⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.144
Server IP:
157.245.143.252
Server:
Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software:
nginx/1.26.0
PHP Version:
8.3.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
usr
/
lib
/
python3
/
dist-packages
/
bcc
/
__pycache__
/
View File Name :
__init__.cpython-312.pyc
fu l d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl Z ddl m Z mZmZmZmZ ddlmZmZmZmZmZ ddlmZ ddlmZm Z m Z m Z m Z ddl m!Z! dd l"m#Z#m$Z$ dd l%m&Z&m'Z' e( d Z+d a,d Z-d Z.ej^ ja e.d Z1ej^ je e1 sdZ1dZ3dZ4dZ5dZ6dZ7dZ8 G d de9 Z: G d d Z; G d d Z< G d d Z= G d d Z> G d d Z? G d! d" Z@ G d# d$ ZA G d% d& ZB G d' d(e9 ZCy# e)$ r e*Z(Y w xY w)) )print_functionN )lib bcc_symbolbcc_symbol_optionbcc_stacktrace_build_id _SYM_CB_TYPE)TablePerfEventArrayRingBufBPF_MAP_TYPE_QUEUEBPF_MAP_TYPE_STACK)Perf)get_online_cpusprintb_assert_is_bytes ArgString StrcmpRewrite) __version__)disassemble_prog decode_map)USDT USDTExceptioni c t S N)_num_open_probes ./usr/lib/python3/dist-packages/bcc/__init__.py_get_num_open_probesr + s r z/sys/kernel/debugtracingz/sys/kernel/tracing c e Zd Zd Zd Zd Zy) SymbolCachec t j |t j d t j t | _ y r )r bcc_symcache_newctcastPOINTERr cache)selfpids r __init__zSymbolCache.__init__D s/ ))RWWT2::.?#@AC r c t }|r5t j | j |t j | }n4t j | j |t j | }|dk rb|j rQ|j rEd|j t j |j t j j fS d|dfS |r5|j }t j t j | n |j }||j t j |j t j j fS )a Return a tuple of the symbol (function), its offset from the beginning of the function, and the module in which it lies. For example: ("start_thread", 0x202, "/usr/lib/.../libpthread-2.24.so") If the symbol cannot be found but we know which module it is in, return the module name and the offset from the beginning of the module. If we don't even know the module, return the absolute address as the offset. r N)r r bcc_symcache_resolver. r+ byref bcc_symcache_resolve_no_demanglemoduleoffsetr, c_char_pvalue demangle_name bcc_symbol_free_demangle_namename)r/ addrdemanglesymresname_ress r resolvezSymbolCache.resolveH s l **4::tRXXc]KC66tzz479xx}FC 7zzcjj cjj BKK8>>@ @$% % ((H - -bhhsm <xxH#**bggcjj"++&F&L&LMMr c t | }t | }t j }t j | j ||t j | dk ry|j S )Nr )r r+ c_ulonglongr bcc_symcache_resolve_namer. r4 r9 )r/ r6 r< r= s r resolve_namezSymbolCache.resolve_namee sZ !&) %~~ ( (VT "# $zzr N)__name__ __module__ __qualname__r1 rB rG r r r r( r( C s CN:r r( c $ e Zd ZdZdZdZdZdZdZy)PerfTyper r r" r# N) rH rI rJ HARDWARESOFTWARE TRACEPOINTHW_CACHERAW BREAKPOINTr r r rL rL n s HHJH CJr rL c 4 e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z y ) PerfHWConfigr r r" rM r# rN r$ N) rH rI rJ CPU_CYCLES INSTRUCTIONSCACHE_REFERENCES CACHE_MISSESBRANCH_INSTRUCTIONS BRANCH_MISSES BUS_CYCLESSTALLED_CYCLES_FRONTENDSTALLED_CYCLES_BACKENDREF_CPU_CYCLESr r r rV rV w s8 JLLMJ Nr rV c 8 e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z y ) PerfSWConfigr r r" rM r# rN rW rX r$ rY N)rH rI rJ CPU_CLOCK TASK_CLOCK PAGE_FAULTSCONTEXT_SWITCHESCPU_MIGRATIONSPAGE_FAULTS_MINPAGE_FAULTS_MAJALIGNMENT_FAULTSEMULATION_FAULTSDUMMY BPF_OUTPUTr r r re re s< IJKNOO EJr re c p e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZy)PerfEventSampleFormatr r" r# r$ r% r& @ i i i i i @ i i i i i i i i @ i i N) rH rI rJ IPTIDTIMEADDRREAD CALLCHAINIDCPUPERIOD STREAM_IDrS BRANCH_STACK REGS_USER STACK_USERWEIGHTDATA_SRC IDENTIFIER TRANSACTION REGS_INTR PHYS_ADDRAUXCGROUPDATA_PAGE_SIZECODE_PAGE_SIZE WEIGHT_STRUCTr r r rs rs s B C D D DI B CFI CLIJFHJKII CF N N Mr rs c ` e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZy) BPFProgTyper r" rM r# rN rW rX r$ rY rf r% N)rH rI rJ SOCKET_FILTERKPROBE SCHED_CLS SCHED_ACTrQ XDP PERF_EVENT CGROUP_SKB CGROUP_SOCKLWT_INLWT_OUTLWT_XMITSOCK_OPSSK_SKB CGROUP_DEVICESK_MSGRAW_TRACEPOINTCGROUP_SOCK_ADDRCGROUP_SOCKOPTTRACINGLSMr r r r r sl M FIIJ CJJK FGHH FM FNNG Cr r c e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Z!