From 6473db86a30e1fe74f743405ea8b98e5f69101ec Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui@live.cn>
Date: Mon, 17 Jun 2024 14:44:34 +0800
Subject: [PATCH] SunOS: support shell & terminal detection

---
 src/common/processing_linux.c               | 52 ++++++++++++---------
 src/detection/terminalshell/terminalshell.c |  2 +-
 2 files changed, 32 insertions(+), 22 deletions(-)

diff --git a/src/common/processing_linux.c b/src/common/processing_linux.c
index bf4160e3c..c4db9216d 100644
--- a/src/common/processing_linux.c
+++ b/src/common/processing_linux.c
@@ -18,8 +18,10 @@
     #include <sys/user.h>
     #include <sys/sysctl.h>
 #endif
-#if defined(__APPLE__) || defined(__sun)
+#if defined(__APPLE__)
     #include <libproc.h>
+#elif defined(__sun)
+    #include <procfs.h>
 #endif
 
 enum { FF_PIPE_BUFSIZ = 8192 };
@@ -113,15 +115,6 @@ const char* ffProcessAppendOutput(FFstrbuf* buffer, char* const argv[], bool use
     return "read(childPipeFd, str, FF_PIPE_BUFSIZ) failed";
 }
 
-#ifdef __sun
-void freeProcHandle(struct ps_prochandle** phandle)
-{
-    assert(phandle);
-    if (*phandle)
-        Pfree(*phandle);
-}
-#endif
-
 void ffProcessGetInfoLinux(pid_t pid, FFstrbuf* processName, FFstrbuf* exe, const char** exeName, FFstrbuf* exePath)
 {
     assert(processName->length > 0);
@@ -243,6 +236,26 @@ void ffProcessGetInfoLinux(pid_t pid, FFstrbuf* processName, FFstrbuf* exe, cons
         ffStrbufSetS(exe, arg0);
     }
 
+    #elif defined(__sun)
+
+    char filePath[PATH_MAX];
+    snprintf(filePath, sizeof(filePath), "/proc/%d/psinfo", (int) pid);
+    psinfo_t proc;
+    if (ffReadFileData(filePath, sizeof(proc), &proc) == sizeof(proc))
+    {
+        ffStrbufSetS(exe, proc.pr_psargs);
+        ffStrbufSubstrBeforeFirstC(exe, ' ');
+    }
+
+    snprintf(filePath, sizeof(filePath), "/proc/%d/path/a.out", (int) pid);
+    ffStrbufEnsureFixedLengthFree(exePath, PATH_MAX);
+    ssize_t length = readlink(filePath, exePath->chars, exePath->allocated - 1);
+    if (length > 0) // doesn't contain trailing NUL
+    {
+        exePath->chars[length] = '\0';
+        exePath->length = (uint32_t) length;
+    }
+
     #endif
 
     if(exe->length == 0)
@@ -345,20 +358,17 @@ const char* ffProcessGetBasicInfoLinux(pid_t pid, FFstrbuf* name, pid_t* ppid, i
     }
 
     #elif defined(__sun)
-    int err;
-    __attribute__((__cleanup__(freeProcHandle))) struct ps_prochandle* handle = Pgrab(pid, PGRAB_RDONLY, &err);
-    if (!handle)
-        return "Pgrab() failed";
+    char path[128];
+    snprintf(path, sizeof(path), "/proc/%d/psinfo", (int) pid);
+    psinfo_t proc;
+    if (ffReadFileData(path, sizeof(proc), &proc) != sizeof(proc))
+        return "ffReadFileData(psinfo) failed";
 
-    const psinfo_t* proc = Ppsinfo(handle);
-    if (!proc)
-        return "Ppsinfo() failed";
-
-    ffStrbufSetS(name, proc->pr_fname);
+    ffStrbufSetS(name, proc.pr_fname);
     if (ppid)
-        *ppid = proc->pr_ppid;
+        *ppid = proc.pr_ppid;
     if (tty)
-        *tty = (int) proc->pr_ttydev;
+        *tty = (int) proc.pr_ttydev;
 
     #else
 
diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c
index a4fd97783..7766790c2 100644
--- a/src/detection/terminalshell/terminalshell.c
+++ b/src/detection/terminalshell/terminalshell.c
@@ -553,7 +553,7 @@ bool fftsGetTerminalVersion(FFstrbuf* processName, FF_MAYBE_UNUSED FFstrbuf* exe
 
     #endif
 
-    #if defined(__linux__) || defined(__FreeBSD__)
+    #if defined(__linux__) || defined(__FreeBSD__) || defined(__sun)
 
     if(ffStrbufStartsWithIgnCaseS(processName, "gnome-terminal"))
         return getTerminalVersionGnome(version);