From f091078622635844a07bc6104c9a2ca6c5e6cf31 Mon Sep 17 00:00:00 2001
From: tosu <timo42@proton.me>
Date: Thu, 13 Apr 2023 18:15:31 +0200
Subject: [PATCH] spy on pts's shell script

---
 mon.sh | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100755 mon.sh

diff --git a/mon.sh b/mon.sh
new file mode 100755
index 0000000..23593ca
--- /dev/null
+++ b/mon.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+#Requires sudo, strace and GNU grep
+
+echo "<START>"
+
+sudo strace       \
+  -e trace=write  \
+  -s 1000         \
+  -f              \
+  $(ps u                       |
+    grep pts                   |
+    grep Ss                    |
+    grep -v grep               |
+    awk '{print "-p " $2 " "}' |
+    xargs)        \
+ 2>&1             |
+
+  grep            \
+  --line-buffered \
+  -o '".*[^"]"'   |
+
+  grep            \
+  --line-buffered \
+  -o '[^"]*[^"]'  |
+
+while IFS="" read -r char; do
+  printf '%b' "$char"
+done
+
+echo "<END>"