|
|
@ -2,8 +2,9 @@
|
|
|
|
#![no_main]
|
|
|
|
#![no_main]
|
|
|
|
|
|
|
|
|
|
|
|
use aya_bpf::{
|
|
|
|
use aya_bpf::{
|
|
|
|
macros::{uprobe, map},
|
|
|
|
macros::{map, uprobe},
|
|
|
|
programs::{perf_event, ProbeContext}, maps::PerfEventArray,
|
|
|
|
maps::PerfEventArray,
|
|
|
|
|
|
|
|
programs::ProbeContext,
|
|
|
|
};
|
|
|
|
};
|
|
|
|
use aya_log_ebpf::{debug, info};
|
|
|
|
use aya_log_ebpf::{debug, info};
|
|
|
|
|
|
|
|
|
|
|
@ -19,9 +20,9 @@ pub struct Args {
|
|
|
|
a_7: i64,
|
|
|
|
a_7: i64,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
impl Args{
|
|
|
|
impl Args {
|
|
|
|
fn new()->Self{
|
|
|
|
fn new() -> Self {
|
|
|
|
Self{
|
|
|
|
Self {
|
|
|
|
a_0: 0,
|
|
|
|
a_0: 0,
|
|
|
|
a_1: 0,
|
|
|
|
a_1: 0,
|
|
|
|
a_2: 0,
|
|
|
|
a_2: 0,
|
|
|
@ -48,7 +49,7 @@ pub fn test_stack_argument(ctx: ProbeContext) -> i32 {
|
|
|
|
|
|
|
|
|
|
|
|
//read argument, and send event
|
|
|
|
//read argument, and send event
|
|
|
|
fn try_stack_argument(ctx: ProbeContext) -> Result<i32, i64> {
|
|
|
|
fn try_stack_argument(ctx: ProbeContext) -> Result<i32, i64> {
|
|
|
|
let args = Args::new();
|
|
|
|
let mut args = Args::new();
|
|
|
|
args.a_0 = ctx.arg(0).ok_or(255)?;
|
|
|
|
args.a_0 = ctx.arg(0).ok_or(255)?;
|
|
|
|
args.a_1 = ctx.arg(1).ok_or(255)?;
|
|
|
|
args.a_1 = ctx.arg(1).ok_or(255)?;
|
|
|
|
args.a_2 = ctx.arg(2).ok_or(255)?;
|
|
|
|
args.a_2 = ctx.arg(2).ok_or(255)?;
|
|
|
@ -57,7 +58,6 @@ fn try_stack_argument(ctx: ProbeContext) -> Result<i32, i64> {
|
|
|
|
args.a_5 = ctx.arg(5).ok_or(255)?;
|
|
|
|
args.a_5 = ctx.arg(5).ok_or(255)?;
|
|
|
|
args.a_6 = ctx.stack_arg(0).ok_or(255)?;
|
|
|
|
args.a_6 = ctx.stack_arg(0).ok_or(255)?;
|
|
|
|
args.a_7 = ctx.stack_arg(1).ok_or(255)?;
|
|
|
|
args.a_7 = ctx.stack_arg(1).ok_or(255)?;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
EVENTS.output(&ctx, &args, 0);
|
|
|
|
EVENTS.output(&ctx, &args, 0);
|
|
|
|
|
|
|
|
|
|
|
|