📄 ksyms.d
字号:
/* * When our strings(1) invocation starts a read(2), set a watched flag on * the current thread. When the read(2) finishes, clear the watched flag. */syscall::read:entry/curpsinfo->pr_psargs == "strings -a /dev/ksyms"/{ printf("read %u bytes to user address %x\n", arg2, arg1); self->watched = 1;}syscall::read:return/self->watched/{ self->watched = 0;}/* * Instrument uiomove(9F). The prototype for this function is as follows: * int uiomove(caddr_t addr, size_t nbytes, enum uio_rw rwflag, uio_t *uio); */fbt::uiomove:entry/self->watched/{ this->iov = args[3]->uio_iov; printf("uiomove %u bytes to %p in pid %d\n", this->iov->iov_len, this->iov->iov_base, pid);}
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -