Linux id-dci-web1980.main-hosting.eu 5.14.0-611.26.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jan 29 05:24:47 EST 2026 x86_64
LiteSpeed
: 153.92.8.146 | : 216.73.217.84
Cant Read [ /etc/named.conf ]
8.3.30
u610877233
www.github.com/MadExploits
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
CPANEL RESET
CREATE WP USER
README
+ Create Folder
+ Create File
/
lib /
python3.9 /
site-packages /
bcc /
__pycache__ /
[ HOME SHELL ]
Name
Size
Permission
Action
__init__.cpython-39.opt-1.pyc
54.16
KB
-rw-r--r--
__init__.cpython-39.pyc
54.24
KB
-rw-r--r--
containers.cpython-39.opt-1.py...
3.19
KB
-rw-r--r--
containers.cpython-39.pyc
3.19
KB
-rw-r--r--
disassembler.cpython-39.opt-1....
11.45
KB
-rw-r--r--
disassembler.cpython-39.pyc
11.45
KB
-rw-r--r--
libbcc.cpython-39.opt-1.pyc
8.74
KB
-rw-r--r--
libbcc.cpython-39.pyc
8.74
KB
-rw-r--r--
perf.cpython-39.opt-1.pyc
5.39
KB
-rw-r--r--
perf.cpython-39.pyc
5.39
KB
-rw-r--r--
syscall.cpython-39.opt-1.pyc
8.6
KB
-rw-r--r--
syscall.cpython-39.pyc
8.6
KB
-rw-r--r--
table.cpython-39.opt-1.pyc
44.49
KB
-rw-r--r--
table.cpython-39.pyc
44.49
KB
-rw-r--r--
tcp.cpython-39.opt-1.pyc
1010
B
-rw-r--r--
tcp.cpython-39.pyc
1010
B
-rw-r--r--
usdt.cpython-39.opt-1.pyc
7.75
KB
-rw-r--r--
usdt.cpython-39.pyc
7.75
KB
-rw-r--r--
utils.cpython-39.opt-1.pyc
4.35
KB
-rw-r--r--
utils.cpython-39.pyc
4.37
KB
-rw-r--r--
version.cpython-39.opt-1.pyc
160
B
-rw-r--r--
version.cpython-39.pyc
160
B
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : __init__.cpython-39.pyc
a u*�h� � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl Z ddl m Z mZmZmZmZ ddlmZmZmZmZmZ ddlmZ ddlmZm Z m Z m Z m Z ddl m!Z! dd l"m#Z#m$Z$ dd l%m&Z&m'Z' ze( W n e)y� e*Z(Y n0 d Z+d a,d d � Z-dZ.ej/�0e.d�Z1ej/�2e1��s4dZ1dZ3dZ4dZ5dZ6dZ7dZ8G dd� de9�Z:G dd� d�Z;G dd� d�Z<G d d � d �Z=G d d � d �Z>G d d!� d!�Z?G d"d#� d#�Z@G d$d%� d%�ZAG d&d'� d'�ZBG d(d)� d)e9�ZCdS )*� )�print_functionN� )�lib� bcc_symbol�bcc_symbol_option�bcc_stacktrace_build_id� _SYM_CB_TYPE)�Table�PerfEventArray�RingBuf�BPF_MAP_TYPE_QUEUE�BPF_MAP_TYPE_STACK)�Perf)�get_online_cpus�printb�_assert_is_bytes� ArgString� StrcmpRewrite)� __version__)�disassemble_prog� decode_map)�USDT� USDTExceptioni� c C s t S �N)�_num_open_probes� r r �0/usr/lib/python3.9/site-packages/bcc/__init__.py�_get_num_open_probes+ s r z/sys/kernel/debug�tracingz/sys/kernel/tracing� � � � � c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� SymbolCachec C s t �|t�d t�t���| _d S r )r Zbcc_symcache_new�ct�cast�POINTERr �cache)�self�pidr r r �__init__D s �zSymbolCache.__init__c C s� t � }|r"t�| j|t�|��}nt�| j|t�|��}|dk rp|jrf|jrfd|jt� |jtj �j fS d|dfS |r�|j }t� t�|�� n|j}||jt� |jtj �j fS )a� Return a tuple of the symbol (function), its offset from the beginning of the function, and the module in which it lies. For example: ("start_thread", 0x202, "/usr/lib/.../libpthread-2.24.so") If the symbol cannot be found but we know which module it is in, return the module name and the offset from the beginning of the module. If we don't even know the module, return the absolute address as the offset. r N)r r Zbcc_symcache_resolver( r% �byrefZ bcc_symcache_resolve_no_demangle�module�offsetr& �c_char_p�valueZ demangle_nameZ bcc_symbol_free_demangle_name�name)r) �addr�demangle�sym�resZname_resr r r �resolveH s" � � zSymbolCache.resolvec C s> t |�}t |�}t�� }t�| j||t�|��dk r8dS |jS )Nr ���)r r% � c_ulonglongr Zbcc_symcache_resolve_namer( r, r0 )r) r- r1 r2 r r r � resolve_namee s ��zSymbolCache.resolve_nameN)�__name__� __module__� __qualname__r+ r6 r9 r r r r r$ C s r$ c @ s$ e Zd ZdZdZdZdZdZdZdS )�PerfTyper r r � r � N) r: r; r< ZHARDWAREZSOFTWARE� TRACEPOINTZHW_CACHE�RAWZ BREAKPOINTr r r r r= n s r= c @ s4 e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d S ) � PerfHWConfigr r r r> r r? � � r! � N) r: r; r< Z CPU_CYCLESZ INSTRUCTIONSZCACHE_REFERENCESZ CACHE_MISSESZBRANCH_INSTRUCTIONSZ BRANCH_MISSESZ BUS_CYCLESZSTALLED_CYCLES_FRONTENDZSTALLED_CYCLES_BACKENDZREF_CPU_CYCLESr r r r rB w s rB c @ s8 e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d S ) � PerfSWConfigr r r r> r r? rC rD r! rE � N)r: r; r< Z CPU_CLOCKZ TASK_CLOCKZ PAGE_FAULTSZCONTEXT_SWITCHESZCPU_MIGRATIONSZPAGE_FAULTS_MINZPAGE_FAULTS_MAJZALIGNMENT_FAULTSZEMULATION_FAULTSZDUMMYZ BPF_OUTPUTr r r r rF � s rF c @ sp e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdS )�PerfEventSampleFormatr r r r! r" r# �@ � � i � i i i i @ i � i i i i i i i @ i � i N) r: r; r< ZIPZTIDZTIMEZADDRZREADZ CALLCHAINZIDZCPUZPERIODZ STREAM_IDrA Z BRANCH_STACKZ REGS_USERZ STACK_USERZWEIGHTZDATA_SRCZ IDENTIFIERZ TRANSACTIONZ REGS_INTRZ PHYS_ADDR�AUXZCGROUPZDATA_PAGE_SIZEZCODE_PAGE_SIZEZ WEIGHT_STRUCTr r r r rH � s2 rH c @ s` e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdS )� BPFProgTyper r r> r r? rC rD r! rE rG � � � � � r" � � � � � N)r: r; r< � SOCKET_FILTER�KPROBE� SCHED_CLS� SCHED_ACTr@ �XDP� PERF_EVENT� CGROUP_SKB� CGROUP_SOCK�LWT_IN�LWT_OUT�LWT_XMIT�SOCK_OPS�SK_SKB� CGROUP_DEVICE�SK_MSG�RAW_TRACEPOINT�CGROUP_SOCK_ADDRZCGROUP_SOCKOPT�TRACING�LSMr r r r rN � s* rN c @ s� e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Z!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(S ))� BPFAttachTyper r r r> r r? rC rD r! rE rG rO rP rQ rR rS r" rT rU � � � � � � rV rW � � rX � � r# �! �" �# �$ �% �& N)*r: r; r< ZCGROUP_INET_INGRESSZCGROUP_INET_EGRESSZCGROUP_INET_SOCK_CREATEZCGROUP_SOCK_OPSZSK_SKB_STREAM_PARSERZSK_SKB_STREAM_VERDICTrf ZSK_MSG_VERDICTZCGROUP_INET4_BINDZCGROUP_INET6_BINDZCGROUP_INET4_CONNECTZCGROUP_INET6_CONNECTZCGROUP_INET4_POST_BINDZCGROUP_INET6_POST_BINDZCGROUP_UDP4_SENDMSGZCGROUP_UDP6_SENDMSGZ LIRC_MODE2ZFLOW_DISSECTORZ CGROUP_SYSCTLZCGROUP_UDP4_RECVMSGZCGROUP_UDP6_RECVMSGZCGROUP_GETSOCKOPTZCGROUP_SETSOCKOPTZ TRACE_RAW_TPZ TRACE_FENTRYZ TRACE_FEXITZ MODIFY_RETURNZLSM_MACZ TRACE_ITERZCGROUP_INET4_GETPEERNAMEZCGROUP_INET6_GETPEERNAMEZCGROUP_INET4_GETSOCKNAMEZCGROUP_INET6_GETSOCKNAMEZ XDP_DEVMAPZCGROUP_INET_SOCK_RELEASEZ XDP_CPUMAPZ SK_LOOKUPr] ZSK_SKB_VERDICTr r r r rl � sN rl c @ s e Zd ZdZdZdZdZdZdS )� XDPActionr r r r> r N)r: r; r< � XDP_ABORTED�XDP_DROP�XDP_PASS�XDP_TX� XDP_REDIRECTr r r r r} � s r} c @ s e Zd ZdZdZdZdZdZdS )�XDPFlagsr r r r! r" N)r: r; r< �UPDATE_IF_NOEXIST�SKB_MODE�DRV_MODE�HW_MODE�REPLACEr r r r r� � s r� c @ s� e Zd ZejZejZejZejZejZej Z ej Z ej Z ej Z ej Z ejZejZejZejZejZejZejZejZejZejZejZejZejZej Z ej Z e j Z e j!Z"e j#Z$e j%Z&e j'Z(e)�*d�Z+i Z,e-�.� Z/dgddgddgdgdd gd �Z0g d �Z1d Z2G d d� de3j4�Z5e3j6ddd�Z7e7j8Z9e3j:e3�;e5�ge9_<e=dd� �Z>e=dd� �Z?e@Z@G dd� deA�ZBeCdd� �ZDeCdd� �ZEd d d d g g dd d f d d!�ZFefd"d#�ZGd�d%d&�ZHd'd(� ZId)d*� ZJd�d+d,�ZKe3jLe3jMe3jNe3jOe3jPe3jQe3j:e3jRe3jSe3jTe3jUe3jVe3jWe3jXe3jYe3jZd- e3j[d- d.�Z\eCd/d0� �Z]d�d1d2�Z^d3d4� Z_d5d6� Z`d7d8� Zad9d:� Zbd;d<� ZceCd�d=d>��ZdeCd?d@� �ZeeCdAdB� �ZfeCdCdD� �ZgdEdF� ZheCdGdH� �ZidIdJ� ZjdKdL� ZkdMdN� ZldOdP� ZmdQdR� ZndSdT� ZodUdV� Zpd�dWdX�Zqd�dYdZ�Zrd[d\� Zsd]d^� Ztd�d_d`�Zud�dadb�ZveCd�dcdd��ZweCd�dedf��Zxe=d�dgdh��ZyeCd�didj��ZzeCdkdl� �Z{eCdmdn� �Z|d�dodp�Z}d�dqdr�Z~d�dsdt�ZeCdudv� �Z�eCdwdx� �Z�eCdydz� �Z�d�d{d|�Z�d�d}d~�Z�d�dd��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�eCd�d�� �Z�eCd�d�� �Z�eCd�d�� �Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�d��Z�eCd�d�� �Z�eCd�d�� �Z�eCd�d�� �Z�d�d�� Z�d�d�d��Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�eCd�d�� �Z�eCd�d�d���Z�eCd�d�d���Z�eCd�d�� �Z�d�d�� Z�d�d�� Z�d�d Z��d d�dĄZ�d�dƄ Z��dd�dȄZ��dd�dʄZ��dd�d̄Z�d�d΄ Z�d�dЄ Z�eCd�d҄ �Z�d�dԄ Z�d�dք Z�d�d Z�d�dڄ Z�d�d܄ Z�d S ( �BPFs [^a-zA-Z0-9_]�timeZfs�fileZbioZrequestZallocZsk_buffZ net_device)z linux/time.hz linux/fs.hzlinux/blkdev.hz linux/slab.hzlinux/netdevice.h)s sys_s __x64_sys_s __x32_compat_sys_s __ia32_compat_sys_s __arm64_sys_s __s390x_sys_s __s390_sys_s __riscv_sys_r c @ s e Zd ZdejfdejfgZdS )z BPF.timespec�tv_sec�tv_nsecN)r: r; r< r% �c_long�_fields_r r r r �timespecD s r� z librt.so.1T)Z use_errnoc C sH | � � }| �| jt�|��dkr8t�� }t|t�|���|j d |j S )z�monotonic_time() Returns the system monotonic time from clock_gettime, using the CLOCK_MONOTONIC constant. The time returned is in nanoseconds. r g e��A) r� �_clock_gettime�CLOCK_MONOTONICr% r, � get_errno�OSError�os�strerrorr� r� )�cls�t�errnor r r �monotonic_timeK s zBPF.monotonic_timec C sL d}| j �� D ]8\}}|D ]*}|D ] }||v r"||vr"|d| 7 }q"qq|S )a1 Generates #include statements automatically based on a set of recognized types such as sk_buff and bio. The input is all the words that appear in the BPF program, and the output is a (possibly empty) string of #include statements, such as "#include <linux/fs.h>". � z#include <%s> )�_auto_includes�items)r� Z program_wordsZheaders�header�keywords�keywordZwordr r r �generate_auto_includesW s zBPF.generate_auto_includesc @ s e Zd Zdd� ZdS )z BPF.Functionc C s || _ || _|| _d S r )�bpfr1 �fd)r) r� r1 r� r r r r+ k s zBPF.Function.__init__N)r: r; r< r+ r r r r �Functionj s r� c C sb | r^t j�| �s^ttjd �}d�t j�t j�|� � ��| g�}t j�|�rR|} n t d| ��| S )z1 If filename is invalid, search in ./ of argv[0] r � /zCould not find file %s) r� �path�isfiler �sys�argv�join�abspath�dirname� __bytes__� Exception)�filenameZargv0r� r r r � _find_filep s " zBPF._find_filec C sr dd� }t j�| �\}}|r*|| �rn| S nDt jd �t j�D ]0}|�d�}t j�|�� | �}||�r<| S q<dS )a� find_exe(bin_path) Traverses the PATH environment variable, looking for the first directory that contains an executable file named bin_path, and returns the full path to that file, or None if no such file can be found. This is meant to replace invocations of the "which" shell utility, which doesn't have portable semantics for skipping aliases. c S s t j�| �ot �| t j�S r )r� r� r� �access�X_OK)�fpathr r r �is_exe� s �z BPF.find_exe.<locals>.is_exe�PATH�"N)r� r� �split�environ�pathsep�stripr� �encode)Zbin_pathr� r� �fnamer� Zexe_filer r r �find_exe} s z BPF.find_exe� Nr Fc C s� t |�}t |�}t |�}|r$|r$J �t�� } | dk�r"z8tjddgtjd�} | �d��d�} tj � | �sld} W n( t y� } zd} W Y d} ~ n d} ~ 0 0 z8tjd dgtjd�}|�d��d�}tj � |�s�d}W n( t y� } zd}W Y d} ~ n d} ~ 0 0 | �r|� d | � |�r"|� d | � i | _ i | _i | _i | _i | _i | _i | _i | _i | _d| _d| _t�| j� || _i | _ i | _ d| _ t j t!|� � }t"|�D ]\}}t#t$|��||< �q�|�r�t%�&|�}t%�&|�}|�rt'|d d ��}|�(� }W d � n1 �s0 Y t j)t!|� � }t"|�D ] \}}t �)|�*� �||< �q*t+�,|t!|��}|du �rjt d ��|| }t+�-|| j|t!|�||�| _ | j �s�t d|�p�d ��|D ]}|�.| | � �q�| �/� dS )aZ Create a new BPF module with the given source code. Note: All fields are marked as optional, but either `src_file` or `text` must be supplied, and not both. Args: src_file (Optional[str]): Path to a source file for the module hdr_file (Optional[str]): Path to a helper header file for the `src_file` text (Optional[str]): Contents of a source file for the module debug (Optional[int]): Flags used for debug prints, can be |'d together See "Debug flags" for explanation Z loongarch64Zclangz-print-file-name=include)�stderr�utf-8� FNZgccz-I�rb)�modezycan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple locationsz Failed to compile BPF module %sz<text>)0r �platform�machine� subprocessZ check_outputZSTDOUT�decoder� r� r� �existsr� �append� kprobe_fds� uprobe_fds�tracepoint_fds�raw_tracepoint_fds�kfunc_entry_fds�kfunc_exit_fds�lsm_fds� perf_buffers�open_perf_events�_ringbuf_manager� tracefile�atexit�register�cleanup�debug�funcs�tablesr- r% r/ �len� enumerate�bytesr r� r� �open�read�c_void_pZ get_contextr Zbcc_usdt_genargsZ bpf_module_create_c_from_stringZattach_uprobes�_trace_autoload)r) Zsrc_fileZhdr_file�textr� ZcflagsZ usdt_contextsZ allow_rlimit�deviceZattach_usdt_ignore_pidZ architectureZclang_include_path_outputZclang_include_path_str�eZgcc_include_path_outputZgcc_include_path_strZ cflags_array�i�sr� Z ctx_array�usdtZ usdt_textZ usdt_contextr r r r+ � s� $ ( �z BPF.__init__c C s@ g }t dt�| j��D ]$}t�| j|�}|�| �||�� q|S )z�load_funcs(prog_type=KPROBE) Load all functions in this BPF module with the given type. Returns a list of the function handles.r )�ranger �bpf_num_functionsr- �bpf_function_namer� � load_func)r) � prog_type�fnsr� � func_namer r r � load_funcs s zBPF.load_funcsr7 c C s t |�}|| jv r | j| S t�| j|�s6td| ��d}| jt@ rJd}n| jt@ rXd}t� | j||t�| j|�t� | j|�t� | j�t� | j�|d d||� }|dk r�t �| j� t�� tjkr�td��t�t�� �}td||f ��t�| ||�}|| j|< |S )N�Unknown program %sr r r z!Need super-user privileges to runz!Failed to load BPF program %s: %s)r r� r �bpf_function_startr- r� r� �DEBUG_BPF_REGISTER_STATE� DEBUG_BPFZ bcc_func_load�bpf_function_sizeZbpf_module_licenseZbpf_module_kern_versionr� r� � donothingr% r� r� �EPERMr� r� r� r� ) r) r� r� r� � attach_typeZ log_levelr� �errstr�fnr r r r� s8 � � z BPF.load_funcc C sJ t |�}t�| j|�s"td| ��t�| j|�}t�| j|�}t�||�S )zR Return the eBPF bytecodes for the specified function as a string r� )r r r� r- r� r� r% Z string_at)r) r� �start�sizer r r � dump_func0 s z BPF.dump_funcc C s | � |�}t||�S r )r� r )r) r� Zbpfstrr r r �disassemble_func< s zBPF.disassemble_funcc C s( | | }t �| j|j�}t||||d�S )N)�sizeinfo)r �bpf_table_type_idr- �map_idr )r) Z table_namer� Z table_objZ table_typer r r � decode_table@ s zBPF.decode_tabler )Z_Bool�charZwchar_tz unsigned charZshortzunsigned short�intz unsigned intZlongz unsigned longz long longzunsigned long long�floatZdoublez long doubleZ__int128zunsigned __int128c C s t | t�rtj| S g }g }| d D �]@}t|�dkrT|�|d t�|d �f� q$t|�dk�rVt |d t�r�|�|d t�|d �|d d f� n�t |d t�r�|�|d t�|d �|d f� n�t |d t��rD|d dk�s|d dk�s|d dk�rD|d }|dk�r.d t|� }|�|� |�|t�|�f� nt d t |� ��q$t d t |� ��q$t j }d }t| �dk�r�| d dk�r�t j }n.| d dk�r�t j }n| d dk�r�t j }d }|�r�tt | d �|ft|d|d ��}n tt | d �|ft||d��}|S )Nr r r r> �union�structZ struct_packedr� z__anon%dzFailed to decode type %sFT)� _anonymous_Z_pack_r� )r r� )� isinstance� basestringr� � str2ctyper� r� �_decode_table_type�listr r� �strr% � Structure�Union�type�dict)ZdescZanon�fieldsr� r1 �baseZ is_packedr� r r r r X sX *$ � � � � �zBPF._decode_table_typec C s� t |�}t�| j|�}t�| j|�}t�| j|�ttfv }|dk rFt�|s�|s�t� | j|�� d�}|srt d| ��t � t�|��}|s�t�| j|�� d�} | s�t d| ��t � t�| ��}t| ||||||d�S )Nr r� z$Failed to load BPF Table %s key descz%Failed to load BPF Table %s leaf desc)�reducer)r r Z bpf_table_idr- Z bpf_table_fdr� r r �KeyErrorZbpf_table_key_descr� r� r� r �json�loadsZbpf_table_leaf_descr ) r) r1 ZkeytypeZleaftyper r �map_fdZ is_queuestackZkey_descZ leaf_descr r r � get_table� s" z BPF.get_tablec C s$ || j vr| �|�| j |< | j | S r )r� r �r) �keyr r r � __getitem__� s zBPF.__getitem__c C s || j |< d S r �r� )r) r Zleafr r r � __setitem__� s zBPF.__setitem__c C s t | j�S r )r� r� �r) r r r �__len__� s z BPF.__len__c C s | j |= d S r r r r r r � __delitem__� s zBPF.__delitem__c C s | j �� S r )r� �__iter__r r r r r" � s z BPF.__iter__c C sJ t | tj�std��t�| j|||�}|dk rFtd�|t� | ����d S )N�"arg 1 must be of type BPF.Functionr z7Failed to attach BPF function with attach_type {0}: {1}) r r� r� r� r Zbpf_prog_attachr� �formatr� r� )r� � attachable_fdr� �flagsr5 r r r � attach_func� s �zBPF.attach_funcc C sH t | tj�std��t�| j||�}|dk rDtd�|t� | ����d S )Nr# r z7Failed to detach BPF function with attach_type {0}: {1}) r r� r� r� r Zbpf_prog_detach2r� r$ r� r� )r� r% r� r5 r r r � detach_func� s �zBPF.detach_funcc C s� t |�}t| tj�s td��t�|�}|dk rLt�t � � �}td||f ��t� || j �}|dk r�t�t � � �}td||f ��|| _ d S )Nr# r z Failed to open raw device %s: %s�%Failed to attach BPF to device %s: %s)r r r� r� r� r Zbpf_open_raw_sockr� r� r% r� Zbpf_attach_socketr� �sock)r� �devr* r� r5 r r r �attach_raw_socket� s �zBPF.attach_raw_socketc C s� dt }z@t|d��"}tdd� |D ��}W d � n1 s<0 Y W n< ty� } z$|jtjkrh|�tg �}W Y d }~n d }~0 0 dt }z@t|d��"}tdd� |D ��}W d � n1 s�0 Y W n> t�y } z$|jtjkr�|�tg �}W Y d }~n d }~0 0 g }d} d} tdd���L} | D �]4} | �� �� d d � \} }| dk�rh|d k�r�d } �q,n | d k�r�|d k�r,d } �q,| dk�r�|dk�r�d } �q,n|dk�r�d } �q,n | d k�r�|dk�r,d } �q,|�d��r�q,nB|�d��s,|�d��r�q,n$|�d��r�q,nt � d|��r&�q,| � � dv �r,t � | |��r,||v�r,||v �r,|� |� �q,W d � n1 �sz0 Y t|�S )Nz%s/kprobes/blacklistr� c S s g | ]}|� � �� d �qS )r ��rstripr� ��.0�liner r r � <listcomp>� r� z,BPF.get_kprobe_functions.<locals>.<listcomp>z%%s/tracing/available_filter_functionsc S s g | ]}|� � �� d �qS )r r- r/ r r r r2 � r� r �/proc/kallsymsr r> s __init_begins __init_endr s __irqentry_text_starts __irqentry_text_ends _kbl_addr_s __perfs perf_s __SCT__s ^.*\.cold(\.\d+)?$)� t� w)�DEBUGFSr� �set�IOErrorr� r� r. r� � startswith�re�match�lower� fullmatchr� )�event_reZblacklist_fileZ blacklist_fZ blacklistr� Zavail_filter_fileZavail_filter_fZ avail_filterr� Zin_init_sectionZin_irq_sectionZ avail_filer1 r� r� r r r �get_kprobe_functions� sp 4 4 ��.zBPF.get_kprobe_functionsc C s t | t�� krtd��d S )Nz/Number of open probes would exceed global quota)r r� �get_probe_limitr� )r) Znum_new_probesr r r �_check_probe_quota s zBPF._check_probe_quotac C s( t j�d�} | r | �� r t| �S tS d S )NZBCC_PROBE_LIMIT)r� r� �get�isdigitr �_default_probe_limit)Zenv_probe_limitr r r r@ s zBPF.get_probe_limitc C s. || j vri | j |< || j | |< td7 ad S �Nr �r� r )r) �ev_name�fn_namer� r r r �_add_kprobe_fd% s zBPF._add_kprobe_fdc C s | j | |= td8 ad S rE rF )r) rG rH r r r �_del_kprobe_fd, s zBPF._del_kprobe_fdc C s || j |< td7 ad S rE �r� r )r) r1 r� r r r �_add_uprobe_fd1 s zBPF._add_uprobe_fdc C s | j |= td8 ad S rE rK �r) r1 r r r �_del_uprobe_fd6 s zBPF._del_uprobe_fdc C s0 | j D ] }| �d| �dkr| S q| j d S )Ns %sbpfr7 r )�_syscall_prefixes�ksymname)r) �prefixr r r �get_syscall_prefix> s zBPF.get_syscall_prefixc C s t |�}| �� | S r )r rR rM r r r �get_syscall_fnnameG s zBPF.get_syscall_fnnamec C s< t |�}| jD ](}|�|�r| �|t|�d � � S q|S r )r rO r9 rS r� )r) r1 rQ r r r �fix_syscall_fnnameN s zBPF.fix_syscall_fnnamec C s t |�}t |�}t |�}|r�t�|�}| �t|�� d}g }|D ]6}z| j||d� W q@ |d7 }|�|� Y q@0 q@|t|�kr�td|d�|�f ��d S | �d� | � |tj �} d|� dd�� d d� } t � | jd| ||d�} | dk r�td||f ��| �| || � | S ) Nr ��eventrH r zwFailed to attach BPF program %s to kprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")�/� p_� +� _� .)r r� r? rA r� � attach_kprober� r� r� r� rZ �replacer �bpf_attach_kprober� rI ) r) rV Z event_offrH r> �matches�failed�probesr1 r� rG r� r r r r\ U s: � �zBPF.attach_kprobec C s t |�}t |�}t |�}|r�t�|�}d}g }|D ]8}z| j|||d� W q2 |d7 }|�|� Y q20 q2|t|�kr�td|d�|�f ��d S | �d� | � |tj �} d|� dd�� d d� } t � | jd| |d|�} | dk r�td||f ��| �| || � | S ) Nr )rV rH � maxactiver zzFailed to attach BPF program %s to kretprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")rW � r_rY rZ r[ )r r� r? �attach_kretprober� r� r� r� rA r� rZ r] r r^ r� rI ) r) rV rH r> rb r_ r` ra r1 r� rG r� r r r rd w s< � � �zBPF.attach_kretprobec C s4 t |�}t| j| �� �}|D ]}| �||� q d S r )r r r� �keys�detach_kprobe_event_by_fn)r) rG Zfn_namesrH r r r �detach_kprobe_event� s zBPF.detach_kprobe_eventc C s� t |�}t |�}|| jvr&td| ��t�| j| | �}|dk rJtd��| �||� t| j| �dkr�t�|�}|dk r�td��d S )NzKprobe %s is not attachedr zFailed to close kprobe FDz Failed to detach BPF from kprobe)r r� r� r �bpf_close_perf_event_fdrJ r� Zbpf_detach_kprobe)r) rG rH r5 r r r rf � s z BPF.detach_kprobe_event_by_fnc C sH t |�}d|�dd��dd� }|r:t |�}| �||� n | �|� d S )NrX rY rZ r[ �r r] rf rg �r) rV rH rG r r r � detach_kprobe� s zBPF.detach_kprobec C sH t |�}d|�dd��dd� }|r:t |�}| �||� n | �|� d S )Nrc rY rZ r[ ri rj r r r �detach_kretprobe� s zBPF.detach_kretprobec C sn t | �} t|tj�s td��t�| |j|�}|dk rjt� � }|t j krPtd��nt � |�}td| |f ��dS )zt This function attaches a BPF function to a device on the device driver level (XDP) r# r zMInternal error while attaching BPF to device, try increasing the debug level!r) N)r r r� r� r� r �bpf_attach_xdpr� r% r� r� ZEBADMSGr� r� )r+ r� r& r5 Zerr_nor� r r r � attach_xdp� s �zBPF.attach_xdpc C s@ t | �} t�| d|�}|dk r<t�t�� �}td| |f ��dS )zw This function removes any BPF function from a device on the device driver level (XDP) r7 r z'Failed to detach BPF from device %s: %sN)r r rm r� r� r% r� r� )r+ r& r5 r� r r r � remove_xdp� s �zBPF.remove_xdpc C s� t |�}t |�}t� }|dkr"dn|}t�|||p4d|t�d t�t��t�|��dk rnt d|� � |� � f ��|j | }t�|j tj �j} t�|j � | |fS )Nr7 r z.could not determine address of symbol %s in %s)r r r Zbcc_resolve_symnamer% r& r' r r, r� r� r. r- r/ r0 �bcc_procutils_free) r� r- Zsymnamer2 r* �sym_offr4 Zc_pid�new_addrZ module_pathr r r �_check_path_symbol� s& ��� zBPF._check_path_symbolc C sL t | �} |rt�| |�}n t�| d�}|s.dS t�|tj�j}t�|� |S )a& Find the full path to the shared library whose name starts with "lib{libname}". If non-zero pid is given, search only the shared libraries mapped by the process with this pid. Otherwise, search the global ldconfig cache at /etc/ld.so.cache. Examples: BPF.find_library(b"c", pid=12345) # returns b"/usr/lib/x86_64-linux-gnu/libc.so.6" BPF.find_library(b"pthread") # returns b"/lib/x86_64-linux-gnu/libpthread.so.0" BPF.find_library(b"nonexistent") # returns None r N) r r Z!bcc_procutils_which_so_in_processZbcc_procutils_which_sor% r& r/ r0 rp )Zlibnamer* r5 Zlibpathr r r � find_library� s zBPF.find_libraryc C s� g }t j�td�}t �|�D ]t}t j�||�}t j�|�s<q t �|�D ]H}t j�||�}t j�|�rFd||f }t�| �� |�rF|� |� � � qFq |S )N�eventsz%s:%s) r� r� r� �TRACEFS�listdir�isdirr: r; r� r� r� )�tp_re�resultsZ events_dir�categoryZcat_dirrV �evt_dir�tpr r r �get_tracepoints s zBPF.get_tracepointsc C s t j�td| |�}t j�|�S )Nru )r� r� r� rv rx )r{ rV r| r r r �tracepoint_exists s zBPF.tracepoint_existsc C s� t |�}t |�}t |�}|r>t�|�D ]}| j||d� q&dS | �|tj�}|�d�\}}t�|j ||�}|dk r�t d||f ��|| j |< | S )a� attach_tracepoint(tp="", tp_re="", fn_name="") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd can be used to filter the probe. The tracepoint specification is simply the tracepoint category and the tracepoint name, separated by a colon. For example: sched:sched_switch, syscalls:sys_enter_bind, etc. Instead of a tracepoint name, a regular expression can be provided in tp_re. The program will then attach to tracepoints that match the provided regular expression. To obtain a list of kernel tracepoints, use the tplist tool or cat the file /sys/kernel/debug/tracing/available_events. Examples: BPF(text).attach_tracepoint(tp="sched:sched_switch", fn_name="on_switch") BPF(text).attach_tracepoint(tp_re="sched:.*", fn_name="on_switch") �r} rH N� :r z0Failed to attach BPF program %s to tracepoint %s) r r� r~ �attach_tracepointr� r@ r� r Zbpf_attach_tracepointr� r� r� )r) r} ry rH r� � tp_category�tp_namer� r r r r� s � zBPF.attach_tracepointc C s` t |�}|| jv r td| ��t |�}| �|tj�}t�|j|�}|dk rRtd��|| j|< | S )a� attach_raw_tracepoint(self, tp=b"", fn_name=b"") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The bpf function should be loaded as a RAW_TRACEPOINT type. The fn_name is the kernel tracepoint name, e.g., sched_switch, sys_enter_bind, etc. Examples: BPF(text).attach_raw_tracepoint(tp="sched_switch", fn_name="on_switch") z#Raw tracepoint %s has been attachedr z&Failed to attach BPF to raw tracepoint) r r� r� r� r� rh r Zbpf_attach_raw_tracepointr� )r) r} rH r� r� r r r �attach_raw_tracepointF s zBPF.attach_raw_tracepointc C s: t |�}|| jvr td| ��t�| j| � | j|= dS )z�detach_raw_tracepoint(tp="") Stop running the bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_raw_tracepoint("sched_switch") z!Raw tracepoint %s is not attachedN)r r� r� r� �close)r) r} r r r �detach_raw_tracepoint^ s zBPF.detach_raw_tracepointc C s |� | �s| | }|S r )r9 )rQ r1 r r r � add_prefixm s zBPF.add_prefixc C s2 t �� dkrdS t�� s dS t�d�dkr.dS dS )NZx86_64FZbpf_trampoline_link_progr7 T)r� r� r �bpf_has_kernel_btfr� rP r r r r � support_kfuncs s zBPF.support_kfuncc C s" t �� s dS t�d�dkr dS dS )NFs bpf_lsm_bpfr7 T)r r� r� rP r r r r � support_lsm s zBPF.support_lsmc C sF t |�}t�d|�}|| jvr*td| ��t�| j| � | j|= d S )N� kfunc__z$Kernel entry func %s is not attached)r r� r� r� r� r� r� �r) rH r r r � detach_kfunc� s zBPF.detach_kfuncc C sF t |�}t�d|�}|| jvr*td| ��t�| j| � | j|= d S )N� kretfunc__z#Kernel exit func %s is not attached)r r� r� r� r� r� r� r� r r r �detach_kretfunc� s zBPF.detach_kretfuncc C sb t |�}t�d|�}|| jv r*td| ��| �|tj�}t�|j �}|dk rTtd��|| j|< | S )Nr� z&Kernel entry func %s has been attachedr z)Failed to attach BPF to entry kernel func) r r� r� r� r� r� rj r �bpf_attach_kfuncr� �r) rH r� r� r r r � attach_kfunc� s zBPF.attach_kfuncc C sb t |�}t�d|�}|| jv r*td| ��| �|tj�}t�|j �}|dk rTtd��|| j|< | S )Nr� z%Kernel exit func %s has been attachedr z(Failed to attach BPF to exit kernel func) r r� r� r� r� r� rj r r� r� r� r r r �attach_kretfunc� s zBPF.attach_kretfuncc C sF t |�}t�d|�}|| jvr*td| ��t�| j| � | j|= d S )N� lsm__zLSM %s is not attached)r r� r� r� r� r� r� r� r r r � detach_lsm� s zBPF.detach_lsmc C sb t |�}t�d|�}|| jv