TracePointContext Question

[skipmcgee]

Hello, I'd love some help if folks have time:
In my project ebpf program I'm using Aya's TracePointContext to parse the syscall sys_enter_execve. I'm trying to access its argv. I know the offset for argv should be 24 from reading the execve description. However im not sure what type to give the read_at call that I could use to iterate over the arguments in argv (if any). Would it be possible to point me in the right direction? Thanks in advance!

Here is the field that im trying to use in the syscall:

cat  /sys/kernel/debug/tracing/events/syscalls/sys_enter_execve/format
...
	field:const char *const * argv;	offset:24;	size:8;	signed:0;
...

Here is an example of my code:

fn try_sys_enter_execve(ctx: TracePointContext) -> Result<u32, i64> {
            let args_ptr = ctx.read_at::<*const T>(24)?;
           //this is where I don't know what type to pass to get argv

            //then later I want to do something like get all the args as a string if existent:
            /*
            // uses buf initialized prior
            let args_bytes = bpf_probe_read_user_str_bytes(args_ptr, &mut *buf)?;
            let args_str = from_utf8_unchecked(args_bytes);
            */
    Ok(0)
}

[skipmcgee]

I think this is solved with something like the below:

        unsafe {
            let args_ptr: *const *const u8 = ctx.read_at::<*const *const u8>(24)?;
            let mut buf = [0u8; 16];

            for i in 0..10 {
                let arg_ptr: *const u8 = bpf_probe_read_user(args_ptr.offset(i as isize))?;
                if arg_ptr.is_null() {
                    break;
                }
                let arg_bytes = bpf_probe_read_user_str_bytes(arg_ptr, &mut buf)?;
                let args_str = from_utf8_unchecked(arg_bytes);
                info!(&ctx, "argv[{}]: {}", i, args_str);
            }
        }

[jpmateo022]

Thank you I know understand how *const *const u8 works