KB)
📄 proc(3.88 KB)
📄 proc-create(3.88 KB)
📄 proc-exec(3.88 KB)
📄 proc-exec-failure(3.88 KB)
📄 proc-exec-success(3.88 KB)
📄 proc-exit(3.88 KB)
📄 proc-signal(3.88 KB)
📄 proc-signal-clear(3.88 KB)
📄 proc-signal-discard(3.88 KB)
📄 proc-signal-send(3.88 KB)
📄 proc-status(3.88 KB)
📄 read(1.8 KB)
📄 recv(6.32 KB)
📄 recvfrom(6.32 KB)
📄 recvmsg(6.32 KB)
📄 rw(1.8 KB)
📄 sched(2.9 KB)
📄 sched-change-pri(2.9 KB)
📄 sched-cpu(2.9 KB)
📄 sched-dequeue(2.9 KB)
📄 sched-enqueue(2.9 KB)
📄 sched-exec(2.9 KB)
📄 sched-lend-pri(2.9 KB)
📄 sched-load-change(2.9 KB)
📄 sched-off-cpu(2.9 KB)
📄 sched-on-cpu(2.9 KB)
📄 sched-preempt(2.9 KB)
📄 sched-pri(2.9 KB)
📄 sched-queue(2.9 KB)
📄 sched-remain-cpu(2.9 KB)
📄 sched-sleep(2.9 KB)
📄 sched-surrender(2.9 KB)
📄 sched-tick(2.9 KB)
📄 sched-wakeup(2.9 KB)
📄 send(6.32 KB)
📄 sendmsg(6.32 KB)
📄 sendrecv(6.32 KB)
📄 sendto(6.32 KB)
📄 systop(2.22 KB)
📄 tcp(5.37 KB)
📄 tcp-accept(5.37 KB)
📄 tcp-accept-established(5.37 KB)
📄 tcp-accept-refused(5.37 KB)
📄 tcp-connect(5.37 KB)
📄 tcp-connect-established(5.37 KB)
📄 tcp-connect-refused(5.37 KB)
📄 tcp-connect-request(5.37 KB)
📄 tcp-established(5.37 KB)
📄 tcp-init(5.37 KB)
📄 tcp-io(5.37 KB)
📄 tcp-receive(5.37 KB)
📄 tcp-refused(5.37 KB)
📄 tcp-send(5.37 KB)
📄 tcp-state-change(5.37 KB)
📄 tcp-status(5.37 KB)
📄 udp(2.29 KB)
📄 udp-receive(2.29 KB)
📄 udp-send(2.29 KB)
📄 udplite(2.35 KB)
📄 udplite-receive(2.35 KB)
📄 udplite-send(2.35 KB)
📄 vop_create(4.96 KB)
📄 vop_lookup(4.96 KB)
📄 vop_mkdir(4.96 KB)
📄 vop_mknod(4.96 KB)
📄 vop_readdir(4.71 KB)
📄 vop_remove(4.96 KB)
📄 vop_rename(8.11 KB)
📄 vop_rmdir(4.96 KB)
📄 vop_symlink(5.04 KB)
📄 write(1.8 KB)

Editing: recvfrom

# -*- tab-width: 4 -*- ;; Emacs
# vi: set filetype=sh tabstop=8 shiftwidth=8 noexpandtab :: Vi/ViM
############################################################ IDENT(1)
#
# $Title: dwatch(8) module for send(2)/recv(2) $
# $Copyright: 2014-2018 Devin Teske. All rights reserved. $
# $FreeBSD$
#
############################################################ DESCRIPTION
#
# Print details from send(2)/recv(2)
#
############################################################ PROBE

case "$PROFILE" in
sendrecv)
	: ${PROBE:=$( echo \
		syscall::recvfrom:return, \
		syscall::recvmsg:return, \
		syscall::sendmsg:entry, \
		syscall::sendto:entry )} ;;
send)
	: ${PROBE:=$( echo \
		syscall::sendmsg:entry, \
		syscall::sendto:entry )} ;;
recv)
	: ${PROBE:=$( echo \
		syscall::recvfrom:return, \
		syscall::recvmsg:return )} ;;
recv*)
	: ${PROBE:=syscall::$PROFILE:return} ;;
*)
	: ${PROBE:=syscall::$PROFILE:entry}
esac

