From 9c73f6b7879d7b0c4bca7bb3093f47255af9918e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Wed, 26 Oct 2022 19:49:25 +0800
Subject: [PATCH] TerminalShell: support freebsd

---
 .../terminalshell/terminalshell_linux.c       | 27 ++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c
index e04f41f66..5040cede5 100644
--- a/src/detection/terminalshell/terminalshell_linux.c
+++ b/src/detection/terminalshell/terminalshell_linux.c
@@ -13,6 +13,10 @@
 
 #ifdef __APPLE__
     #include <libproc.h>
+#elif defined(__FreeBSD__)
+    #include <sys/types.h>
+    #include <sys/user.h>
+    #include <sys/sysctl.h>
 #endif
 
 static void setExeName(FFstrbuf* exe, const char** exeName)
@@ -47,7 +51,13 @@ static void getProcessInformation(pid_t pid, FFstrbuf* processName, FFstrbuf* ex
 
     #else
 
-    //TODO: support bsd (https://www.freebsd.org/cgi/man.cgi?query=kinfo_getproc)
+    size_t size = exe->allocated;
+    if(!sysctl(
+        (int[]){CTL_KERN, KERN_PROC, KERN_PROC_PATHNAME, pid}, 4,
+       exe->chars, &size,
+        NULL, 0
+    ))
+        exe->length = (uint32_t)size;
 
     #endif
 
@@ -92,8 +102,19 @@ static const char* getProcessNameAndPpid(pid_t pid, char* name, pid_t* ppid)
 
     #else
 
-    //TODO: support bsd (https://www.freebsd.org/cgi/man.cgi?query=kinfo_getproc)
-    error = "unimplemented";
+    struct kinfo_proc proc;
+    size_t size = sizeof(proc);
+    if(sysctl(
+        (int[]){CTL_KERN, KERN_PROC, KERN_PROC_PID, pid}, 4,
+        &proc, &size,
+        NULL, 0
+    ))
+        error = "sysctl(KERN_PROC_PID) failed";
+    else
+    {
+        *ppid = (pid_t)proc.ki_ppid;
+        strncpy(name, proc.ki_comm, COMMLEN);
+    }
 
     #endif