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)y()) BPFAttachTyper r r" rM r# rN rW rX r$ rY rf r r r r r r% r r r r r r& ! " # $ % & N)*rH rI rJ CGROUP_INET_INGRESSCGROUP_INET_EGRESSCGROUP_INET_SOCK_CREATECGROUP_SOCK_OPSSK_SKB_STREAM_PARSERSK_SKB_STREAM_VERDICTr SK_MSG_VERDICTCGROUP_INET4_BINDCGROUP_INET6_BINDCGROUP_INET4_CONNECTCGROUP_INET6_CONNECTCGROUP_INET4_POST_BINDCGROUP_INET6_POST_BINDCGROUP_UDP4_SENDMSGCGROUP_UDP6_SENDMSG LIRC_MODE2FLOW_DISSECTOR CGROUP_SYSCTLCGROUP_UDP4_RECVMSGCGROUP_UDP6_RECVMSGCGROUP_GETSOCKOPTCGROUP_SETSOCKOPT TRACE_RAW_TP TRACE_FENTRY TRACE_FEXIT MODIFY_RETURNLSM_MAC TRACE_ITERCGROUP_INET4_GETPEERNAMECGROUP_INET6_GETPEERNAMECGROUP_INET4_GETSOCKNAMECGROUP_INET6_GETSOCKNAME XDP_DEVMAPCGROUP_INET_SOCK_RELEASE XDP_CPUMAP SK_LOOKUPr SK_SKB_VERDICTr r r r r s O MN JNM LLKMGJ ! ! ! ! J ! JI CNr r c e Zd ZdZdZdZdZdZy) XDPActionr r r" rM r# N)rH rI rJ XDP_ABORTEDXDP_DROPXDP_PASSXDP_TX XDP_REDIRECTr r r r r s KHH FLr r c e Zd ZdZdZdZdZdZy)XDPFlagsr r" r# r$ r% N)rH rI rJ UPDATE_IF_NOEXISTSKB_MODEDRV_MODEHW_MODEREPLACEr r r r r s HHGGr r c e Zd Zej Zej Zej Zej Zej Zej Z ej Z ej Z ej Z ej Z ej Zej Zej Zej" Zej$ Zej& Zej( Zej* Zej, Zej. Zej2 Zej4 Zej6 Zej8 Z ej: Z e j> Z e jB Z"e jF Z$e jJ Z&e jN Z( e)jT d Z+i Z, e-j\ Z/dgddgddgdgdd gd Z0g d Z1d Z2 G d de3jh Z5 e3jl dd Z7e7jp Z9e3jt e3jv e5 ge9_< e=d Z>e=d Z?e@Z@ G d deA ZBeCd ZDeCd ZEddddg g dddf d ZFefd ZGdd ZHd ZId ZJdd!ZKi d"e3j d#e3j d$e3j d%e3j d&e3j d'e3j d(e3jt d)e3j d*e3j d+e3j d,e3j d-e3j d.e3j d/e3j d0e3j d1e3j d2z d3e3j d2z Z\eCd4 Z]dd5Z^d6 Z_d7 Z`d8 Zad9 Zbd: ZceCdd; ZdeCd< ZeeCd= ZfeCd> Zgd? ZheCd@ ZidA ZjdB ZkdC ZldD ZmdE ZndF ZodG ZpddHZqddIZrdJ ZsdK ZtddLZuddMZveCddN ZweCddO Zxe=ddP ZyeCdQ ZzeCdR Z{eCdS Z|ddTZ}ddUZ~ddVZeCdW ZeCdX ZeCdY ZddZZdd[Zdd\Zdd]Zdd^Zdd_ZeCd` ZeCda ZeCdb ZddcZdd Z ddeZdf ZddgZddhZeCdi ZeCdj ZeCdk Zdl Z ddmZ ddnZdo ZddpZddqZdr ZddsZddtZdduZddvZeCdw ZeCddx ZeCddy ZeCdz Zd{ Zd| Zd} Zdd~Zd ZddZddZddZd Zd ZeCd Zd Zd Zd Zd Zd Zy)BPFs [^a-zA-Z0-9_]timefsfilebiorequestallocsk_buff net_device)z linux/time.hz linux/fs.hzlinux/blkdev.hz linux/slab.hzlinux/netdevice.h)s sys_s __x64_sys_s __x32_compat_sys_s __ia32_compat_sys_s __arm64_sys_s __s390x_sys_s __s390_sys_r c D e Zd Zdej fdej fgZy) BPF.timespectv_sectv_nsecN)rH rI rJ r+ c_long_fields_r r r timespecr C s ryy)Iryy+ABr r z librt.so.1T) use_errnoc $ | j }| j | j t j | dk7 r3t j }t |t j | |j dz |j z S )zmonotonic_time() Returns the system monotonic time from clock_gettime, using the CLOCK_MONOTONIC constant. The time returned is in nanoseconds. r g eA) r _clock_gettimeCLOCK_MONOTONICr+ r4 get_errnoOSErrorosstrerrorr r )clsterrnos r monotonic_timezBPF.monotonic_timeJ sj LLN c 1 1288A; ?1 DLLNE%U!34 4xx#~ ))r c d}| j j D ]% \ }}|D ] }|D ] }||v s||vs |d|z z } ' |S )a1 Generates #include statements automatically based on a set of recognized types such as sk_buff and bio. The input is all the words that appear in the BPF program, and the output is a (possibly empty) string of #include statements, such as "#include <linux/fs.h>". z#include <%s> )_auto_includesitems)r program_wordsheadersheaderkeywordskeywordwords r generate_auto_includeszBPF.generate_auto_includesV s` # 2 2 8 8 : FH# )D $6+@ #4v#== * $ !; r c e Zd Zd Zy) BPF.Functionc . || _ || _ || _ y r )bpfr< fd)r/ r r< r! s r r1 zBPF.Function.__init__j s DH DIDGr N)rH rI rJ r1 r r r Functionr i s r r" c | rt j j | st t j d }dj t j j t j j |j | g }t j j | r|} | S t d| z | S )z1 If filename is invalid, search in ./ of argv[0] r /zCould not find file %s) r pathisfiler sysargvjoinabspathdirname __bytes__ Exception)filenameargv0r s r _find_filezBPF._find_fileo s 77>>(+!#((1+.IIrwwrwwu?P/Q RT\ ]^77>>!$ H $$<x$GHHr c h d }t j j | \ }}|r || r| S yt j d j t j D ]M }|j d }t j j |j | } || sK|c S y)a find_exe(bin_path) Traverses the PATH environment variable, looking for the first directory that contains an executable file named bin_path, and returns the full path to that file, or None if no such file can be found. This is meant to replace invocations of the "which" shell utility, which doesn't have portable semantics for skipping aliases. c t j j | xr$ t j | t j S r )r r% r& accessX_OK)fpaths r is_exez BPF.find_exe.<locals>.is_exe s. 77>>%( * %) *r PATH"N)r r% splitenvironpathsepstripr) encode)bin_pathr6 r5 fnamer% exe_files r find_exez BPF.find_exe| s * ww}}X. u h 6*00<zz# 77<< x@(##O = r r Nr Fc t | }t | }t | }|r|rJ i | _ i | _ i | _ i | _ i | _ i | _ i | _ i | _ i | _ d| _ d| _ t j | j || _ i | _ i | _ d| _ t' j( t+ | z } t- | D ] \ } } t/ t1 | | | < |r*t2 j5 | }t2 j5 | }|r&t7 |d 5 } | j9 }ddd t' j: t+ | z }t- | D ]+ \ } }t' j: |j= || < - t? j@ |t+ | }| tC d ||z }t? jD || j | t+ | || | _ | j$ stC d|xs dz |D ] }|jG | | | jI y# 1 sw Y xY w)aZ Create a new BPF module with the given source code. Note: All fields are marked as optional, but either `src_file` or `text` must be supplied, and not both. Args: src_file (Optional[str]): Path to a source file for the module