From 8aeb7c2f103aa4147602b9a4c0bbbb1d5ec2de15 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= Date: Tue, 2 Jun 2026 17:44:55 +0800 Subject: [PATCH] Shell (Linux): improves performance of busybox (ash) version detection --- src/detection/terminalshell/terminalshell.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c index d51bc465f..e4b83f37a 100644 --- a/src/detection/terminalshell/terminalshell.c +++ b/src/detection/terminalshell/terminalshell.c @@ -168,7 +168,18 @@ static bool getShellVersionNushell(FFstrbuf* exe, FFstrbuf* version) { return getExeVersionRaw(exe, version); // 0.73.0 } +static bool extractBusyboxVersion(const char* line, uint32_t len, void* userdata) { + if (!ffStrStartsWith(line, "BusyBox v")) { + return true; + } + + ffStrbufSetNS((FFstrbuf*) userdata, len - strlen("BusyBox v"), line + strlen("BusyBox v")); + return false; +} + static bool getShellVersionAsh(FFstrbuf* exe, FFstrbuf* version) { + ffBinaryExtractStrings(exe->chars, extractBusyboxVersion, version, (uint32_t) strlen("BusyBox v0.0.0")); + const char* error = ffStrbufEndsWithS(exe, "busybox") ? ffProcessAppendStdErr(version, (char* const[]) { exe->chars, "ash", "--help", NULL }) : ffProcessAppendStdErr(version, (char* const[]) { exe->chars, "--help", NULL });