Can ps command show genuine argv[] arguments passed to a process?

This is a subtle problem I find today. The ps command can show command arguments for a process, but I find the feature crippled.

For a shell command line like this:

gdbserver localhost:5050 testg "hello world" 123

We know that gdbserver's main() will see:

However, ps -ef shows

gdbserver localhost:5050 testg hello world 123

So it looks like argv[3] is hello, which is so misleading.

So may question is clear, is there way to have ps show genuine argv[] values? man ps does not seem to refer to this issue. If it can't, any alternative tools?

Here is a screen shot from Ubuntu Linux 20.04.

1 Answer

No, PS can not (I think), but you can get it from proc e.g. /proc/PID/cmdline the cmdline file is a null separated list of the args of a program so this script will parce it

hexdump -v -e '/1 "%02X "' /proc/PID/cmdline | sed 's/00/0a/g' | xxd -r -p

• hexdump -v -e '/1 "%02X "' /proc/PID/cmdline will dump the file as hex each bite has a space in between it.
• sed 's/00/0a/g' replaces the 00 (null) with 0a (line ending or new line)
• xxd -r -p takes the hex and converts it back to binary So the output will be a list of args with a new line in between them.