Skip to content

Instantly share code, notes, and snippets.

Created August 6, 2018 21:45
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
What would you like to do?
#!/usr/bin/env python
from bcc import BPF
import ctypes as ct
# define BPF program
prog = """
#include <linux/sched.h>
#include <linux/bpf.h>
// define output data structure in C
struct data_t {
u64 key;
char map[16];
struct fd_pid {
u32 fd;
u32 pid;
BPF_HASH(currmap, u32, char*);
#Keep track of fd_pid to map name association
BPF_HASH(mapidfdpid,struct fd_pid,char*);
int kprobe__bpf_map_new_fd(struct pt_regs *ctx, struct bpf_map *map){
u32 pid = bpf_get_current_pid_tgid();
char mapname[16];
int kretprobe__bpf_map_new_fd(struct pt_regs *ctx){
int ret = PT_REGS_RC(ctx);
u32 pid = bpf_get_current_pid_tgid();
char ** mapname = currmap.lookup(&pid);
return 0;
struct fd_pid fd_pid={};;
bpf_trace_printk("trace %d %d %s\\n", pid, ret, mapname);
int hello(struct pt_regs *ctx, union bpf_attr *attr) {
struct data_t data = {};
u32 pid = bpf_get_current_pid_tgid();
struct fd_pid fd_pid={};;
#Recover mapname from current pid and fd
char** mapname=mapidfdpid.lookup(&fd_pid);
return 0;
__aligned_u64 key=attr->key;
#doing the same operation of map_update elem
void __user *ukey = u64_to_user_ptr(key);
#TODO:!assume that key is a long
bpf_probe_read(&data.key, 8, ukey);
bpf_trace_printk("trace %d %d %s\\n", pid, attr->value, mapname);
events.perf_submit(ctx, &data, sizeof(data));
bpf_trace_printk("trace \\n");
return 0;
# load BPF program
b = BPF(text=prog)
b.attach_kprobe(event="map_update_elem", fn_name="hello")
# define output data structure in Python
class Data(ct.Structure):
_fields_ = [("key", ct.c_ulonglong),
# process event
start = 0
def print_event(cpu, data, size):
event = ct.cast(data, ct.POINTER(Data)).contents
print("%s %d" % (, event.key))
# loop with callback to print_event
while 1:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment