Skip to content

Instantly share code, notes, and snippets.

@wkz
Created January 19, 2016 20:13
Show Gist options
  • Save wkz/18ad94891b0f3aaa9c2c to your computer and use it in GitHub Desktop.
Save wkz/18ad94891b0f3aaa9c2c to your computer and use it in GitHub Desktop.
#!/bin/ply -f
kprobe:SyS_* {
syscall[reg("pc")] += 1
}
--
000: mov r9, r1
001: mov r0, #0x0
002: stdw [r10 - 0x10], r0
003: mov r1, r10
004: add r1, #-0x10
005: mov r2, #0x4
006: mov r3, r9
007: add r3, #0x78
008: call probe_read
009: mov r0, #0x0
010: stdw [r10 - 0x8], r0
011: lddw r1, r1
012: ldw r0, #0x0
013: mov r2, r10
014: add r2, #-0x10
015: call map_lookup_elem
016: jeq r0, #0x0, +5
017: mov r1, r10
018: add r1, #-0x8
019: mov r2, #0x8
020: mov r3, r0
021: call probe_read
022: lddw r0, [r10 - 0x8]
023: add r0, #0x1
024: stdw [r10 - 0x8], r0
025: lddw r1, r1
026: ldw r0, #0x0
027: mov r2, r10
028: add r2, #-0x10
029: mov r3, r10
030: add r3, #-0x8
031: mov r4, #0x0
032: call map_update_elem
033: mov r0, #0x0
034: exit
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment