Gecko [ www.jobworksschool.com ]

Name	Size	Permission	Date
CMakeLists.txt	276 B	-rw-r--r--	2023-12-08 15:36
biolatpcts.py	3.23 KB	-rwxr-xr-x	2023-12-08 15:36
biolatpcts_example.txt	650 B	-rw-r--r--	2023-12-08 15:36
bitehist.py	1.36 KB	-rwxr-xr-x	2023-12-08 15:36
bitehist_example.txt	1.18 KB	-rw-r--r--	2023-12-08 15:36
dddos.py	3.73 KB	-rwxr-xr-x	2023-12-08 15:36
dddos_example.txt	2.06 KB	-rw-r--r--	2023-12-08 15:36
disksnoop.py	1.9 KB	-rwxr-xr-x	2023-12-08 15:36
disksnoop_example.txt	1.55 KB	-rw-r--r--	2023-12-08 15:36
hello_fields.py	679 B	-rwxr-xr-x	2023-12-08 15:36
hello_perf_output.py	1.24 KB	-rwxr-xr-x	2023-12-08 15:36
hello_perf_output_using_ns.py	1.8 KB	-rwxr-xr-x	2023-12-08 15:36
kvm_hypercall.py	1.48 KB	-rwxr-xr-x	2023-12-08 15:36
kvm_hypercall.txt	1.74 KB	-rw-r--r--	2023-12-08 15:36
mallocstacks.py	1.9 KB	-rwxr-xr-x	2023-12-08 15:36
mysqld_query.py	1.66 KB	-rwxr-xr-x	2023-12-08 15:36
mysqld_query_example.txt	499 B	-rw-r--r--	2023-12-08 15:36
nflatency.py	6.07 KB	-rwxr-xr-x	2023-12-08 15:36
nodejs_http_server.py	1.34 KB	-rwxr-xr-x	2023-12-08 15:36
nodejs_http_server_example.txt	276 B	-rw-r--r--	2023-12-08 15:36
stack_buildid_example.py	3.03 KB	-rwxr-xr-x	2023-12-08 15:36
stacksnoop.py	3.18 KB	-rwxr-xr-x	2023-12-08 15:36
stacksnoop_example.txt	2.8 KB	-rw-r--r--	2023-12-08 15:36
strlen_count.py	1.3 KB	-rwxr-xr-x	2023-12-08 15:36
strlen_hist.py	1.81 KB	-rwxr-xr-x	2023-12-08 15:36
strlen_hist_ifunc.py	3.71 KB	-rwxr-xr-x	2023-12-08 15:36
strlen_snoop.py	1.35 KB	-rwxr-xr-x	2023-12-08 15:36
sync_timing.py	1.36 KB	-rwxr-xr-x	2023-12-08 15:36
task_switch.c	499 B	-rw-r--r--	2023-12-08 15:36
task_switch.py	486 B	-rwxr-xr-x	2023-12-08 15:36
tcpv4connect.py	2.36 KB	-rwxr-xr-x	2023-12-08 15:36
tcpv4connect_example.txt	1.04 KB	-rw-r--r--	2023-12-08 15:36
trace_fields.py	589 B	-rwxr-xr-x	2023-12-08 15:36
trace_perf_output.py	1.56 KB	-rwxr-xr-x	2023-12-08 15:36
undump.py	3.52 KB	-rwxr-xr-x	2023-12-08 15:36
undump_example.txt	886 B	-rw-r--r--	2023-12-08 15:36
urandomread-explicit.py	1.48 KB	-rwxr-xr-x	2023-12-08 15:36
urandomread.py	1.01 KB	-rwxr-xr-x	2023-12-08 15:36
urandomread_example.txt	675 B	-rw-r--r--	2023-12-08 15:36
vfsreadlat.c	896 B	-rw-r--r--	2023-12-08 15:36
vfsreadlat.py	1.3 KB	-rwxr-xr-x	2023-12-08 15:36
vfsreadlat_example.txt	3.53 KB	-rw-r--r--	2023-12-08 15:36

Rename

#!/usr/bin/python
# Carlos Neira <cneirabustos@gmail.com>
# This is a Hello World example that uses BPF_PERF_OUTPUT.
# in this example bpf_get_ns_current_pid_tgid(), this helper
# works inside pid namespaces.
# bpf_get_current_pid_tgid() only returns the host pid outside any
# namespace and this will not work when the script is run inside a pid namespace.

from bcc import BPF
from bcc.utils import printb
import sys, os
from stat import *

# define BPF program
prog = """
#include <linux/sched.h>

// define output data structure in C
struct data_t {
    u32 pid;
    u64 ts;
    char comm[TASK_COMM_LEN];
};
BPF_PERF_OUTPUT(events);

int hello(struct pt_regs *ctx) {
    struct data_t data = {};
    struct bpf_pidns_info ns = {};

if(bpf_get_ns_current_pid_tgid(DEV, INO, &ns, sizeof(struct bpf_pidns_info)))
	return 0;
    data.pid = ns.pid;
    data.ts = bpf_ktime_get_ns();
    bpf_get_current_comm(&data.comm, sizeof(data.comm));

events.perf_submit(ctx, &data, sizeof(data));

return 0;
}
"""

devinfo = os.stat("/proc/self/ns/pid")
for r in (("DEV", str(devinfo.st_dev)), ("INO", str(devinfo.st_ino))):
    prog = prog.replace(*r)

# load BPF program
b = BPF(text=prog)
b.attach_kprobe(event=b.get_syscall_fnname("clone"), fn_name="hello")

# header
print("%-18s %-16s %-6s %s" % ("TIME(s)", "COMM", "PID", "MESSAGE"))

# process event
start = 0

def print_event(cpu, data, size):
    global start
    event = b["events"].event(data)
    if start == 0:
        start = event.ts
    time_s = (float(event.ts - start)) / 1000000000
    printb(
        b"%-18.9f %-16s %-6d %s"
        % (time_s, event.comm, event.pid, b"Hello, perf_output!")
    )

# loop with callback to print_event
b["events"].open_perf_buffer(print_event)
while 1:
    try:
        b.perf_buffer_poll()
    except KeyboardInterrupt:
        exit()