r*td| ��| �|tj�}t�|j �}|dk rTtd��|| j|< | S )Nr� zLSM %s has been attachedr zFailed to attach LSM) r r� r� r� r� r� rk r Zbpf_attach_lsmr� r� r r r � attach_lsm� s zBPF.attach_lsmc C s$ t �d�dks t �d�dkr dS dS )NZbpf_find_raw_tracepointr7 Zbpf_get_raw_tracepointTF)r� rP r r r r �support_raw_tracepoint� s �zBPF.support_raw_tracepointc C sz d} t | ��Z}|D ]B}|�� �dd�\}}}|�d�d }|dkr W d � dS qW d � dS 1 sl0 Y d S ) Nr3 � r � r Zbpf_trace_modulesTF)r� r. r� )ZkallsymsZsymsr1 �_r1 r r r � support_raw_tracepoint_in_module� s z$BPF.support_raw_tracepoint_in_modulec C s t | �} t |�}t�| |�S r )r r �kernel_struct_has_field)Z struct_name� field_namer r r r� � s zBPF.kernel_struct_has_fieldc C st t |�}|| jvr td| ��t�| j| �}|dk r>td��|�d�\}}t�||�}|dk rhtd��| j|= dS )z�detach_tracepoint(tp="") Stop running a bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_tracepoint("sched:sched_switch") z Tracepoint %s is not attachedr z$Failed to detach BPF from tracepointr� N)r r� r� r rh r� Zbpf_detach_tracepoint)r) r} r5 r� r� r r r �detach_tracepoint� s zBPF.detach_tracepointc C s, t �||||||||�} | dk r(td��| S )Nr z"Failed to attach BPF to perf event)r Zbpf_attach_perf_eventr� ) r) �progfd�ev_type� ev_config� sample_period� sample_freqr* �cpu�group_fdr5 r r r �_attach_perf_event� s �zBPF._attach_perf_eventc C s~ t |�}| �|tj�} i } |dkrB| �| j|||||||�| |< n*t� D ]"} | �| j|||||| |�| | < qH| | j||f< d S �Nr )r r� r� r^ r� r� r r� ) r) r� r� rH r� r� r* r� r� r� r5 r� r r r �attach_perf_event s � � zBPF.attach_perf_eventc C s. t �|t�|�|||d�}|dk r*td��|S )Nr z&Failed to attach BPF to perf raw event)r Zbpf_attach_perf_event_rawr% r, r� )r) r� �attrr* r� r� r5 r r r �_attach_perf_event_raw s �zBPF._attach_perf_event_rawc C sv t |�}| �|tj�}i }|dkr<| �|j||||�||< n$t� D ] }| �|j||||�||< qB|| j|j|j f< d S r� ) r r� r� r^ r� r� r r� r Zconfig) r) r� rH r* r� r� r� r5 r� r r r �attach_perf_event_raw s � � zBPF.attach_perf_event_rawc C sv z| j ||f }W n" ty4 td�||���Y n0 d}|�� D ]}t�|�pR|}qB|dkrftd��| j ||f= d S )Nz)Perf event type {} config {} not attachedr z$Failed to detach BPF from perf event)r� r r� r$ �valuesr rh )r) r� r� Zfdsr5 r� r r r �detach_perf_event& s � zBPF.detach_perf_eventc C s t dd� t�| |�D ��S )Nc S s g | ] \}}|�qS r r )r0 r1 r� r r r r2 6 r� z*BPF.get_user_functions.<locals>.<listcomp>�r7 r� � get_user_functions_and_addresses�r1 �sym_rer r r �get_user_functions4 s �zBPF.get_user_functionsc C s t dd� t�| |�D ��S )a� We are returning addresses here instead of symbol names because it turns out that the same name may appear multiple times with different addresses, and the same address may appear multiple times with the same name. We can't attach a uprobe to the same address more than once, so it makes sense to return the unique set of addresses that are mapped to a symbol that matches the provided regular expression. c S s g | ] \}}|�qS r r )r0 r� �addressr r r r2 C r� z*BPF.get_user_addresses.<locals>.<listcomp>r� r� r r r �get_user_addresses9 s �zBPF.get_user_addressesc sN t | �} t ���g � � �fdd�}t�| t|��}|dk rJtd|| f ��� S )Nc s" | }t ��|�r � �||f� dS r� )r: r; r� )Zsym_namer2 Zdname�� addressesr� r r �sym_cbK s z4BPF.get_user_functions_and_addresses.<locals>.sym_cbr z"Error %d enumerating symbols in %s)r r Zbcc_foreach_function_symbolr r� )r1 r� r� r5 r r� r r� F s z$BPF.get_user_functions_and_addressesc C sN |dkr(d|| j �dtj�|��|f S d|| j �dtj�|��||f S d S )Nr7 s %s_%s_0x%xrZ s %s_%s_0x%x_%d)� _probe_repl�subr� r� �basename)r) rQ r� r2 r* r r r �_get_uprobe_evnameV s zBPF._get_uprobe_evnamec C s� |dks J �|dur$|dks$J d��t |�}t |�}t |�}t |�}|r�t�||�}| �t|�� |D ]} | j|| ||d� qfdS t�|||||�\} }| �d� | �|tj�} | � d| ||�} t � | j d| | ||�} | dk r�t d��| �| | � | S )a� attach_uprobe(name="", sym="", sym_re="", addr=None, fn_name="" pid=-1, sym_off=0) Run the bpf function denoted by fn_name every time the symbol sym in the library or binary 'name' is encountered. Optional parameters pid, cpu, and group_fd can be used to filter the probe. If sym_off is given, attach uprobe to offset within the symbol. The real address addr may be supplied in place of sym, in which case sym must be set to its default value. If the file is a non-PIE executable, addr must be a virtual address, otherwise it must be an offset relative to the file load address. Instead of a symbol name, a regular expression can be provided in sym_re. The uprobe will then attach to symbols that match the provided regular expression. Libraries can be given in the name argument without the lib prefix, or with the full path (/usr/lib/...). Binaries can be given only with the full path (/bin/sh). If a PID is given, the uprobe will attach to the version of the library used by the process. Example: BPF(text).attach_uprobe("c", "malloc") BPF(text).attach_uprobe("/usr/bin/python", "main") r Nz!offset with addr is not supported�r1 r2 rH r* r � pz Failed to attach BPF to uprobe)r r� r� rA