From 197d1c6e5d4bdf5d1e4abba462948e014853a5e2 Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui3371@sina.com>
Date: Sun, 25 Oct 2026 00:13:54 +0800
Subject: [PATCH] Uptime (SunOS): improves detection via kstat

---
 CHANGELOG.md                        |  5 ++++
 src/detection/uptime/uptime_sunos.c | 40 +++++++++++++++++++++--------
 src/modules/uptime/uptime.c         |  2 +-
 3 files changed, 35 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 61d12fc3e..1b2aa5c8b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+# Unreleased
+
+Bugfixes:
+* Improved uptime detection on SunOS via kstat. (#2674, Uptime, SunOS)
+
 # 2.70.0
 
 Changes:
diff --git a/src/detection/uptime/uptime_sunos.c b/src/detection/uptime/uptime_sunos.c
index 1e6aa4fd2..b76b33889 100644
--- a/src/detection/uptime/uptime_sunos.c
+++ b/src/detection/uptime/uptime_sunos.c
@@ -1,19 +1,37 @@
 #include "uptime.h"
+#include "common/debug.h"
 #include "common/time.h"
 
-#include <utmpx.h>
+#include <kstat.h>
+
+static inline void kstatFreeWrap(kstat_ctl_t** pkc) {
+    assert(pkc);
+    if (*pkc) {
+        kstat_close(*pkc);
+    }
+}
 
 const char* ffDetectUptime(FFUptimeResult* result) {
-    struct utmpx* ut;
-
-    setutxent();
-    while (nullptr != (ut = getutxent())) {
-        if (ut->ut_type == BOOT_TIME) {
-            result->bootTime = (uint64_t) ut->ut_tv.tv_sec * 1000 + (uint64_t) ut->ut_tv.tv_usec / 1000000;
-            result->uptime = ffTimeGetNow() - result->bootTime;
-            break;
-        }
+    [[gnu::cleanup(kstatFreeWrap)]] kstat_ctl_t* kc = kstat_open();
+    if (!kc) {
+        FF_DEBUG("kstat_open() failed");
+        return "kstat_open() failed";
     }
-    endutxent();
+
+    kstat_t* ks = kstat_lookup(kc, "unix", 0, "system_misc");
+    if (!ks || kstat_read(kc, ks, nullptr) < 0) {
+        FF_DEBUG("kstat_lookup(unix:0:system_misc) failed");
+        return "kstat_lookup(unix:0:system_misc) failed";
+    }
+
+    kstat_named_t* bootTime = (kstat_named_t*) kstat_data_lookup(ks, "boot_time");
+    if (!bootTime) {
+        FF_DEBUG("kstat_data_lookup(boot_time) failed");
+        return "kstat_data_lookup(boot_time) failed";
+    }
+
+    result->bootTime = (uint64_t) bootTime->value.ui32 * 1000;
+    result->uptime = ffTimeGetNow() - result->bootTime;
+
     return nullptr;
 }
diff --git a/src/modules/uptime/uptime.c b/src/modules/uptime/uptime.c
index 3a68c4696..2afa44995 100644
--- a/src/modules/uptime/uptime.c
+++ b/src/modules/uptime/uptime.c
@@ -60,7 +60,7 @@ void ffGenerateUptimeJsonConfig(FFUptimeOptions* options, yyjson_mut_doc* doc, y
 }
 
 bool ffGenerateUptimeJsonResult([[maybe_unused]] FFUptimeOptions* options, yyjson_mut_doc* doc, yyjson_mut_val* module) {
-    FFUptimeResult result;
+    FFUptimeResult result = {};
     const char* error = ffDetectUptime(&result);
 
     if (error) {