Skip to content

Instantly share code, notes, and snippets.

@cataphract
Last active April 29, 2022 01:32
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save cataphract/e50a14aede9e02624c3f5aa6602b9893 to your computer and use it in GitHub Desktop.
Save cataphract/e50a14aede9e02624c3f5aa6602b9893 to your computer and use it in GitHub Desktop.
struct link_map {
char _other[8];
char *l_name;
char _other2[776];
unsigned l_direct_opencount;
};
uprobe:/usr/lib/x86_64-linux-gnu/libc.so.6:dlopen {
@enter[tid] = arg0;
}
uretprobe:/usr/lib/x86_64-linux-gnu/libc.so.6:dlopen {
$count = retval == 0 ? 0 : ((struct link_map*)retval)->l_direct_opencount;
printf("[%d:%d] opening %s result %p c_after:%u\n", pid, tid, str(@enter[tid]), retval, $count);
printf("%s", ustack(3))
}
uprobe:/usr/lib/x86_64-linux-gnu/libc.so.6:dlclose {
$lm = (struct link_map*)reg("di");
printf("[%d:%d] closing on %p c_before:%u %s\n", pid, tid, arg0, $lm->l_direct_opencount, str($lm->l_name));
printf("%s", ustack(3))
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment