1#!/usr/sbin/dtrace -s 2/* 3 * whatexec.d - Examine the type of files exec'd. 4 * Written using DTrace (Solaris 10 3/05) 5 * 6 * This prints the first four chacacters of files that are executed. 7 * This traces the kernel function findexec_by_hdr(), which checks for 8 * a known magic number in the file's header. 9 * 10 * The idea came from a demo I heard about from the UK, where a 11 * "blue screen of death" was displayed for "MZ" files (although I 12 * haven't seen the script or the demo). 13 * 14 * $Id: whatexec.d 3 2007-08-01 10:50:08Z brendan $ 15 * 16 * USAGE: whatexec.d (early release, check for updates) 17 * 18 * FIELDS: 19 * PEXEC parent command name 20 * EXEC pathname to file exec'd 21 * OK is type runnable, Y/N 22 * TYPE first four characters from file 23 * 24 * COPYRIGHT: Copyright (c) 2006 Brendan Gregg. 25 * 26 * CDDL HEADER START 27 * 28 * The contents of this file are subject to the terms of the 29 * Common Development and Distribution License, Version 1.0 only 30 * (the "License"). You may not use this file except in compliance 31 * with the License. 32 * 33 * You can obtain a copy of the license at Docs/cddl1.txt 34 * or http://www.opensolaris.org/os/licensing. 35 * See the License for the specific language governing permissions 36 * and limitations under the License. 37 * 38 * CDDL HEADER END 39 * 40 * 11-Feb-2006 Brendan Gregg Created this. 41 * 25-Apr-2006 " " Last update. 42 */ 43 44#pragma D option quiet 45 46this char *buf; 47 48dtrace:::BEGIN 49{ 50 printf("%-16s %-38s %2s %s\n", "PEXEC", "EXEC", "OK", "TYPE"); 51} 52 53fbt::gexec:entry 54{ 55 self->file = cleanpath((*(struct vnode **)arg0)->v_path); 56 self->ok = 1; 57} 58 59fbt::findexec_by_hdr:entry 60/self->ok/ 61{ 62 bcopy(args[0], this->buf = alloca(5), 4); 63 this->buf[4] = '\0'; 64 self->hdr = stringof(this->buf); 65} 66 67fbt::findexec_by_hdr:return 68/self->ok/ 69{ 70 printf("%-16s %-38s %2s %S\n", execname, self->file, 71 arg1 == NULL ? "N" : "Y", self->hdr); 72 self->hdr = 0; 73} 74 75fbt::gexec:return 76{ 77 self->file = 0; 78 self->ok = 0; 79} 80