cybersecurity · intermediate · ~15 min · safe pentest lab

Parse a labelled /proc field

Generalise the find-label-then-number recipe.

Challenge

Read a numeric field from /proc/<pid>/status-style text by its label — a reusable recipe for forensic process inspection.

Task

Implement long proc_field(const char *status, const char *label) that finds label in status, skips the whitespace after it, and returns the integer that follows. Return -1 if label is not present. label includes its trailing colon, e.g. "PPid:".

Input

  • status: a fixed /proc/<pid>/status-style text the grader provides (labels separated from values by a tab or spaces).
  • label: the field label to look up, including its colon.

Output

Returns the integer following label, or -1 if the label is absent.

Example

status = "Pid:\t42\nPPid:\t1\nUid:\t1000\n"
proc_field(status, "PPid:")   ->   1
proc_field(status, "Uid:")    ->   1000
proc_field(status, "Gid:")    ->   -1   (absent)

Edge cases

  • Label not found: return -1.
  • There may be a tab or spaces between the label and its value.

Input format

A fixed /proc-status text and a label including its trailing colon.

Output format

The integer following label, or -1 if absent.

Constraints

Find the label, skip whitespace, parse the number.

Starter code

#include <string.h>
#include <stdlib.h>

long proc_field(const char *status, const char *label) {
    /* TODO */
    return -1;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.