DynamoRIO / DynamoRIO/dynamorio
add child process creation event
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on April 24, 2012 12:12:46_
monitoring child processes is a common task, yet it's rather a pain to do
manually as you have to not only watch SYS_fork but also SYS_clone w/o
CLONE_VM, which requires saving syscall params and thus setting up CLS
storage. on windows, drmgr_decode_sysnum_from_wrapper() helps with
obtaining syscall numbers, but 3 different syscalls have to be watched, and
how would a typical developer know that? the upcoming syscall framework
will help with syscall args but won't help w/ knowing which syscalls do what.
the event should provide the pid of the child. on linux this is easy to
get, but on windows I had to add a new API routine
dr_convert_handle_to_pid() ( issue #749 ) to retrieve this w/o rolling my own
query syscall.
_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=752_
Contributor guide
Assessment
This issue has not been assessed yet.