2 files changed, 32 insertions, 26 deletions

diff --git a/listener/basefunc.go b/listener/basefunc.go
index 2f39507..dcaf68a 100644
--- a/listener/basefunc.go
+++ b/listener/basefunc.go
@@ -4,46 +4,52 @@ import (
         "bufio"
         "fmt"
         "os"
-        "os/exec"
         "path/filepath"
+        "regexp"
         "strconv"
         "strings"
         "time"
 )
 
 func figureOutSyscalls() error {
-        cmd := exec.Command("ausyscall", "--dump")
-        stdout, err := cmd.StdoutPipe()
+        var targetFile string
+        err := filepath.Walk("/usr/include", func(path string, info os.FileInfo, err error) error {
+                if err != nil {
+                        return err
+                }
+                if strings.HasSuffix(path, "asm/unistd_64.h") {
+                        targetFile = path
+                        return filepath.SkipDir // 找到后提前退出遍历
+                }
+                return nil
+        })
         if err != nil {
                 return err
         }
 
-        if err := cmd.Start(); err != nil {
+        // 如果没有找到目标文件
+        if targetFile == "" {
+                return fmt.Errorf("file asm/unistd_64.h not found in /usr/include")
+        }
+
+        NRRegex := regexp.MustCompile(`#define __NR_(.*?) (\d+)$`)
+        file, err := os.Open("/usr/include/asm/unistd_64.h")
+        if err != nil {
                 return err
         }
+        defer file.Close()
 
-        scanner := bufio.NewScanner(stdout)
-        for i := 0; scanner.Scan(); i++ {
-                if i == 0 {
-                        continue
-                }
+        scanner := bufio.NewScanner(file)
+        for scanner.Scan() {
                 line := scanner.Text()
-                parts := strings.Split(line, "\t")
-                if len(parts) != 2 {
-                        return fmt.Errorf("invalid ausyscall format")
+                if NRRegex.MatchString(line) {
+                        match := NRRegex.FindStringSubmatch(line)
+                        num, err := strconv.Atoi(match[2])
+                        if err != nil {
+                                return err
+                        }
+                        syscallTable[num] = match[1]
                 }
-                num, err := strconv.Atoi(parts[0])
-                if err != nil {
-                        return err
-                }
-                syscallTable[num] = parts[1]
-        }
-
-        if err := scanner.Err(); err != nil {
-                return err
-        }
-        if err := cmd.Wait(); err != nil {
-                return err
         }
         return nil
 }
diff --git a/listener/godo.go b/listener/godo.go
index 0e1dc73..4f09b67 100644
--- a/listener/godo.go
+++ b/listener/godo.go
@@ -108,11 +108,11 @@ func coroutine(client *libaudit.AuditClient) error {
         wg.Add(1)
         go deal()
         wg.Add(1)
-        go procWatch()
-        wg.Add(1)
         go receive(client)
         wg.Add(1)
         go orgnaze()
+        wg.Add(1)
+        go procWatch()
 
         wg.Wait()
         time.Sleep(2 * time.Second)