appscope icon indicating copy to clipboard operation
appscope copied to clipboard

Improvement: sync files and sockets on attach

Open jrcheli opened this issue 2 years ago • 0 comments

When we inject into a process, we'll start observing all files and sockets that are opened after our library has been loaded. So at the current time, it's a reason that injection is not as good as being preloaded from the moment a process has started. Saying the same thing another way... after injection, our library isn't currently aware of files and sockets that were opened before we were injected.

If we end up doing more injection, (cough #1027) I think we should improve this. How? I'm not picky, but one way would be to wade through /proc/self/fd and tease out what sockets and files are open, and update the internal g_fsinfo and g_netinfo structures accordingly, perhaps adding network addresses and file names to these g_ structures as appropriate.

jrcheli avatar Aug 10 '22 19:08 jrcheli