Skip to content

Instantly share code, notes, and snippets.

@No9
Last active June 22, 2017 18:34
Show Gist options
  • Save No9/7afea71e01eccb07eb958682db0012c0 to your computer and use it in GitHub Desktop.
Save No9/7afea71e01eccb07eb958682db0012c0 to your computer and use it in GitHub Desktop.
@dariocravero
Copy link

dariocravero commented Jun 22, 2017

Syscall Tracing (syscall Provider)

dtrace -qn 'syscall:::entry { printf("%s %s\n", execname, probefunc); }'

read() Sizes (syscall Provider)

dtrace -qn 'syscall::read:return /execname == "sshd"/ { @ = quantize(arg0); }'

Kernel Function Tracing (FBT Provider)

dtrace -n 'fbt::malloc:entry /pid != $pid/ { printf("%s %s\n", execname, arg0); }'

Userland Tracing (pid Provider)

dtrace -qn 'pid$target:libc.so.7::entry { @[probefunc] = count(); }' -c /bin/ls

proc Provider (SDT)

dtrace -n 'proc:::exec-success { printf("%s", curpsinfo->pr_psargs); }'

@No9
Copy link
Author

No9 commented Jun 22, 2017

@No9
Copy link
Author

No9 commented Jun 22, 2017

FInd leaks by monitoring mallocs

@goyox86
Copy link

goyox86 commented Jun 22, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment