mirror of
https://github.com/varun-r-mallya/Python-BPF.git
synced 2025-12-31 21:06:25 +00:00
Add constant check (maybe broken) and also a globals pass
This commit is contained in:
@ -1,10 +1,32 @@
|
||||
#include <linux/bpf.h>
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include <stdint.h>
|
||||
|
||||
int trace_testing(void *ctx)
|
||||
{
|
||||
bpf_printk("THISISACONSTANT");
|
||||
bpf_printk("THISISCONSTANT2");
|
||||
uint64_t a = 69;
|
||||
bpf_printk("%d", a);
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("tracepoint/syscalls/sys_enter_execve")
|
||||
int trace_execve(void *ctx)
|
||||
{
|
||||
bpf_printk("execve called\n");
|
||||
if(ctx){
|
||||
trace_testing(ctx);
|
||||
} else {
|
||||
bpf_printk("THISISANOTHERCONSTANT");
|
||||
}
|
||||
bpf_trace_printk("execve called\n", 15);
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("tracepoint/syscalls/sys_exit_execve")
|
||||
int trace_randomname_exit(void *ctx)
|
||||
{
|
||||
bpf_trace_printk("execve called to exit\n", 15);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
2
examples/check.sh
Executable file
2
examples/check.sh
Executable file
@ -0,0 +1,2 @@
|
||||
#!/bin/bash
|
||||
sudo bpftool prog -d load ./execve.o /sys/fs/bpf/tmp && sudo rm -f /sys/fs/bpf/tmp
|
||||
@ -1,10 +1,15 @@
|
||||
from pythonbpf.decorators import tracepoint, syscalls
|
||||
from ctypes import c_void_p, c_int32
|
||||
|
||||
#This is a test function
|
||||
def test_function():
|
||||
print("test_function called")
|
||||
|
||||
@tracepoint(syscalls.sys_enter_execve)
|
||||
def trace_execve(ctx: c_void_p) -> c_int32:
|
||||
print("execve called")
|
||||
print("execve2 called")
|
||||
test_function()
|
||||
return c_int32(0)
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user