diff --git a/examples/execve5.py b/examples/execve5.py index fe34491..1a7f6aa 100644 --- a/examples/execve5.py +++ b/examples/execve5.py @@ -27,6 +27,7 @@ def hello(ctx: c_void_p) -> c_int32: dataobj.pid = process_id dataobj.ts = ts print(f"clone called at {ts} by pid {process_id}") + events.output(dataobj) return c_int32(0) diff --git a/pythonbpf/bpf_helper_handler.py b/pythonbpf/bpf_helper_handler.py index 471cc36..462e5c0 100644 --- a/pythonbpf/bpf_helper_handler.py +++ b/pythonbpf/bpf_helper_handler.py @@ -340,6 +340,10 @@ def bpf_get_current_pid_tgid_emitter(call, map_ptr, module, builder, func, local return pid +def bpf_perf_event_output_handler(call, map_ptr, module, builder, local_sym_tab=None): + pass + + helper_func_list = { "lookup": bpf_map_lookup_elem_emitter, "print": bpf_printk_emitter, @@ -347,6 +351,7 @@ helper_func_list = { "update": bpf_map_update_elem_emitter, "delete": bpf_map_delete_elem_emitter, "pid": bpf_get_current_pid_tgid_emitter, + "output": bpf_perf_event_output_handler, } diff --git a/pythonbpf/maps.py b/pythonbpf/maps.py index 25bc360..24b421c 100644 --- a/pythonbpf/maps.py +++ b/pythonbpf/maps.py @@ -30,3 +30,6 @@ class PerfEventArray: self.key_type = key_size self.value_type = value_size self.entries = {} + + def output(self, data): + pass # Placeholder for output method