You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm trying to dump the content of a sys_write using a chisel. After a bit of research i've found that --snaplen increase the max size for capturing I/O opreration, but even with this i'm capped at 41512. Is there a way of increasing this ?
My chisel looks like this
functionstarts_with(str)
returnstr:sub(1, #elf_magic) ==elf_magicend-- Event parsing callbackfunctionon_event()
ifevt.field(ftype) ==syscallnameandevt.field(fdir) =="<" thenlocalcontent=evt.field(fcontent)
print("------------------------")
print(string.format("size : %d",#content))
print("------------------------")
ifstarts_with(content) ==truethencount=count+1print(string.format("[+]Dumping elf number %d",count))
localfile_name="elf_dump_" ..countlocalfile=io.open(file_name, "w")
iffilethenfile:write(content)
file:close()
elseprint("Failed to open file for writing:", file_name)
endendendreturntrueend
The text was updated successfully, but these errors were encountered:
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
I'm trying to dump the content of a
sys_write
using a chisel. After a bit of research i've found that--snaplen
increase the max size for capturing I/O opreration, but even with this i'm capped at 41512. Is there a way of increasing this ?My chisel looks like this
The text was updated successfully, but these errors were encountered: