add execsnoop in c++

This commit is contained in:
springzfx
2020-05-24 23:21:06 +08:00
parent 0ec9caefe1
commit f501c7e476
15 changed files with 355 additions and 194 deletions

23
tools/execsnoop.cpp Normal file
View File

@@ -0,0 +1,23 @@
#include "execsnoop.hpp"
#include "common.h"
using namespace std;
using namespace CGPROXY::EXESNOOP;
#define PATH_MAX_LEN 128
int handle_pid(int pid) {
char path[PATH_MAX_LEN];
auto size = readlink(to_str("/proc/", pid, "/exe").c_str(), path, PATH_MAX_LEN);
if (size == -1) error("readlink: %s", to_str("/proc/", pid, "/exe").c_str());
path[size] = '\0';
info("%d %s", pid, path);
return 0;
}
int main() {
enable_debug = true;
enable_info = true;
callback = handle_pid;
execsnoop();
return 0;
}