Jonas L

I am starting to wonder... can anybody at all do a syscall::NtCreateFile:entry probe in dtrace that print the filename attempted opened without getting "dtrace: processing aborted: Illegal byte sequence" within the first minute. If you can- i would love to see how

if(((struct ustr*)this->fname)->buffer[ ((*this->len)/2)-1 ] < 255 ) { if(((struct ustr*)this->fname)->buffer[ ((*this->len)/2) ] == 0) { printf("%ws", ((struct ustr*) this->fname)->buffer ); } works

You want us to compile this in Visual Studio?

save as .d file, do dtrace -s file.d