Re: agenda: IO Visor TSC/Dev Meeting
alessandro.gario@...
Hello Song!
toggle quoted messageShow quoted text
I'm using sys_enter_execve/sys_exit_execve and sys_enter_execveat/sys_exit_execveat. Bound loops seem really useful! This is going to solve many of the issues I had. I don't have code I can show, but I'm using LLVM and Clang directly by generating IR. Data is acquired in a similar way to execsnoop (i.e. looping through argv[] looking for the null terminator). The second example is causing me issues as I can only capture a low amount of parameters before I run out of instruction space. Bound loops will certainly help quite a lot in this scenario! Thanks so much for your help! Alessandro Gario
On Tue, 2019-08-06 at 11:17 -0700, Y Song wrote:
On Tue, Aug 6, 2019 at 7:31 AM <alessandro.gario@...> wrote:Hello Brenden!Which tracepoint do you have in mind for your particular use case?
|
|