kprobe

kprobe是内核提供的探测内核代码的一种机制,有助于开发人员跟踪内核代码运行状态。

1,three types

--Kprobes, Jprobes, Return Probes


2, arch support

--- i386
---arm

---...

 

3,configs

--CONFIG_KPROBES

--CONFIG_MODULES

--CONFIG_MODULE_UNLOAD

--CONFIG_KALLSYMS

--CONFIG_KALLSYMS_ALL

--CONFIG_DEBUG_INFO

 

4,API

register_kprobe

#include <linux/kprobes.h>
int register_kprobe(struct kprobe *kp);

 

 

User's pre-handler (kp->pre_handler):

#include <linux/kprobes.h>
#include <linux/ptrace.h>
int pre_handler(struct kprobe *p, struct pt_regs *regs);

 

User's post-handler (kp->post_handler):

#include <linux/kprobes.h>
#include <linux/ptrace.h>
void post_handler(struct kprobe *p, struct pt_regs *regs,
        unsigned long flags);

 

User's fault-handler (kp->fault_handler):

#include <linux/kprobes.h>
#include <linux/ptrace.h>
int fault_handler(struct kprobe *p, struct pt_regs *regs, int trapnr);

 

 

register_jprobe

#include <linux/kprobes.h>
int register_jprobe(struct jprobe *jp)

 

register_kretprobe

#include <linux/kprobes.h>
int register_kretprobe(struct kretprobe *rp);

 

User's return-probe handler (rp->handler):

#include <linux/kprobes.h>
#include <linux/ptrace.h>
int kretprobe_handler(struct kretprobe_instance *ri, struct pt_regs *regs);

 

unregister_*probe

#include <linux/kprobes.h>
void unregister_kprobe(struct kprobe *kp);
void unregister_jprobe(struct jprobe *jp);
void unregister_kretprobe(struct kretprobe *rp);

 

register_*probes
#include <linux/kprobes.h>
int register_kprobes(struct kprobe **kps, int num);
int register_kretprobes(struct kretprobe **rps, int num);
int register_jprobes(struct jprobe **jps, int num);

 

unregister_*probes
#include <linux/kprobes.h>
void unregister_kprobes(struct kprobe **kps, int num);
void unregister_kretprobes(struct kretprobe **rps, int num);
void unregister_jprobes(struct jprobe **jps, int num);

 

disable_*probe
#include <linux/kprobes.h>
int disable_kprobe(struct kprobe *kp);
int disable_kretprobe(struct kretprobe *rp);
int disable_jprobe(struct jprobe *jp);

 

enable_*probe
#include <linux/kprobes.h>
int enable_kprobe(struct kprobe *kp);
int enable_kretprobe(struct kretprobe *rp);
int enable_jprobe(struct jprobe *jp);

 

http://lxr.linux.no/linux+v2.6.31/samples/kprobes/

 

http://lxr.linux.no/linux+v2.6.31/Documentation/kprobes.txt

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值