1 #!/usr/sbin/dtrace -s 2 /* 3 * whatexec.d - Examine the type of files exec'd. 4 * Written using DTrace (Solaris 10 3/05) 5 * 6 * This prints the first four chacacters of files that are executed. 7 * This traces the kernel function findexec_by_hdr(), which checks for 8 * a known magic number in the file's header. 9 * 10 * The idea came from a demo I heard about from the UK, where a 11 * "blue screen of death" was displayed for "MZ" files (although I 12 * haven't seen the script or the demo). 13 * 14 * $Id: whatexec.d,v 1.1.1.1 2015/09/30 22:01:09 christos Exp $ 15 * 16 * USAGE: whatexec.d (early release, check for updates) 17 * 18 * FIELDS: 19 * PEXEC parent command name 20 * EXEC pathname to file exec'd 21 * OK is type runnable, Y/N 22 * TYPE first four characters from file 23 * 24 * COPYRIGHT: Copyright (c) 2006 Brendan Gregg. 25 * 26 * CDDL HEADER START 27 * 28 * The contents of this file are subject to the terms of the 29 * Common Development and Distribution License, Version 1.0 only 30 * (the "License"). You may not use this file except in compliance 31 * with the License. 32 * 33 * You can obtain a copy of the license at Docs/cddl1.txt 34 * or http://www.opensolaris.org/os/licensing. 35 * See the License for the specific language governing permissions 36 * and limitations under the License. 37 * 38 * CDDL HEADER END 39 * 40 * 11-Feb-2006 Brendan Gregg Created this. 41 * 25-Apr-2006 " " Last update. 42 */ 43 44 #pragma D option quiet 45 46 this char *buf; 47 48 dtrace:::BEGIN 49 { 50 printf("%-16s %-38s %2s %s\n", "PEXEC", "EXEC", "OK", "TYPE"); 51 } 52 53 fbt::gexec:entry 54 { 55 self->file = cleanpath((*(struct vnode **)arg0)->v_path); 56 self->ok = 1; 57 } 58 59 fbt::findexec_by_hdr:entry 60 /self->ok/ 61 { 62 bcopy(args[0], this->buf = alloca(5), 4); 63 this->buf[4] = '\0'; 64 self->hdr = stringof(this->buf); 65 } 66 67 fbt::findexec_by_hdr:return 68 /self->ok/ 69 { 70 printf("%-16s %-38s %2s %S\n", execname, self->file, 71 arg1 == NULL ? "N" : "Y", self->hdr); 72 self->hdr = 0; 73 } 74 75 fbt::gexec:return 76 { 77 self->file = 0; 78 self->ok = 0; 79 } 80