r� � attach_uprobers r� rZ r� r �bpf_attach_uprober� r� rL )r) r1 r4 r� r2 rH r* rq r� �sym_addrr� r� rG r� r r r r� ^ s0 � zBPF.attach_uprobec C s� t |�}t |�}t |�}t |�}|rLt�||�D ]}| j||||d� q0dS t�||||�\}}| �d� | �|tj�} | �d|||�} t � | j d| |||�} | dk r�t d��| � | | � | S )a6 attach_uretprobe(name="", sym="", sym_re="", addr=None, fn_name="" pid=-1) Run the bpf function denoted by fn_name every time the symbol sym in the library or binary 'name' finishes execution. See attach_uprobe for meaning of additional parameters. r� Nr � rr z!Failed to attach BPF to uretprobe)r r� r� �attach_uretprobers rA r� rZ r� r r� r� r� rL ) r) r1 r4 r� r2 rH r* r� r� r� rG r� r r r r� � s& � zBPF.attach_uretprobec C s^ || j vrtd| ��t�| j | �}|dk r6td��t�|�}|dk rPtd��| �|� d S )NzUprobe %s is not attachedr z Failed to detach BPF from uprobe)r� r� r rh Zbpf_detach_uproberN )r) rG r5 r r r �detach_uprobe_event� s zBPF.detach_uprobe_eventc C sD t |�}t |�}t�|||||�\}}| �d|||�}| �|� dS )z�detach_uprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. r� N�r r� rs r� r� )r) r1 r4 r2 r* rq r� rG r r r � detach_uprobe� s zBPF.detach_uprobec C sB t |�}t |�}t�||||�\}}| �d|||�}| �|� dS )z�detach_uretprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. r� Nr� )r) r1 r4 r2 r* r� rG r r r �detach_uretprobe� s zBPF.detach_uretprobec C sh t dt�| j��D �]N}t�| j|�}|�d�r^| �|tj�}| j | � |dd � �|j d� q|�d�r�| �|tj�}| j | � |dd � �|j d� q|�d�r�| �|tj �}|j td�d � �dd �}| j||j d � q|�d ��r| �|tj�}|j td �d � }| j||j d � q|�d ��r2| j|d � q|�d��rL| j|d � q|�d�r| j|d � qd S )Nr s kprobe__r! rU s kretprobe__rO s tracepoint__s __r� r� s raw_tracepoint__r� )rH r� r� )r� r r� r- r� r9 r� r� rZ r\ rT r1 rd r@ r� r] r� rh r� r� r� r� )r) r� r� r� r} r r r r� � s8 � � zBPF._trace_autoloadc C sN | j sHtdt d�| _ |rH| j �� }t�|tj�}t�|tj|tjB � | j S )zWtrace_open(nonblocking=False) Open the trace_pipe if not already open z %s/trace_piper� ) r� r� rv �fileno�fcntlZF_GETFLZF_SETFLr� � O_NONBLOCK)r) � nonblockingr� Zflr r r � trace_open� s zBPF.trace_openc C s | � |�}|s|rdS |�d�r"q |dd� �� }|dd� }|�d�}z |d|� �� \}}}}W n0 ty� } zW Y d} ~ q W Y d} ~ n d} ~ 0 0 |dd� }||d d� }|�d�} || d d� } z |t|�t|�|t|�| fW S t�y } zW Y d} ~ d S d} ~ 0 0 q dS ) z�trace_fields(nonblocking=False) Read from the kernel debug trace pipe and return a tuple of the fields (task, pid, cpu, flags, timestamp, msg) or None if no line was read (nonblocking=True) )NNNNNNs CPU:Nr" rT r� r r7 r )�Unknownr r r� g r� )�trace_readliner9 �lstrip�findr� r� r r ) r) r� r1 ZtaskZts_endr* r� r& �tsr� Zsym_end�msgr r r � trace_fields s$ " zBPF.trace_fieldsc C s8 | � |�}d}z|�d��� }W n ty2 Y n0 |S )z�trace_readline(nonblocking=False) Read from the kernel debug trace pipe and return one line If nonblocking is False, this will block until ctrl-C is pressed. NrL )r� �readliner. r8 )r) r� Ztracer1 r r r r� ) s zBPF.trace_readlinec C sF |r"| j dd�}|sq |j|� }n | jdd�}t|� tj�� q dS )a trace_print(self, fmt=None) Read from the kernel debug trace pipe and print on stdout. If fmt is specified, apply as a format string to the output. See trace_fields for the members of the tuple example: trace_print(fmt="pid {1}, msg = {5}") F)r� N)r� r$ r� �printr� �stdout�flush)r) �fmtr r1 r r r � trace_print9 s zBPF.trace_printc C s6 | dk r| dkrd} | t jvr,t| �t j| < t j| S )z�_sym_cache(pid) Returns a symbol cache for the specified PID. The kernel symbol cache is accessed by providing any PID less than zero. r r7 )r� � _sym_cachesr$ )r* r r r � _sym_cacheL s zBPF._sym_cachec C s4 t t| ��}|�d�dkr�t� }t� }| j|_| j|_| j|j_t � t j t �|�t �|��}|dk r�|jr�|jr�d|jt �|jt j�j } } } q�d| d } } } q�|j|jt �|jt j�j } } } nt �|��| |�\} } } |r�| dur�d| nd} | p�d} | | } |�r(| du�r(dtj�| � nd} | | S ) ay sym(addr, pid, show_module=False, show_offset=False) Translate a memory address into a function name for a pid, which is returned. When show_module is True, the module name is also included. When show_offset is True, the instruction offset as a hexadecimal number is also included in the string. A pid of less than zero will access the kernel symbol cache. Example output when both show_module and show_offset are True: "start_thread+0x202 [libpthread-2.24.so]" Example output when both show_module and show_offset are False: "start_thread" Zbpf_stack_build_idr7 r Ns +0x%xr� s [unknown]s [%s])r r r� r r �statusZbuild_idr. �ur Zbcc_buildsymcache_resolver� � _bsymcacher% r, r- r& r/ r0 r1 r� r6 r� r� r� ) r2 r* � show_module� show_offsetr3 Z typeofaddrr4 �br5 r1 r. r- r r r r4 Y s> � � � ���zBPF.symc C s t �| d||d�S )a� ksym(addr) Translate a kernel memory address into a kernel function name, which is returned. When show_module is True, the module name ("kernel") is also included. When show_offset is true, the instruction offset as a hexadecimal number is also included in the string. Example output when both show_module and show_offset are True: "default_idle+0x0 [kernel]" r7 