############################################################ EVENT ACTION

#[ "$CUSTOM_TEST" ] || EVENT_TEST="this->from != NULL"

############################################################ ACTIONS

exec 9<<EOF
typedef struct sainfo {
	sa_family_t sa_family;
	uint16_t port;
	string addr;
	string family;
} sainfo_t;

/*
 * Address families from <sys/socket.h>
 */
#pragma D binding "1.13" address_family_string
inline string address_family_string[sa_family_t af] =
	af == AF_UNSPEC ?		"AF_UNSPEC" :
	af == AF_LOCAL ?		"AF_UNIX" :
	af == AF_UNIX ?			"AF_UNIX" :
	af == AF_INET ?			"AF_INET" :
	af == AF_IMPLINK ?		"AF_IMPLINK" :
	af == AF_PUP ?			"AF_PUP" :
	af == AF_CHAOS ?		"AF_CHAOS" :
	af == AF_NETBIOS ?		"AF_NETBIOS" :
	af == AF_ISO ?			"AF_ISO" :
	af == AF_OSI ?			"AF_ISO" :
	af == AF_ECMA ?			"AF_ECMA" :
	af == AF_DATAKIT ?		"AF_DATAKIT" :
	af == AF_CCITT ?		"AF_CCITT" :
	af == AF_SNA ?			"AF_SNA" :
	af == AF_DECnet ?		"AF_DECnet" :
	af == AF_DLI ?			"AF_DLI" :
	af == AF_LAT ?			"AF_LAT" :
	af == AF_HYLINK ?		"AF_HYLINK" :
	af == AF_APPLETALK ?		"AF_APPLETALK" :
	af == AF_ROUTE ?		"AF_ROUTE" :
	af == AF_LINK ?			"AF_LINK" :
	af == pseudo_AF_XTP ?		"pseudo_AF_XTP" :
	af == AF_COIP ?			"AF_COIP" :
	af == AF_CNT ?			"AF_CNT" :
	af == pseudo_AF_RTIP ?		"pseudo_AF_RTIP" :
	af == AF_IPX ?			"AF_IPX" :
	af == AF_SIP ?			"AF_SIP" :
	af == pseudo_AF_PIP ?		"pseudo_AF_PIP" :
	af == AF_ISDN ?			"AF_ISDN" :
	af == AF_E164 ?			"AF_ISDN" :
	af == pseudo_AF_KEY ?		"pseudo_AF_KEY" :
	af == AF_INET6 ?		"AF_INET6" :
	af == AF_NATM ?			"AF_NATM" :
	af == AF_ATM ?			"AF_ATM" :
	af == pseudo_AF_HDRCMPLT ?	"pseudo_AF_HDRCMPLT" :
	af == AF_NETGRAPH ?		"AF_NETGRAPH" :
	af == AF_SLOW ?			"AF_SLOW" :
	af == AF_SCLUSTER ?		"AF_SCLUSTER" :
	af == AF_ARP ?			"AF_ARP" :
	af == AF_BLUETOOTH ?		"AF_BLUETOOTH" :
	af == AF_IEEE80211 ?		"AF_IEEE80211" :
	af == AF_INET_SDP ?		"AF_INET_SDP" :
	af == AF_INET6_SDP ?		"AF_INET6_SDP" :
	af == AF_MAX ?			"AF_MAX" :
	strjoin("AF_UNKNOWN(", strjoin(lltostr(af), ")"));

#pragma D binding "1.13" sa_data_size
inline int sa_data_size = 14;
#pragma D binding "1.13" sa_dummy_data
inline char *sa_dummy_data = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0";

#pragma D binding "1.13" sa_data_addr
inline string sa_data_addr[sa_family_t af, char data[sa_data_size]] =
	af == AF_INET ? strjoin(
		strjoin(strjoin(lltostr(data[2] & 0xFF), "."),
			strjoin(lltostr(data[3] & 0xFF), ".")
		),
		strjoin(strjoin(lltostr(data[4] & 0xFF), "."),
			lltostr(data[5] & 0xFF))
	) :
	"";

#pragma D binding "1.13" sa_data_port
inline uint16_t sa_data_port[sa_family_t af, char data[sa_data_size]] =
	af == AF_INET ? (data[0] << 8) + data[1] :
	0;

#pragma D binding "1.13" translator
translator sainfo_t < struct sockaddr *SA > {
	sa_family =	SA == NULL ? 0 : SA->sa_family;
	family =	address_family_string[SA == NULL ? 0 : SA->sa_family];
	addr =		SA == NULL ?
	    sa_data_addr[0, sa_dummy_data] :
	    sa_data_addr[SA->sa_family, SA->sa_data];
	port =		SA == NULL ?
	    sa_data_port[0, sa_dummy_data] :
	    sa_data_port[SA->sa_family, SA->sa_data];
};

this sainfo_t		sainfo;
this ssize_t		nbytes;
this string		details;
this string		flow;
this struct msghdr *	msghdr;
this struct sockaddr *	sa;

inline string probeflow[string func] =
	func == "recvfrom" ?	"<-" :
	func == "recvmsg" ?	"<-" :
	func == "recvmmsg" ?	"<-" :
	"->";

inline string af_details[sa_family_t af, string addr, uint16_t port] =
	af == AF_INET ? strjoin(addr, strjoin(":", lltostr(port))) :
	"";

$PROBE /* probe ID $ID */
{${TRACE:+
	printf("<$ID>");}
	this->details = "";
	this->flow = probeflow[probefunc];
}

syscall::recvfrom:entry /* probe ID $(( $ID + 1 )) */
{${TRACE:+
	printf("<$(( $ID + 1 ))>");}
	this->sainfo = xlate <sainfo_t> ((struct sockaddr *)(args[4] == NULL ?
		NULL : copyin(arg4, sizeof(struct sockaddr))));
}

syscall::recvfrom:return /* probe ID $(( $ID + 2 )) */
{${TRACE:+
	printf("<$(( $ID + 2 ))>");}
	this->nbytes = arg0;
	this->details = strjoin("from ", strjoin(
		strjoin(this->sainfo.family, " "),
		af_details[this->sainfo.sa_family,
			this->sainfo.addr, this->sainfo.port]));
}

syscall::recvmsg:entry /* probe ID $(( $ID + 3 )) */
{${TRACE:+
	printf("<$(( $ID + 3 ))>");}
	this->sockaddr = (struct sockaddr *)arg1;
}

syscall::recvmsg:return /this->sockaddr != NULL/ /* probe ID $(( $ID + 4 )) */
{${TRACE:+
	printf("<$(( $ID + 4 ))>");}
	this->nbytes = arg0;
	this->sainfo = xlate <sainfo_t> ((struct sockaddr *)this->sockaddr);
	this->details = strjoin("sainfo=[", "]");
}

syscall::sendmsg:entry /* probe ID $(( $ID + 5 )) */
{${TRACE:+
	printf("<$(( $ID + 5 ))>");}
	this->nbytes = arg2;
}

syscall::sendto:entry /* probe ID $(( $ID + 6 )) */
{${TRACE:+
	printf("<$(( $ID + 6 ))>");}
	this->nbytes = arg2;
	this->sainfo = xlate <sainfo_t> ((struct sockaddr *)(arg4 == NULL ?
		NULL : copyin(arg4, sizeof(struct sockaddr))));
	this->details = strjoin("to ", strjoin(
		strjoin(this->sainfo.family, " "),
		af_details[this->sainfo.sa_family,
			this->sainfo.addr, this->sainfo.port]));
}
EOF
ACTIONS=$( cat <&9 )
ID=$(( $ID + 7 ))

############################################################ EVENT DETAILS

if [ ! "$CUSTOM_DETAILS" ]; then
exec 9<<EOF
	/*
	 * Print socket details
	 */
	printf("%s %d byte%s%s%s",
		this->flow,
		this->nbytes,
		this->nbytes != 1 ? "s" : "",
		this->details != "" ? " " : "",
		this->details);
EOF
EVENT_DETAILS=$( cat <&9 )
fi

################################################################################
# END
################################################################################

003 File Manager

Editing: recvfrom

Upload File

Create Folder