1N/A#!/usr/sbin/dtrace -s
1N/A/*
1N/A * whatexec.d - Examine the type of files exec'd.
1N/A * Written using DTrace (Solaris 10 3/05)
1N/A *
1N/A * This prints the first four chacacters of files that are executed.
1N/A * This traces the kernel function findexec_by_hdr(), which checks for
1N/A * a known magic number in the file's header.
1N/A *
1N/A * The idea came from a demo I heard about from the UK, where a
1N/A * "blue screen of death" was displayed for "MZ" files (although I
1N/A * haven't seen the script or the demo).
1N/A *
1N/A * $Id: whatexec.d 3 2007-08-01 10:50:08Z brendan $
1N/A *
1N/A * USAGE: whatexec.d (early release, check for updates)
1N/A *
1N/A * FIELDS:
1N/A * PEXEC parent command name
1N/A * EXEC pathname to file exec'd
1N/A * OK is type runnable, Y/N
1N/A * TYPE first four characters from file
1N/A *
1N/A * COPYRIGHT: Copyright (c) 2006 Brendan Gregg.
1N/A *
1N/A * CDDL HEADER START
1N/A *
1N/A * The contents of this file are subject to the terms of the
1N/A * Common Development and Distribution License, Version 1.0 only
1N/A * (the "License"). You may not use this file except in compliance
1N/A * with the License.
1N/A *
1N/A * You can obtain a copy of the license at Docs/cddl1.txt
1N/A * or http://www.opensolaris.org/os/licensing.
1N/A * See the License for the specific language governing permissions
1N/A * and limitations under the License.
1N/A *
1N/A * CDDL HEADER END
1N/A *
1N/A * 11-Feb-2006 Brendan Gregg Created this.
1N/A * 25-Apr-2006 " " Last update.
1N/A */
1N/A
1N/A#pragma D option quiet
1N/A
1N/Athis char *buf;
1N/A
1N/Adtrace:::BEGIN
1N/A{
1N/A printf("%-16s %-38s %2s %s\n", "PEXEC", "EXEC", "OK", "TYPE");
1N/A}
1N/A
1N/Afbt::gexec:entry
1N/A{
1N/A self->file = cleanpath((*(struct vnode **)arg0)->v_path);
1N/A self->ok = 1;
1N/A}
1N/A
1N/Afbt::findexec_by_hdr:entry
1N/A/self->ok/
1N/A{
1N/A bcopy(args[0], this->buf = alloca(5), 4);
1N/A this->buf[4] = '\0';
1N/A self->hdr = stringof(this->buf);
1N/A}
1N/A
1N/Afbt::findexec_by_hdr:return
1N/A/self->ok/
1N/A{
1N/A printf("%-16s %-38s %2s %S\n", execname, self->file,
1N/A arg1 == NULL ? "N" : "Y", self->hdr);
1N/A self->hdr = 0;
1N/A}
1N/A
1N/Afbt::gexec:return
1N/A{
1N/A self->file = 0;
1N/A self->ok = 0;
1N/A}