main.c

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdbool.h>

void slankdev_test(int id, const char* str, bool isUS)
{
	printf("%d: fuckin %s. slankdev \"I %s understand PACKET.\"\n",
			id,
			str,
			isUS?"can":"cannot"
			);
}

int main()
{
  for (size_t i=0; ; i++) {
		bool cond = rand()%2 == 0 ? true : false;
    slankdev_test(i, "kusobpf", cond);
    sleep(1);
  }
}

makefile

make:
	sudo ./slankdev.py



src:
	gcc -static main.c

slankdev.py

#!/usr/bin/env python
from bcc import BPF

prog = """
#include <uapi/linux/ptrace.h>
void call(struct pt_regs *ctx)
{
	bpf_trace_printk("Call Func\\n");
	bpf_trace_printk(" arg[1]: %d \\n", PT_REGS_PARM1(ctx));
	bpf_trace_printk(" arg[2]: %s \\n", (char*)PT_REGS_PARM2(ctx));
	bpf_trace_printk(" arg[3]: %d \\n", PT_REGS_PARM3(ctx)?1:0);
}
"""

b = BPF(text=prog)
b.attach_uprobe   (name="./a.out", sym="slankdev_test", fn_name="call")

while True:
    print(b.trace_fields()[5])