hdr_file (Optional[str]): Path to a helper header file for the `src_file` text (Optional[str]): Contents of a source file for the module debug (Optional[int]): Flags used for debug prints, can be |'d together See "Debug flags" for explanation Nrb)modezycan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple locationsz Failed to compile BPF module %sz<text>)%r kprobe_fds uprobe_fdstracepoint_fdsraw_tracepoint_fdskfunc_entry_fdskfunc_exit_fdslsm_fds perf_buffersopen_perf_events_ringbuf_manager tracefileatexitregistercleanupdebugfuncstablesr6 r+ r8 len enumeratebytesr r r0 openreadc_void_p get_contextr bcc_usdt_genargsr- bpf_module_create_c_from_stringattach_uprobes_trace_autoload)r/ src_filehdr_filetextrS cflags usdt_contexts allow_rlimitdeviceattach_usdt_ignore_pid cflags_arrayisr ctx_arrayusdt usdt_text usdt_contexts r r1 z BPF.__init__ s# " $H-#H- %X&& "$ ! " $ % c&k14 f%DAqy|9L|A% ~~h/H~~h/H hT*dyy{ + [[3}#558 /GAt ;;t'7'7'9:IaL 0((C 4FG ( ) ) 4 99$:>**:FLHY:FP {{ =AUX VW W )L ' '.D E * 9 +*s 5II c g }t dt j | j D ]C }t j | j | }|j | j || E |S )zload_funcs(prog_type=KPROBE) Load all functions in this BPF module with the given type. Returns a list of the function handles.r )ranger bpf_num_functionsr6 bpf_function_nameappend load_func)r/ prog_typefnsrj func_names r load_funcszBPF.load_funcs s] q#// <=A--dkk1=I JJt~~i; < > r c t | }|| j v r| j | S t j | j | st d|z d}| j t z rd}n| j t z rd}t j | j ||t j | j | t j | j | t j | j t j | j |d d|| }|dk rt j | j t! j" t$ j& k( r t d t) j* t! j" }t d|d| t, j/ | || }|| j |< |S )NUnknown program %sr r" r z!Need super-user privileges to runzFailed to load BPF program : )r rT r bpf_function_startr6 r- rS DEBUG_BPF_REGISTER_STATE DEBUG_BPF bcc_func_loadbpf_function_sizebpf_module_licensebpf_module_kern_versionrP rQ donothingr+ r r EPERMr r r r" ) r/ rx rv rg attach_type log_levelr! errstrfns r ru z BPF.load_func sn $Y/ "::i( (%%dkk9= 09 <= = JJ1 1Ijj9$I t{{Iy&&t{{I>%%dkk9=&&t{{3++DKK84FK 9 6 OODNN +||~, CDD[[ 0F & 0 1 1 \\$ 2 . " 9 r c t | }t j | j | st d|z t j | j | }t j | j | }t j || S )zR Return the eBPF bytecodes for the specified function as a string r{ )r r r} r6 r- r r+ string_at)r/ rx startsizes r dump_funcz BPF.dump_func sp %Y/ %%dkk9= 09 <= ='' Y?%%dkk9=||E4((r c < | j | }t || S r )r r )r/ rx bpfstrs r disassemble_funczBPF.disassemble_func" s * 622r c ~ | | }t j | j |j }t |||| S )N)sizeinfo)r bpf_table_type_idr6 map_idr )r/ table_namer table_obj table_types r decode_tablezBPF.decode_table& s9 $ **4;; 8H8HI *ihOOr _Boolcharwchar_tz unsigned charshortzunsigned shortintz unsigned intlongz unsigned longz long longzunsigned long longfloatdoublez long double__int128r" zunsigned __int128c t | t rt j | S g }g }| d D ] }t | dk( r-|j |d t j |d f ?t | dk( r t |d t r6|j |d t j |d |d d z f t |d t r1|j |d t j |d |d f t |d t ri|d dk( s|d dk( s|d dk( rQ|d }|dk( r d t | z }|j | |j |t j | f Wt d t | z t d t | z t j }d }t | dkD rL| d dk( rt j }n3| d dk( rt j }n| d dk( rt j }d }|r(t t | d |ft |d| }|S t t | d |ft || }|S )Nr r" r rM unionstruct struct_packedr z__anon%dzFailed to decode type %sFT) _anonymous__pack_r )r r ) isinstance basestringr str2ctyperV rt _decode_table_typelistr r- strr+ StructureUniontypedict)descanonfieldsr r< base is_packedr s r r zBPF._decode_table_type> sA dJ '==& &aA1v{ qtS%;%;AaD%A BCQ1 adD)MM1Q4)?)?!)E!Q)O"PQ !c*MM1Q4)?)?!)Eqt"LM !j1!(AaDI,=! 00 Q4Drz )CI 5 D)MM4)?)?)B"CD#$>Q$GHH :SV CDD' ( || t9q=Aw("xxaI%||a ,,|| s47|dWdtA /! "C s47|dWdt /! "C r c t | }t j | j | }t j | j | }t j | j | t t fv }|dk rt |si|sgt j | j | j d }|st d|z t j t j | }|sgt j | j | j d } | st d|z t j t j | }t# | |||||| S )Nr zutf-8z$Failed to load BPF Table %s key descz%Failed to load BPF Table %s leaf desc)reducer)r r bpf_table_idr6 bpf_table_fdr r r KeyErrorbpf_table_key_descdecoder- r r jsonloadsbpf_table_leaf_descr ) r/ r< keytypeleaftyper r map_fd is_queuestackkey_desc leaf_descs r get_tablez BPF.get_tablej s! %!!$++t4!!$++t4--dkk6BGY[mFnn A:N}--dkk4@GGPH F MNN,,TZZ-ABG// TBII'RI G$ NOO--djj.CDHT667HdGTTr c x || j vr | j | | j |< | j | S r )rU r r/ keys r __getitem__zBPF.__getitem__} s4 dkk ! #~~c 2DKK {{3 r c " || j |< y r rU )r/ r leafs r __setitem__zBPF.__setitem__ s Cr c , t | j S r )rV rU r/ s r __len__z BPF.__len__ s 4;; r c | j |= y r r r s r __delitem__zBPF.__delitem__ s KK r c 6 | j j S r )rU __iter__r s r r z BPF.__iter__ s {{##%%r c t | t j s t d t j | j ||| }|dk r/t dj |t j | y )N"arg 1 must be of type BPF.Functionr z7Failed to attach BPF function with attach_type {0}: {1}) r r r" r- r bpf_prog_attachr! formatr r )r attachable_fdr flagsr@ s r attach_funczBPF.attach_func sm "cll+ @A A!!"%% UK 7 ''-vk2;;t;L'MO O r c t | t j s t d t j | j || }|dk r/t dj |t j | y )Nr r z7Failed to detach BPF function with attach_type {0}: {1}) r r r" r- r bpf_prog_detach2r! r r r )r r r r@ s r detach_funczBPF.detach_func sk "cll+ @A A""255-E 7 ''-vk2;;t;L'MO O r c t | }t | t j s t d t j | }|dk r8t j t j }t d|d| t j || j }|dk r8t j t j }t d|d| || _ y )Nr r zFailed to open raw device r| Failed to attach BPF to device )r r r r" r- r bpf_open_raw_sockr r r+ r bpf_attach_socketr! sock)r devr r r@ s r attach_raw_socketzBPF.attach_raw_socket s s#"cll+ @A A$$S) !8[[ 0F#v NO O##D"%%0 7[[ 0FF $ % %r c < dt z } t |d 5 }t |D cg c]# }|j j d % c} }d d d dt z } t |d 5 }t |D cg c]# }|j j d % c} }d d d g } d} d} t dd 5 } | D ] }|j j dd \ } }| dk( r|dk( rd} 5| dk( r|d k( rd } B| dk( r|d k( rd} O|d k( rd } W| dk( r|d k( rd } d|j d rv|j d s|j d r|j d rt j d| r| j dv st j | | s|vs|v s| j | d d d t | S c c}w # 1 sw Y xY w# t $ r5}|j t j k7 r|t g }Y d }~d }~ww xY wc c}w # 1 sw Y xY w# t $ r5}|j t j k7 r|t g }Y d }~d }~ww xY w# 1 sw Y t | S xY w)Nz%s/kprobes/blacklistrC r z%%s/tracing/available_filter_functionsr /proc/kallsymsrM s __init_begins __init_endr" s __irqentry_text_starts __irqentry_text_ends _kbl_addr_s __perfs perf_s __SCT__s ^.*.cold(.d+)?$) t w)DEBUGFSrY setrstripr9 IOErrorr r startswithrematchlower fullmatchrt )event_reblacklist_file blacklist_fline blacklisteavail_filter_fileavail_filter_f avail_filterrw in_init_sectionin_irq_section avail_filer r s r get_kprobe_functionszBPF.get_kprobe_functions s /'9 nd+{ k Rkd !4!4!6q!9k R S , Dg M #'.. " #X DKKM$7$7$9!$< #X Y / "D )Z" ++---/!4B #a'_,*+ $)]**+ "Q& 55)* 55)* #q( 33)* == / ]]9- x1H ]]:. XX 0"5 GGI -2<<"3M)+l*JJrNa # *d 3xK !S ,+ ww%++%BI $Y /. #ww%++% r7L # *d 3xs G4 G'(G" G'G4 " I . H:8(H5 H:'I CJJ0J5J:J"G''G1,G4 4 H2=*H--H25H::I?I J*J JJc V t |z t j kD r t d y )Nz/Number of open probes would exceed global quota)r r get_probe_limitr- )r/ num_new_probess r _check_probe_quotazBPF._check_probe_quota s* n ,s/B/B/D D MN N Er c t j j d } | r| j r t | S t S )NBCC_PROBE_LIMIT)r r: getisdigitr _default_probe_limit)env_probe_limits r r zBPF.get_probe_limit s4 **..):; 6 6 8' '' 'r c t || j vri | j |< || j | |< t dz ay Nr rE r )r/ ev_namefn_namer! s r _add_kprobe_fdzBPF._add_kprobe_fd s: $// )')DOOG $,. )A r c 6 | j | |= t dz ay r r )r/ r r s r _del_kprobe_fdzBPF._del_kprobe_fd s OOG $W -A r c 4 || j |< t dz ay r rF r )r/ r< r! s r _add_uprobe_fdzBPF._add_uprobe_fd s " A r c 0 | j |= t dz ay r r r/ r< s r _del_uprobe_fdzBPF._del_uprobe_fd s OOD !A r c x | j D ] }| j d|z dk7 s|c S | j d S )Ns %sbpfrD r )_syscall_prefixesksymname)r/ prefixs r get_syscall_prefixzBPF.get_syscall_prefix$ s@ ,,F}}X ./25 - %%a((r c > t | }| j |z S r )r r r s r get_syscall_fnnamezBPF.get_syscall_fnname- s %&&(4//r c t | }| j D ]2 }|j | s| j |t | d c S |S r )r r r r! rV )r/ r< r s r fix_syscall_fnnamezBPF.fix_syscall_fnname4 sK %,,Fv&..tCKL/ABB - r c t | }t | }t | }|r~t j | }| j t | d}g }|D ] } | j || |t | k( r!t d|ddj | d y | j d | j |t j } d|j d d j d d z } t j | j d| ||d } | dk rt d|d|d | j | || | S # |dz }|j | Y xY w) Nr eventr r Failed to attach BPF program z to kprobe /K, it's not traceable (either non-existing, inlined, or marked as "notrace") p_ + _ .)r r r r rV attach_kprobert r- r) ru r replacer bpf_attach_kprober! r ) r/ r& event_offr r matchesfailedprobesr r r r! s r r. zBPF.attach_kprobe; s[ '"7+#H- ..x8G # #CL 1FF (&&T7&C W % !(#((6*:!< = = " ^^GSZZ 0%--d3;;D$GG " "255!WeY J 6 $e - . . GWb1 %(aKFMM$'s EE#c t | }t | }t | }|ret j | }d}g }|D ] } | j ||| |t | k( r!t d|ddj | d y | j d | j |t j } d|j d d j d d z } t j | j d| |d| } | dk rt d|d|d | j | || | S # |dz }|j | Y xY w) Nr )r& r maxactiver r' z to kretprobe r( r) r_r+ r, r- )r r r attach_kretprobert rV r- r) r ru r r/ r r0 r! r ) r/ r& r r r6 r2 r3 r4 r r r r! s r r8 zBPF.attach_kretprobe] sP '"7+#H- ..x8GFF ())g4= * ? W % !(#((6*:!< = = " ^^GSZZ 0%--d3;;D$GG " "255!WeQ J 6 $e - . . GWb1 %(aKFMM$'s D//E c t | }t | j | j }|D ] }| j || y r )r r rE keysdetach_kprobe_event_by_fn)r/ r fn_namesr s r detach_kprobe_eventzBPF.detach_kprobe_event sB "7+05578 G * *7G < r c x t | }t | }|| j vrt d|z t j | j | | }|dk r t d | j || t | j | dk( r&t j | }|dk r t d y y )NzKprobe %s is not attachedr zFailed to close kprobe FDz Failed to detach BPF from kprobe)r rE r- r bpf_close_perf_event_fdr rV bpf_detach_kprobe)r/ r r r@ s r r; z BPF.detach_kprobe_event_by_fn s "7+"7+ $// ) 7' AB B))$//'*B7*KL 7 78 8 GW- tw' (A -''0CQw BCC .r c t | }d|j dd j dd z }|r t | }| j || y | j | y )Nr* r+ r, r- r r/ r; r= r/ r& r r s r detach_kprobezBPF.detach_kprobe Y '%--d3;;D$GG &w/G * *7G < $ $W -r c t | }d|j dd j dd z }|r t | }| j || y | j | y )Nr7 r+ r, r- rB rC s r detach_kretprobezBPF.detach_kretprobe rE r c ` t | } t |t j s t d t j | |j | }|dk rXt j }|t j k( r t d t j | }t d| d| y)zt This function attaches a BPF function to a device on the device driver level (XDP) r r zMInternal error while attaching BPF to device, try increasing the debug level!r r| N)r r r r" r- r bpf_attach_xdpr! r+ r r EBADMSGr r )r r r r@ err_nor s r attach_xdpzBPF.attach_xdp s s#"cll+ @A A beeU3 7\\^F & !7 8 8 V, "F!, - - r c t | } t j | d| }|dk r8t j t j }t d| d| y)zw This function removes any BPF function from a device on the device driver level (XDP) rD r z!Failed to detach BPF from device r| N)r r rI r r r+ r r- )r r r@ r s r remove_xdpzBPF.remove_xdp sY s# b%0 7[[ 0F "F , - - r c @ t | }t | }t }|dk( rdn|}t j |||xs d|t j d t j t t j | dk r-t d|j d|j |j |z }t j |j t j j } t j |j | |fS )NrD r z&could not determine address of symbol z in )r r r bcc_resolve_symnamer+ r, r- r r4 r- r r7 r6 r8 r9 bcc_procutils_free) r r6 symnamer= r0 sym_offr? c_pidnew_addr module_paths r _check_path_symbolzBPF._check_path_symbol s !&)"7+lBYC " " G KC GGD"**%67 8 HHSM &~~ / B C C::'ggcjj"++6<< szz*H$$r c t | } t j | d }|sy t j |t j j }t j | |S Nr )r r bcc_procutils_which_sor+ r, r8 r9 rQ )libnamer@ libpaths r find_libraryzBPF.find_library sQ "7+((!4''#r{{+11 s#r c P g }t j j t d }t j | D ] }t j j || }t j j | sCt j | D ] }t j j || }t j j | sC|d|}t j | j | so|j |j |S )Nevents:) r r% r) TRACEFSlistdirisdirr r r rt r= )tp_reresults events_dircategorycat_dirr& evt_dirtps r get_tracepointszBPF.get_tracepoints s WW\\'84 :.Hggll:x8G77==)G, '',,w677==)%-u5Bxx 3 ryy{3 - / r c t j j t d| | }t j j | S )Nr_ )r r% r) ra rc )rg r& ri s r tracepoint_existszBPF.tracepoint_exists s- '',,w(EBww}}W%%r c t | }t | }t | }|r.t j | D ] }| j || y| j |t j }|j d \ }}t j |j || }|dk rt d|d| || j |< | S )a attach_tracepoint(tp="", tp_re="", fn_name="") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd can be used to filter the probe. The tracepoint specification is simply the tracepoint category and the tracepoint name, separated by a colon. For example: sched:sched_switch, syscalls:sys_enter_bind, etc. Instead of a tracepoint name, a regular expression can be provided in tp_re. The program will then attach to tracepoints that match the provided regular expression. To obtain a list of kernel tracepoints, use the tplist tool or cat the file /sys/kernel/debug/tracing/available_events. Examples: BPF(text).attach_tracepoint(tp="sched:sched_switch", fn_name="on_switch") BPF(text).attach_tracepoint(tp_re="sched:.*", fn_name="on_switch") rj r N :r r' z to tracepoint ) r r rk attach_tracepointru rQ r9 r bpf_attach_tracepointr! r- rG )r/ rj rd r r tp_categorytp_namer! s r rq zBPF.attach_tracepoint s * b ! '"7+ ))%0&&"g&> 1 ^^GS^^ 4!#$ g & &ruuk7 C 6 $b * + +"$B r c ( t | }|| j v rt d|z t | }| j |t j }t j |j | }|dk r t d || j |< | S )a attach_raw_tracepoint(self, tp=b"", fn_name=b"") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The bpf function should be loaded as a RAW_TRACEPOINT type. The fn_name is the kernel tracepoint name, e.g., sched_switch, sys_enter_bind, etc. Examples: BPF(text).attach_raw_tracepoint(tp="sched_switch", fn_name="on_switch") z#Raw tracepoint %s has been attachedr z&Failed to attach BPF to raw tracepoint) r rH r- ru r r r bpf_attach_raw_tracepointr! )r/ rj r r r! s r attach_raw_tracepointzBPF.attach_raw_tracepoint s b ! (( ( AB FG G"7+ ^^GS%7%7 8 * *255" 5 6 DE E&( # r c t | }|| j vrt d|z t j | j | | j |= y)zdetach_raw_tracepoint(tp="") Stop running the bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_raw_tracepoint("sched_switch") z!Raw tracepoint %s is not attachedN)r rH r- r close)r/ rj s r detach_raw_tracepointzBPF.detach_raw_tracepoint6 sR b ! T,, , ?" DE E ((,- # #B 'r c 2 |j | s| |z }|S r )r )r r< s r add_prefixzBPF.add_prefixE s v&D=D r c t j dk7 ryt j syt j d dk7 ryy)Nx86_64Fbpf_trampoline_link_progrD T)platformmachiner bpf_has_kernel_btfr r r r r support_kfunczBPF.support_kfuncK s? )%%' <<2 3r 9r c ` t j syt j d dk7 ryy)NFs bpf_lsm_bpfrD T)r r r r r r r support_lsmzBPF.support_lsmW s( %%' << '2 -r c t | }t j d| }|| j vrt d|z t j | j | | j |= y )N kfunc__z$Kernel entry func %s is not attached)r r r| rI r- r ry r/ r s r detach_kfunczBPF.detach_kfunc` s` "7+..W5 $.. . BW LM M %%g./ )r c t | }t j d| }|| j vrt d|z t j | j | | j |= y )N kretfunc__z#Kernel exit func %s is not attached)r r r| rJ r- r ry r s r detach_kretfunczBPF.detach_kretfunci s` "7+.. 8 $-- - AG KL L $$W-. (r c < t | }t j d| }|| j v rt d|z | j |t j }t j |j }|dk r t d || j |< | S )Nr z&Kernel entry func %s has been attachedr z)Failed to attach BPF to entry kernel func) r r r| rI r- ru r r bpf_attach_kfuncr! r/ r r r! s r attach_kfunczBPF.attach_kfuncr s "7+..W5 d** * Dw NO O ^^GS[[ 1 ! !"%% ( 6 GH H(* W% r c < t | }t j d| }|| j v rt d|z | j |t j }t j |j }|dk r t d || j |< | S )Nr z%Kernel exit func %s has been attachedr z(Failed to attach BPF to exit kernel func) r r r| rJ r- ru r r r r! r s r attach_kretfunczBPF.attach_kretfunc s "7+.. 8 d)) ) Cg MN N ^^GS[[ 1 ! !"%% ( 6 FG G')G$ r c t | }t j d| }|| j vrt d|z t j | j | | j |= y )N lsm__zLSM %s is not attached)r r r| rK r- r ry r s r detach_lsmzBPF.detach_lsm sZ "7+..73 $,, & 4w >? ? g&' LL !r c < t | }t j d| }|| j v rt d|z | j |t j }t j |j }|dk r t d || j |< | S )Nr zLSM %s has been attachedr zFailed to attach LSM) r r r| rK r- ru r r bpf_attach_lsmr! r s r attach_lsmzBPF.attach_lsm s "7+..73 dll " 6 @A A ^^GSWW - & 6 23 3 " W r c f t j d dk7 st j d dk7 ryy)Nbpf_find_raw_tracepointrD bpf_get_raw_tracepointTF)r r r r r support_raw_tracepointzBPF.support_raw_tracepoint s. <<1 2b 8 <<0 1R 7r c d} t | 5 }|D ]I }|j j dd \ }}}|j d d }|dk( sA d d d y d d d y# 1 sw Y y xY w) Nr r" r bpf_trace_modulesTF)rY r r9 )kallsymssymsr _r< s r support_raw_tracepoint_in_modulez$BPF.support_raw_tracepoint_in_module sm $ (^t #{{} 2 23 : Atzz$'*.. ^ ^^s AA'A' A''A0c Z t | } t | }t j | | S r )r r kernel_struct_has_field) struct_name field_names r r zBPF.kernel_struct_has_field s) &{3 %j1 **; CCr c D t | }|| j vrt d|z t j | j | }|dk r t d |j d \ }}t j || }|dk r t d | j |= y)zdetach_tracepoint(tp="") Stop running a bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_tracepoint("sched:sched_switch") z Tracepoint %s is not attachedr z$Failed to detach BPF from tracepointrp N)r rG r- r r? r9 bpf_detach_tracepoint)r/ rj r@ rs rt s r detach_tracepointzBPF.detach_tracepoint s b ! T(( ( ;b @A A))$*=*=b*AB 7 BC C!#$ g'' W= 7 BC C #r c ^ t j |||||||| } | dk r t d | S )Nr z"Failed to attach BPF to perf event)r bpf_attach_perf_eventr- ) r/ progfdev_type ev_config sample_period sample_freqr0 cpugroup_fdr@ s r _attach_perf_eventzBPF._attach_perf_event s< '' {Ch@ 7 @A A r c > t | }| j |t j } i } |dk\ r&| j | j ||||||| | |< n4t D ]' } | j | j |||||| | | | < ) | | j ||f< y rY )r ru r r r r! r rM ) r/ r r r r r r0 r r r r@ rj s r attach_perf_eventzBPF.attach_perf_event s "7+ ^^GS^^ 4 !8..ruugy!;S(DCH %& 00%{CHFA ' 7: w 23r c t j |t j | |||d }|dk r t d |S )Nr z&Failed to attach BPF to perf raw event)r bpf_attach_perf_event_rawr+ r4 r- )r/ r attrr0 r r r@ s r _attach_perf_event_rawzBPF._attach_perf_event_raw s? ++FBHHTNCXq" 7 DE E r c Z t | }| j |t j }i }|dk\ r#| j |j |||| ||< n1t D ]$ }| j |j |||| ||< & || j |j |j f< y rY ) r ru r r r r! r rM r config) r/ r r r0 r r r r@ rj s r attach_perf_event_rawzBPF.attach_perf_event_raw s "7+ ^^GS^^ 4 !822255$h(CH %& 44RUUDQ*A ' ;> tyy$++ 67r c | j ||f }d}|j D ] }t j | xs |} |dk7 r t d | j ||f= y # t $ r t dj || w xY w)Nz)Perf event type {} config {} not attachedr z$Failed to detach BPF from perf event)rM r r- r valuesr r? )r/ r r fdsr@ r! s r detach_perf_eventzBPF.detach_perf_event s %'')(<=C **,B--b18SC !8 BC C ! !7I"6 7 % G N N $ % % %s A# #%Bc r t t j | | D cg c] \ } }| c}} S c c}} w r r r get_user_functions_and_addresses)r< sym_rer s r get_user_functionszBPF.get_user_functions sE 88vFHF 'dADFH I I H 3 c r t t j | | D cg c] \ }}| c}} S c c}}w )a We are returning addresses here instead of symbol names because it turns out that the same name may appear multiple times with different addresses, and the same address may appear multiple times with the same name. We can't attach a uprobe to the same address more than once, so it makes sense to return the unique set of addresses that are mapped to a symbol that matches the provided regular expression. r )r< r r addresss r get_user_addresseszBPF.get_user_addresses sG 88vFHF !-GGFH I I Hr c t | } t g fd}t j | t | }|dk rt d|| fz S )Nc \ | }t j | rj ||f yrY )r r rt )sym_namer= dname addressesr s r sym_cbz4BPF.get_user_functions_and_addresses.<locals>.sym_cb# s+ Exx& % /r r z"Error %d enumerating symbols in %s)r r bcc_foreach_function_symbolr r- )r< r r r@ r s ` @r r z$BPF.get_user_functions_and_addresses s\ %!&) --dL4HI 7 @C; NO Or c |dk( r"d|| j j d| |fz S d|| j j d| ||fz S )NrD s %s_%s_0x%xr, s %s_%s_0x%x_%d) _probe_replsub)r/ r r% r= r0 s r _get_uprobe_evnamezBPF._get_uprobe_evname. sY "9 FD,<,<,@,@t,Ld#SS S $vt/?/?/C/CD$/OQUWZ&[[ [r c t |dk\ sJ | |dk( sJ d t | }t | }t | }t | }|rMt j || }| j t | |D ] } | j || || yt j ||||| \ } }| j d | j |t j } | j d| || } t j | j d| | || } | dk r t d | j | | | S )a attach_uprobe(name="", sym="", sym_re="", addr=None, fn_name="" pid=-1, sym_off=0) Run the bpf function denoted by fn_name every time the symbol sym in the library or binary 'name' is encountered. Optional parameters pid, cpu, and group_fd can be used to filter the probe. If sym_off is given, attach uprobe to offset within the symbol. The real address addr may be supplied in place of sym, in which case sym must be set to its default value. If the file is a non-PIE executable, addr must be a virtual address, otherwise it must be an offset relative to the file load address. Instead of a symbol name, a regular expression can be provided in sym_re. The uprobe will then attach to symbols that match the provided regular expression. Libraries can be given in the name argument without the lib prefix, or with the full path (/usr/lib/...). Binaries can be given only with the full path (/bin/sh). If a PID is given, the uprobe will attach to the version of the library used by the process. Example: BPF(text).attach_uprobe("c", "malloc") BPF(text).attach_uprobe("/usr/bin/python", "main") r Nz!offset with addr is not supportedr< r= r r0 r pz Failed to attach BPF to uprobe)r r r r rV attach_uproberW ru r r r bpf_attach_uprober! r- r )r/ r< r? r r= r r0 rS r sym_addrr% r r r! s r r zBPF.attach_uprobe6 s< : !|| a< D!D D< % s#!&)"7+ ..tV<I # #C N 3 %""8+2 # = & --dCsGL t " ^^GSZZ 0))$dC@ " "255!WdD# F 6 <= = GR( r c t | }t | }t | }t | }|r1t j || D ] }| j |||| yt j |||| \ }}| j d | j |t j } | j d||| } t j | j d| ||| } | dk r t d | j | | | S )a6 attach_uretprobe(name="", sym="", sym_re="", addr=None, fn_name="" pid=-1) Run the bpf function denoted by fn_name every time the symbol sym in the library or binary 'name' finishes execution. See attach_uprobe for meaning of additional parameters. r Nr rr z!Failed to attach BPF to uretprobe)r r r attach_uretproberW r ru r r r r r! r- r ) r/ r< r? r r= r r0 r r% r r r! s r r zBPF.attach_uretprobeo s % s#!&)"7+ 2 24 @%%4h.53 & @ A --dCsC t " ^^GSZZ 0))$dC@ " "255!WdD# F 6 ?@ @ GR( r c || j vrt d|z t j | j | }|dk r t d t j | }|dk r t d | j | y )NzUprobe %s is not attachedr z Failed to detach BPF from uprobe)rF r- r r? bpf_detach_uprober )r/ r r@ s r detach_uprobe_eventzBPF.detach_uprobe_event s| $// ) 7' AB B))$//'*BC 7 >? ?##G, 7 >? ? G$r c t | }t | }t j ||||| \ }}| j d||| }| j | y)zdetach_uprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. r Nr r rW r r )r/ r< r? r= r0 rS r% r s r detach_uprobezBPF.detach_uprobe sX % s#--dCsGL t))$dC@ )r c t | }t | }t j |||| \ }}| j d||| }| j | y)zdetach_uretprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. r Nr )r/ r< r? r= r0 r% r s r detach_uretprobezBPF.detach_uretprobe sV % s#--dCsC t))$dC@ )r c t dt j | j D ]4 }t j | j | }|j d rP| j |t j }| j | j |dd |j |j d rP| j |t j }| j | j |dd |j |j d rg| j |t j }|j t d d j dd }| j! ||j ^|j d rW| j |t j" }|j t d d }| j% ||j |j d r| j' | |j d r| j) | |j d s#| j+ | 7 y )Nr s kprobe__r$ r% s kretprobe__r s tracepoint__s __rp ro s raw_tracepoint__r )r r r )rq r rr r6 rs r ru r r r. r# r< r8 rQ rV r/ rq r rw r r r )r/ rj rx r rj s r r` zBPF._trace_autoload s q#// <=A--dkk1=I##K0^^Iszz:"" 11)AB-@ GG # % %%n5^^Iszz:%% 11)BC.A GG & % %%o6^^Is~~>WWS 1 23;;E4H&&"bgg&>%%&9:^^Is/A/ABWWS!4 5 67**b"''*B%%j1!!)!4%%m4$$Y$7%%h/ 23 >r c N | j st dt z d | _ |rt| j j }t j |t j }t j |t j |t j z | j S )zWtrace_open(nonblocking=False) Open the trace_pipe if not already open z %s/trace_piperC ) rO rY ra filenofcntlF_GETFLF_SETFLr O_NONBLOCK)r/ nonblockingr! fls r trace_openzBPF.trace_open sn ~~ !