Gecko [ www.jobworksschool.com ]

Name	Size	Permission	Date
CMakeLists.txt	276 B	-rw-r--r--	2023-12-08 15:36
biolatpcts.py	3.23 KB	-rwxr-xr-x	2023-12-08 15:36
biolatpcts_example.txt	650 B	-rw-r--r--	2023-12-08 15:36
bitehist.py	1.36 KB	-rwxr-xr-x	2023-12-08 15:36
bitehist_example.txt	1.18 KB	-rw-r--r--	2023-12-08 15:36
dddos.py	3.73 KB	-rwxr-xr-x	2023-12-08 15:36
dddos_example.txt	2.06 KB	-rw-r--r--	2023-12-08 15:36
disksnoop.py	1.9 KB	-rwxr-xr-x	2023-12-08 15:36
disksnoop_example.txt	1.55 KB	-rw-r--r--	2023-12-08 15:36
hello_fields.py	679 B	-rwxr-xr-x	2023-12-08 15:36
hello_perf_output.py	1.24 KB	-rwxr-xr-x	2023-12-08 15:36
hello_perf_output_using_ns.py	1.8 KB	-rwxr-xr-x	2023-12-08 15:36
kvm_hypercall.py	1.48 KB	-rwxr-xr-x	2023-12-08 15:36
kvm_hypercall.txt	1.74 KB	-rw-r--r--	2023-12-08 15:36
mallocstacks.py	1.9 KB	-rwxr-xr-x	2023-12-08 15:36
mysqld_query.py	1.66 KB	-rwxr-xr-x	2023-12-08 15:36
mysqld_query_example.txt	499 B	-rw-r--r--	2023-12-08 15:36
nflatency.py	6.07 KB	-rwxr-xr-x	2023-12-08 15:36
nodejs_http_server.py	1.34 KB	-rwxr-xr-x	2023-12-08 15:36
nodejs_http_server_example.txt	276 B	-rw-r--r--	2023-12-08 15:36
stack_buildid_example.py	3.03 KB	-rwxr-xr-x	2023-12-08 15:36
stacksnoop.py	3.18 KB	-rwxr-xr-x	2023-12-08 15:36
stacksnoop_example.txt	2.8 KB	-rw-r--r--	2023-12-08 15:36
strlen_count.py	1.3 KB	-rwxr-xr-x	2023-12-08 15:36
strlen_hist.py	1.81 KB	-rwxr-xr-x	2023-12-08 15:36
strlen_hist_ifunc.py	3.71 KB	-rwxr-xr-x	2023-12-08 15:36
strlen_snoop.py	1.35 KB	-rwxr-xr-x	2023-12-08 15:36
sync_timing.py	1.36 KB	-rwxr-xr-x	2023-12-08 15:36
task_switch.c	499 B	-rw-r--r--	2023-12-08 15:36
task_switch.py	486 B	-rwxr-xr-x	2023-12-08 15:36
tcpv4connect.py	2.36 KB	-rwxr-xr-x	2023-12-08 15:36
tcpv4connect_example.txt	1.04 KB	-rw-r--r--	2023-12-08 15:36
trace_fields.py	589 B	-rwxr-xr-x	2023-12-08 15:36
trace_perf_output.py	1.56 KB	-rwxr-xr-x	2023-12-08 15:36
undump.py	3.52 KB	-rwxr-xr-x	2023-12-08 15:36
undump_example.txt	886 B	-rw-r--r--	2023-12-08 15:36
urandomread-explicit.py	1.48 KB	-rwxr-xr-x	2023-12-08 15:36
urandomread.py	1.01 KB	-rwxr-xr-x	2023-12-08 15:36
urandomread_example.txt	675 B	-rw-r--r--	2023-12-08 15:36
vfsreadlat.c	896 B	-rw-r--r--	2023-12-08 15:36
vfsreadlat.py	1.3 KB	-rwxr-xr-x	2023-12-08 15:36
vfsreadlat_example.txt	3.53 KB	-rw-r--r--	2023-12-08 15:36

Rename

#!/usr/bin/python
#
# mallocstacks  Trace malloc() calls in a process and print the full
#               stack trace for all callsites.
#               For Linux, uses BCC, eBPF. Embedded C.
#
# This script is a basic example of the new Linux 4.6+ BPF_STACK_TRACE
# table API.
#
# Copyright 2016 GitHub, Inc.
# Licensed under the Apache License, Version 2.0 (the "License")

from __future__ import print_function
from bcc import BPF
from bcc.utils import printb
from time import sleep
import sys

if len(sys.argv) < 2:
    print("USAGE: mallocstacks PID [NUM_STACKS=1024]")
    exit()
pid = int(sys.argv[1])
if len(sys.argv) == 3:
    try:
        assert int(sys.argv[2]) > 0, ""
    except (ValueError, AssertionError) as e:
        print("USAGE: mallocstacks PID [NUM_STACKS=1024]")
        print("NUM_STACKS must be a non-zero, positive integer")
        exit()
    stacks = sys.argv[2]
else:
    stacks = "1024"

# load BPF program
b = BPF(text="""
#include <uapi/linux/ptrace.h>

BPF_HASH(calls, int);
BPF_STACK_TRACE(stack_traces, """ + stacks + """);

int alloc_enter(struct pt_regs *ctx, size_t size) {
    int key = stack_traces.get_stackid(ctx, BPF_F_USER_STACK);
    if (key < 0)
        return 0;

// could also use `calls.increment(key, size);`
    u64 zero = 0, *val;
    val = calls.lookup_or_try_init(&key, &zero);
    if (val) {
      (*val) += size;
    }
    return 0;
};
""")

b.attach_uprobe(name="c", sym="malloc", fn_name="alloc_enter", pid=pid)
print("Attaching to malloc in pid %d, Ctrl+C to quit." % pid)

# sleep until Ctrl-C
try:
    sleep(99999999)
except KeyboardInterrupt:
    pass

calls = b.get_table("calls")
stack_traces = b.get_table("stack_traces")

for k, v in reversed(sorted(calls.items(), key=lambda c: c[1].value)):
    print("%d bytes allocated at:" % v.value)
    if k.value > 0 :
        for addr in stack_traces.walk(k.value):
            printb(b"\t%s" % b.sym(addr, pid, show_offset=True))