I ran dtruss
on a process that launches another one: the League of Legends Launcher starts the main game process with certain arguments that I can't seem to pass via the command line.
What caught my attention was this line of dtruss output:
PID/THRD RELATIVE ELAPSD CPU SYSCALL(args) = return
9386/0x47dac: 19625 3013 1805 posix_spawn(0x2A634FC, 0x38A2A00, 0xB06A56E0) = 0 0
I looked up the man page for posix_spawn
, and it is supposed to accept 6 arguments. They are, in order, PID
, /path/to/file
, file_actions
, aatrp
, argv
and envp
.
I was stepping through GDB at the same time as running dtruss
, so I was able to inspect the memory in question.
- The first argument pointed to 0x000024d2, which was in the PID.
- The second argument pointed to a char array: the executable path for LeagueofLegends
- The third argument always points to the same thing, of which the unintelligible string representation is
\026l<?
I don't know what to make of this. Ultimately I want to be able to launch this process myself via C, with my custom arguments, but I think the first step to do that is to understand how it's called by the system, and what that third argument is.
My questions are: what more can I do to find out what that third argument is (?) and is what I'm trying to do (circumventing the launcher) even possible?
It is possible directly on the Windows command-line via,
@start "" "League of Legends.exe" "8394" "LoLLauncher.exe" "" "spectator fspectate.op.gg:4081 tjJbtRLQ/HMV7HuAxWV0XsXoRB4OmFBr 1391881421 NA1"
but on Mac this just relaunches the launcher.
For context, I've already written up a lengthy (and unanswered) question describing everything I've done.
Please let me know how I can improve this question. I've spent over 50 hours trying to figure this out on my own, brute forcing through dtruss output, and I'm just about ready to give up.