Well I have patched the Systemcall table, the sendto method, and so I needed a process id to go with the socket decsriptor to get back the socket, but I believe patching the syscall table is not a smart idea. So now I am not concerned with this approach anymore. If I use a nke to intercept network stuff, is it possible that if I dont like where they are trying to access i can just drop the data? Matt On Dec 10, 2003, at 5:56 PM, Justin Walker wrote: On Wednesday, December 10, 2003, at 03:45 PM, Matt Jaffa wrote: I am trying to get the PID of something. All I basically have to work with is a socket file descriptor. say when you do this int so = socket(....,....., ...., ... etc.); you get back the socket file descriptor, now how can i take that number and see which process created it? You really must enjoy poking yourself in the eye with sharp sticks. This is one of many reasons why doing "user-mode things" in "kernel mode" is not A Good Idea. In the first place, there is almost no reasonable way to determine, from a file descriptor, what process "created" it. Even in user-mode, this is indeterminate. For example: scenario 1: parent creates (open/socket/...) a file descriptor parent forks child execs parent exits Now, the creator of the descriptor is long gone, and the code in the child has no idea where the file descriptor came from, or, in general, what it describes. scenario 2: process A gets a file descriptor somehow process A passes this descriptor to process B process A exits process B execs Again, the code left running (the new code in process B) is left "holding the bag", without knowing much about the bag. What are you trying to do? Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | Some people have a mental | horizon of radius zero, and | call it their point of view. | -- David Hilbert *-------------------------------------- *-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.