peek_proc_reader/
current.rs

1// Live kernel state: current syscall. Plan: small helpers returning Option.
2
3use std::fs;
4use std::path::Path;
5
6/// Reads the current syscall from `/proc/<pid>/syscall`.
7/// Format: "syscall_num arg1 arg2 arg3 arg4 arg5 arg6" (hex args on some kernels).
8/// Returns (syscall_number, args). Returns `None` if unreadable or not in a syscall.
9#[cfg(target_os = "linux")]
10pub fn read_syscall(pid: i32) -> Option<(u64, [u64; 6])> {
11    let path = Path::new("/proc").join(pid.to_string()).join("syscall");
12    let s = fs::read_to_string(&path).ok()?;
13    let s = s.trim_end();
14    // First field is syscall number, then up to 6 args (hex or decimal).
15    let mut parts = s.split_whitespace();
16    let num: u64 = parts.next()?.parse().ok()?;
17    let mut args = [0u64; 6];
18    for (i, a) in parts.take(6).enumerate() {
19        let v = a
20            .strip_prefix("0x")
21            .and_then(|h| u64::from_str_radix(h, 16).ok())
22            .or_else(|| a.parse().ok())?;
23        args[i] = v;
24    }
25    Some((num, args))
26}
27
28#[cfg(not(target_os = "linux"))]
29pub fn read_syscall(_pid: i32) -> Option<(u64, [u64; 6])> {
30    None
31}
peek_proc_reader/current.rs

peek_proc_reader/
current.rs
