Created
January 19, 2016 20:13
-
-
Save wkz/18ad94891b0f3aaa9c2c to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/ply -f | |
kprobe:SyS_* { | |
syscall[reg("pc")] += 1 | |
} | |
-- | |
000: mov r9, r1 | |
001: mov r0, #0x0 | |
002: stdw [r10 - 0x10], r0 | |
003: mov r1, r10 | |
004: add r1, #-0x10 | |
005: mov r2, #0x4 | |
006: mov r3, r9 | |
007: add r3, #0x78 | |
008: call probe_read | |
009: mov r0, #0x0 | |
010: stdw [r10 - 0x8], r0 | |
011: lddw r1, r1 | |
012: ldw r0, #0x0 | |
013: mov r2, r10 | |
014: add r2, #-0x10 | |
015: call map_lookup_elem | |
016: jeq r0, #0x0, +5 | |
017: mov r1, r10 | |
018: add r1, #-0x8 | |
019: mov r2, #0x8 | |
020: mov r3, r0 | |
021: call probe_read | |
022: lddw r0, [r10 - 0x8] | |
023: add r0, #0x1 | |
024: stdw [r10 - 0x8], r0 | |
025: lddw r1, r1 | |
026: ldw r0, #0x0 | |
027: mov r2, r10 | |
028: add r2, #-0x10 | |
029: mov r3, r10 | |
030: add r3, #-0x8 | |
031: mov r4, #0x0 | |
032: call map_update_elem | |
033: mov r0, #0x0 | |
034: exit |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment