Add constant check (maybe broken) and also a globals pass

This commit is contained in:
2025-09-03 18:30:52 +05:30
parent 55b467b337
commit 0ee8b541d1
6 changed files with 134 additions and 6 deletions

View File

@ -1,10 +1,32 @@
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <stdint.h>
int trace_testing(void *ctx)
{
bpf_printk("THISISACONSTANT");
bpf_printk("THISISCONSTANT2");
uint64_t a = 69;
bpf_printk("%d", a);
return 0;
}
SEC("tracepoint/syscalls/sys_enter_execve")
int trace_execve(void *ctx)
{
bpf_printk("execve called\n");
if(ctx){
trace_testing(ctx);
} else {
bpf_printk("THISISANOTHERCONSTANT");
}
bpf_trace_printk("execve called\n", 15);
return 0;
}
SEC("tracepoint/syscalls/sys_exit_execve")
int trace_randomname_exit(void *ctx)
{
bpf_trace_printk("execve called to exit\n", 15);
return 0;
}

2
examples/check.sh Executable file
View File

@ -0,0 +1,2 @@
#!/bin/bash
sudo bpftool prog -d load ./execve.o /sys/fs/bpf/tmp && sudo rm -f /sys/fs/bpf/tmp

View File

@ -1,10 +1,15 @@
from pythonbpf.decorators import tracepoint, syscalls
from ctypes import c_void_p, c_int32
#This is a test function
def test_function():
print("test_function called")
@tracepoint(syscalls.sys_enter_execve)
def trace_execve(ctx: c_void_p) -> c_int32:
print("execve called")
print("execve2 called")
test_function()
return c_int32(0)