Hi All,
I am Implementing my own lsof on Mac10.3.0 to get the list
of open files for process ( i.e. file descriptors, file name). Below is the
code snippet describing the problem.
int kread(u_long addr, char *buf,int len);
void process_file(u_long fp);
int main()
{
struct proc kp;
struct filedesc fd;
struct file fl;
struct file **ofb = NULL;
int iNumberofFiles = 0;
int iBlockSize = 0 ;
kd = kvm_open(NULL,
"/dev/mem", NULL, O_RDONLY, NULL);
if (kd == NULL)
{
printf("Error
occured \n");
}
kip = kvm_getprocs(kd, KERN_PROC_ALL, 0,
&cnt);
if (kip == NULL)
{
printf("Error
occured during proc read\n");
}
printf("Count of proc structures are
%d\n",cnt);
for (int i = 0; i < cnt; i++)
{
//Reading proc structure
kread((u_long)kip[i].kp_eproc.e_paddr, (char *)&kp, sizeof(kp));
printf("Process Identifier is %d \t
%s\n",kp.p_pid,kp.p_comm,kp.p_cpticks);
// reading filedesc structure
kread((u_long)kp.p_fd, (char *)&fd, sizeof(fd));
printf("Total number of files are %d\n",fd.fd_nfiles);
iNumberofFiles =
fd.fd_nfiles ;
iBlockSize =
sizeof(struct file *) * iNumberofFiles;
ofb = (struct
file **)malloc(iBlockSize);
// reading the list of file
structures
if(kread((u_long)fd.fd_ofiles, (char *)ofb, iBlockSize))
printf("ERROR\n");
for(int i = 0; i
< iNumberofFiles ; i++)
{
process_file((u_long)ofb[i]);
}
}
return 0 ;
}
void process_file(u_long fp)
{
struct file fl; //
Why I am not allowed to
use instance of struct file?
int flag;
if
(kread((u_long)fp, (char *)&fl, sizeof(fl)))
{
printf("Error in reading the internal file structure");
}
}
This time I can read struct proc, struct filedesc using
kread() which in turn uses kvm_read() to access the kernel virtual memory, but
when I am declaring struct file fl in method process_file() to read individual
file structures, I am getting compilation error “error: aggregate `file fl' has incomplete type and
cannot be defined”. Unlike struct proc and struct filedesc I
am not able to kread the file structure, which is not private on Mac10.3.
lsof uses the structures successfully , then why it is
not accessible to my programme.
Is there is any special privilege required to do the
same ? Please help !
Thanks,
Manish