Skip to content

Instantly share code, notes, and snippets.

/main.c Secret

Created April 29, 2017 15:29
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save anonymous/1f51db98faef0a566a2f8a7a02104ecf to your computer and use it in GitHub Desktop.
Save anonymous/1f51db98faef0a566a2f8a7a02104ecf to your computer and use it in GitHub Desktop.
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void slankdev_test()
{
puts("fuckin");
}
int main()
{
while (1) {
slankdev_test();
sleep(1);
}
}
all:
g++ -static main.c
#!/usr/bin/env python
from bcc import BPF
bpf_program = """
void call(struct pt_regs *ctx) { bpf_trace_printk("call\\n"); }
void ret (struct pt_regs *ctx) { bpf_trace_printk("ret\\n"); }
void pp (void* c) { bpf_trace_printk("puts\\n"); }
"""
trace_pgm_name = "./a.out"
b = BPF(text=bpf_program)
b.attach_uprobe (name=trace_pgm_name, sym="_Z13slankdev_testv", fn_name="call")
b.attach_uretprobe(name=trace_pgm_name, sym="_Z13slankdev_testv", fn_name="ret")
b.attach_uprobe (name=trace_pgm_name, sym="puts" , fn_name="pp")
while True:
print(b.trace_fields())
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment