void do_tracing_child(Monitor *mon, const QDict *qdict)
{
const char *progname = qdict_get_str(qdict, "name");
const char *filename = qdict_get_str(qdict, "filepath");
/* Set flag for tracing children */
tracing_child = 1;
/* Do not write anything to the trace until child starts */
skip_trace_write = 1;
/* Trace process by name */
do_tracing_by_name_internal(progname, filename);
}
void do_tracing_by_name(Monitor *mon, const QDict *qdict) {
do_tracing_by_name_internal(qdict_get_str(qdict, "name"),
qdict_get_str(qdict, "filepath"));
}
/* Param format
<pid>:<traceFilename>:<pidToSignal>:<processName>
*/
void tracing_after_loadvm(const char*param)
{
char buf[256];
strncpy(buf, param, sizeof(buf) - 1);
buf[255] = '\0';
int pid_to_signal = 0;
char *pid_str = strtok(buf, ":");
if (!pid_str)
return;
char *trace_filename = strtok(0, ":");
if (!trace_filename)
return;
char *pid_to_signal_str = strtok(0, ":");
char *process_name = strtok(0, ":");
char *end = pid_str;
int pid = (int) strtol (pid_str, &end, 10);
if (end == pid_str) {
pid = -1;
}
/* If no PID or Process_name, return */
if ((process_name == NULL) && (pid == -1)) {
monitor_printf(default_mon, "PARAM: %s\n", param);
monitor_printf(default_mon, "START: %p END: %p\n", pid_str, end);
monitor_printf(default_mon, "No PID or Process_name provided\n");
return;
}
if (pid_to_signal_str) {
end = pid_to_signal_str;
pid_to_signal = (int) strtol (pid_to_signal_str, &end, 10);
if (end == pid_to_signal_str) {
pid_to_signal = 0;
}
}
monitor_printf (default_mon,
"PID: %d PID2SIGNAL: %d PROCESS_NAME: %s\n",
pid, pid_to_signal, process_name);
#ifdef TAINT_ENABLED
/* Taint the network */
do_taint_nic_internal(1);
/* Filter traffic (read from ini configuration file) */
print_nic_filter();
#endif // #ifdef TAINT_ENABLED
/* OS dependant initialization */
if (0 == taskaddr)
init_kernel_offsets();
if (0xC0000000 == kernel_mem_start) /* linux */
update_proc(0);
/* Load hooks */
do_load_hooks_internal("","");
/* Start trace */
if (process_name == NULL)
do_tracing_internal(pid, trace_filename);
else
do_tracing_by_name_internal(process_name,trace_filename);
/* Send signal to notify that trace is ready */
//if (pid_to_signal != 0) kill(pid_to_signal,SIGUSR1);
int pipe_fd = open("/tmp/tfd.pipe",O_WRONLY);
size_t num_written = write(pipe_fd,"OK",2);
if (num_written != 2) {
monitor_printf (default_mon, "Error writing to /tmp/tfd.pipe\n");
}
close(pipe_fd);
}
