Bpftrace: A way to print arbitrary binary data safely?

[shish]

I want to see a sample of the data that's being written to disk, but I don't want to accidentally print some binary junk and kill my terminal with unintended ANSI control characters. I'd love some kind of formatting option like Python's %r where non-text bytes are replaced with \xNN escape codes :)

$ python -c 'print("%r" % open("/dev/urandom").read(16))'
'GtlR\xb2\x03n\x18\xda)\xe9#\x85"\xca\xda'

[danobi]

Sounds pretty reasonable to me.

[florianl]

same for tracepoints like sys_enter_sendto, where there is a void * buff. It would be nice, to print the content of buff.

[mmisono]

It's hacky but it is possible to write

tracepoint:syscalls:sys_enter_sendto {
  $len = args->len;
  $p = args->buff;
  $i = (uint64)0;
  unroll(20) {
    if ($i < $len) {
      $c = *(uint8*)$p;
      if ($c >= 32 && $c <= 126) {
        printf("%c", $c);
      } else {
        printf("\\x%02x", $c);
      }
    }
    $p += 1;
    $i += 1;
  }
  printf("\n");
}

% sudo ./src/bpftrace sendto.bt -c "ping 8.8.8.8 -c1"
Attaching 1 probe...
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
\x08\x00\xba/O\xf6\x00\x01+n\x01^\x00\x00\x00\x00\x01:\x01\x00
64 bytes from 8.8.8.8: icmp_seq=1 ttl=63 time=13.3 ms

If printf() supports %r, then we can write bpftrace -e 'tracepoint:syscalls:sys_enter_sendto { printf("%r\n", str(args->buff, args->len)); }'

[florianl]

thanks for the great hint @mmisono

[acj]

I need this too and will work on implementing it in printf