main.c

#include <uapi/linux/ptrace.h>
#define OK 0
#define NG 1
BPF_ARRAY(count, u64, 2);

void trace_good(struct pt_regs *ctx)
{
	bpf_trace_printk("good\n");
	count.increment(OK);
}

void trace_bad(struct pt_regs *ctx)
{
	bpf_trace_printk("bad\n");
	count.increment(NG);
}

makefile

# Only Compile
test:
	sudo ./test.py

# Compile and Tracing
trace:
	sudo ./trace.py

# Build Target Program
target:
	gcc -static target.c

target.c

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdbool.h>

void slankdev_good_practice() { printf("BPF Dekiruuuuuu\n"); }
void slankdev_bad_practice()  { printf("BPF Dekineeeeee, KUSO, KUSO\n"); }

int main()
{
  for (size_t i=0; ; i++) {
		bool cond = rand()%4 == 0 ? true : false;
		if (cond) slankdev_good_practice();
		else      slankdev_bad_practice();
    sleep(1);
  }
}

test.py

#!/usr/bin/env python
from bcc import BPF

b = BPF(src_file="main.c")
print('Compile Done')

trace.py

#!/usr/bin/env python
from bcc import BPF
import time

b = BPF(src_file="main.c")
b.attach_uprobe(
        name    = "./a.out",
        sym     = "slankdev_good_practice",
        fn_name = "trace_good")
b.attach_uprobe(
        name    = "./a.out",
        sym     = "slankdev_bad_practice",
        fn_name = "trace_bad")


while True:
    # print(b.trace_print())
    good = b["count"][0].value
    bad  = b["count"][1].value
    print("understand bpf?      good:{},bad:{}".format(good, bad))
    time.sleep(1)