in auparse/auparse.go [512:537]
func (fm fieldMap) execveArgs() error {
argc, err := fm.find("argc")
if err != nil {
return err
}
count, err := strconv.ParseUint(argc.value, 10, 32)
if err != nil {
return fmt.Errorf("failed to convert argc='%v' to number: %w", argc, err)
}
for i := 0; i < int(count); i++ {
key := "a" + strconv.Itoa(i)
arg, err := fm.find(key)
if err != nil {
return fmt.Errorf("failed to find arg %v", key)
}
if ascii, err := hexToString(arg.orig); err == nil {
fm.setFieldValue(key, ascii)
}
}
return nil
}