F)r� r4 )r2 r� r� r r r �ksym� s zBPF.ksymc C s t �d��d| �S )z�ksymname(name) Translate a kernel name into an address. This is the reverse of ksym. Returns -1 when the function name is unknown.r7 N)r� r� r9 )r1 r r r rP � s z BPF.ksymnamec C s t | j�S )z�num_open_kprobes() Get the number of open K[ret]probes. Can be useful for scenarios where event_re is used while attaching and detaching probes. )r� r� r r r r �num_open_kprobes� s zBPF.num_open_kprobesc C s t | j�S )zInum_open_uprobes() Get the number of open U[ret]probes. )r� r� r r r r �num_open_uprobes� s zBPF.num_open_uprobesc C s t | j�S )zLnum_open_tracepoints() Get the number of open tracepoints. )r� r� r r r r �num_open_tracepoints� s zBPF.num_open_tracepointsc C sH t jt| j� � }t| j�� �D ]\}}|||< q t�t|�||� dS )z�perf_buffer_poll(self) Poll from all open perf ring buffers, calling the callback that was provided when calling open_perf_buffer for each entry. N)r% r� r� r� r� r� r Zperf_reader_poll)r) �timeout�readersr� �vr r r �perf_buffer_poll� s zBPF.perf_buffer_pollc C sF t jt| j� � }t| j�� �D ]\}}|||< q t�t|�|� dS )z�perf_buffer_consume(self) Consume all open perf buffers, regardless of whether or not they currently contain events data. Necessary to catch 'remainder' events when wakeup_events > 1 is set in open_perf_buffer N)r% r� r� r� r� r� r Zperf_reader_consume)r) r� r� r� r r r �perf_buffer_consume� s zBPF.perf_buffer_consumec C s | � |� dS )zMkprobe_poll(self) Deprecated. Use perf_buffer_poll instead. N)r� �r) r� r r r � kprobe_poll� s zBPF.kprobe_pollc C sL | j s&t�|||�| _ | j sHtd��n"t�| j |||�}|dk rHtd��d S )NzCould not open ring bufferr )r� r Zbpf_new_ringbufr� Zbpf_add_ringbuf)r) r r� �ctx�retr r r �_open_ring_buffer� s zBPF._open_ring_bufferc C s | j std��t�| j |� dS )z�ring_buffer_poll(self) Poll from all open ringbuf buffers, calling the callback that was provided when calling open_ring_buffer for each entry. �No ring buffers to pollN)r� r� r Zbpf_poll_ringbufr� r r r �ring_buffer_poll� s zBPF.ring_buffer_pollc C s | j std��t�| j � dS )a/ ring_buffer_consume(self) Consume all open ringbuf buffers, regardless of whether or not they currently contain events data. This is best for use cases where low latency is desired, but it can impact performance. If you are unsure, use ring_buffer_poll instead. r� N)r� r� r Zbpf_consume_ringbufr r r r �ring_buffer_consume� s zBPF.ring_buffer_consumec C s t �� S r )r Zbcc_free_memoryr r r r �free_bcc_memory� s zBPF.free_bcc_memoryc C sP zt �tj| �� � W n4 tyJ } z tdt|� � W Y d}~n d}~0 0 dS )zJadd_module(modname) Add a library or exe to buildsym cache z&Error adding module to build sym cacheN)r Z bcc_buildsymcache_add_moduler� r� r� r� r� r )�modnamer� r r r � add_module� s zBPF.add_modulec C s dS )zthe do nothing exit handlerNr r r r r r� s z BPF.donothingc C sH t | j�� �D ] \}}t�|j� | j|= q| jrDt�| j� d| _dS )zvclose(self) Closes all associated files descriptors. Attached BPF programs are not detached. N) r r� r� r� r� r� r- r Zbpf_module_destroy)r) r1 r� r r r r� s z BPF.closec C s� t | j�� �D ]\}}| �|� qt | j�� �D ]\}}| �|� q0t | j�� �D ]\}}| �|� qRt | j�� �D ]\}}| � |� qtt | j �� �D ]\}}| � |� q�t | j �� �D ]\}}| � |� q�t | j�� �D ]\}}| �|� q�t | j�� �}|D ] }t| j| t��r | j|= �q t | j�� �D ]\}}| �||� �q0| j�r`| j�� d | _| �� | j�r�t�| j� d | _d S r )r r� r� rg r� r� r� r� r� r� r� r� r� r� r� r� r� re r r r� r� r� r� r� r Zbpf_free_ringbuf)r) �kr� Z table_keysr r� r� r r r r� s6 z BPF.cleanupc C s | S r r r r r r � __enter__6 s z BPF.__enter__c C s | � � d S r )r� )r) �exc_typeZexc_valZexc_tbr r r �__exit__9 s z BPF.__exit__)Nr7 )F)NNN)r )r� r r� r� )r� r� r� r )N)N)r )r )r )r )r� r� r� )r� r� )r� )r� )r� )r� )r� )r� )r� )r� )r7 r7 r� r r r7 r7 r7 )r7 r� r7 r7 r7 )r7 r7 )r� r� r� Nr� r7 r )r� r� r� Nr� r7 )r� r� Nr7 r )r� r� Nr7 )F)F)F)N)FFT)FF)r7 )r7 )N)r7 )�r: r; r< rN rY rZ r[ r\ r@ r] r^ r_ r` ra rb rc rd re rf rg rh ri rj rk r} r~ r r� r� r� r� r� ZXDP_FLAGS_UPDATE_IF_NOEXISTr� ZXDP_FLAGS_SKB_MODEr� ZXDP_FLAGS_DRV_MODEr� ZXDP_FLAGS_HW_MODEr� ZXDP_FLAGS_REPLACEr: �compiler� r� r Zbcc_buildsymcache_newr� r� rO r� r% r r� ZCDLLZ_librt� clock_gettimer� Zc_intr' �argtypes� classmethodr� r� r �objectr� � staticmethodr� r� r+ r� r� r� r� r Zc_boolZc_charZc_wcharZc_ubyteZc_shortZc_ushortZc_uintr� Zc_ulongZ c_longlongr8 Zc_floatZc_doubleZ c_longdoubleZc_int64Zc_uint64r r r r r r r! r" r' r( r, r? rA r@ rI rJ rL rN rR rS rT r\ rd rg rf rk rl rn ro rs rt r~ r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r4 r� rP r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� s� � � i � + K " " & � � 9 � # 0 #r� )DZ __future__r r� Zctypesr% r� r r� r: r� r� r� Zlibbccr r r r r �tabler r r r r Zperfr Zutilsr r r r r �versionr Z disassemblerr r r� r r r � NameErrorr rD r r r6 r� r� rv r� Z DEBUG_LLVM_IRr� ZDEBUG_PREPROCESSORZ DEBUG_SOURCEr� Z DEBUG_BTFr� r$ r= rB rF rH rN rl r} r� r� r r r r �<module> sV + *
Close