/G";T BDN^^**,[[U]]3 B rBMM/AB~~ r c | j | }|s|ry|j d r)|dd j }|dd }|j d } |d| j \ }}}}|dd }||dz d }|j d } || d z d } |t | t | |t | | fS # t $ r } Y d} ~ d} ~ ww xY w# t $ r } Y d} ~ y d} ~ ww xY w) ztrace_fields(nonblocking=False) Read from the kernel debug trace pipe and return a tuple of the fields (task, pid, cpu, flags, timestamp, msg) or None if no line was read (nonblocking=True) )NNNNNNs CPU:Nr% r rp r rD r" )Unknownr r r g r )trace_readliner lstripfindr9 r- r r ) r/ r r taskts_endr0 r r tsr sym_endmsgs r trace_fieldszBPF.trace_fields s &&{3DK w'9##%D9DYYt_F &*7Fm&9&9&;#S% a)C $DiioGw{|$C D c#hC%rCHH DC Ds$ B6 "C 6 C C C C c | j | }d} |j d j }|S # t $ r Y |S w xY w)ztrace_readline(nonblocking=False) Read from the kernel debug trace pipe and return one line If nonblocking is False, this will block until ctrl-C is pressed. Nrw )r readliner r )r/ r tracer s r r zBPF.trace_readline sS , >>$'..0D s 6 AAc |r%| j d }|s |j | }n| j d }t | t j j c)a trace_print(self, fmt=None) Read from the kernel debug trace pipe and print on stdout. If fmt is specified, apply as a format string to the output. See trace_fields for the members of the tuple example: trace_print(fmt="pid {1}, msg = {5}") F)r )r r r printr' stdoutflush)r/ fmtr r s r trace_printzBPF.trace_print sa **u*= x!szz6***u*= $K JJ r c | dk r| dk7 rd} | t j vr t | t j | < t j | S )z_sym_cache(pid) Returns a symbol cache for the specified PID. The kernel symbol cache is accessed by providing any PID less than zero. r rD )r _sym_cachesr( )r0 s r _sym_cachezBPF._sym_cache$ sD 7sbyCcoo%#.s#3COOC s##r c t t | }|j d dk7 rXt }t }| j |_ | j |_ | j |j _ t j t j t j | t j | }|dk rf|j rS|j rGd|j t j |j t j" j$ } } } nd| d} } } nz|j& |j t j |j t j" j$ } } } n)t j) | j+ | | \ } } } |r| d| z nd} | xs d} | | z } |r$| "dt, j. j1 | z nd} | | z S ) ay sym(addr, pid, show_module=False, show_offset=False) Translate a memory address into a function name for a pid, which is returned. When show_module is True, the module name is also included. When show_offset is True, the instruction offset as a hexadecimal number is also included in the string. A pid of less than zero will access the kernel symbol cache. Example output when both show_module and show_offset are True: "start_thread+0x202 [libpthread-2.24.so]" Example output when both show_module and show_offset are False: "start_thread" bpf_stack_build_idrD r Ns +0x%xr s [unknown]s [%s])r r r r r statusbuild_idr7 ur bcc_buildsymcache_resolver _bsymcacher+ r4 r6 r, r8 r9 r< r rB r r% basename) r= r0 show_module show_offsetr> typeofaddrr? br@ r< r7 r6 s r r? zBPF.sym1 s ( d_ ??/ 0B 6 #%'![[!(}}!*{{!##*--cnn.0hhqk.0hhsm=# 1Wzzcjj$(#** BKK8>> !6d '+D$FFd$'HHcjj$&GGCJJ $D$J$J !&D "% !4!<!<T8!L $&1d6FF"C#|f}v 1 BGG , ,V 447: f} r c 4 t j | d||d S )a ksym(addr) Translate a kernel memory address into a kernel function name, which is returned. When show_module is True, the module name ("kernel") is also included. When show_offset is true, the instruction offset as a hexadecimal number is also included in the string. Example output when both show_module and show_offset are True: "default_idle+0x0 [kernel]" rD F)r r? )r= r r s r ksymzBPF.ksymb s wwtRk5AAr c L t j d j d| S )zksymname(name) Translate a kernel name into an address. This is the reverse of ksym. Returns -1 when the function name is unknown.rD N)r r rG )r< s r r z BPF.ksymnamep s ~~b!..tT::r c , t | j S )znum_open_kprobes() Get the number of open K[ret]probes. Can be useful for scenarios where event_re is used while attaching and detaching probes. )rV rE r s r num_open_kprobeszBPF.num_open_kprobesx s 4??##r c , t | j S )zInum_open_uprobes() Get the number of open U[ret]probes. )rV rF r s r num_open_uprobeszBPF.num_open_uprobes s 4??##r c , t | j S )zLnum_open_tracepoints() Get the number of open tracepoints. )rV rG r s r num_open_tracepointszBPF.num_open_tracepoints s 4&&''r c t j t | j z }t | j j D ] \ }}|||< t j t | || y)zperf_buffer_poll(self) Poll from all open perf ring buffers, calling the callback that was provided when calling open_perf_buffer for each entry. N)r+ r[ rV rL rW r r perf_reader_poll)r/ timeoutreadersrj vs r perf_buffer_pollzBPF.perf_buffer_poll sa ;;T%6%6!77: d / / 6 6 89DAqGAJ : S\7G<r c t j t | j z }t | j j D ] \ }}|||< t j t | | y)zperf_buffer_consume(self) Consume all open perf buffers, regardless of whether or not they currently contain events data. Necessary to catch 'remainder' events when wakeup_events > 1 is set in open_perf_buffer N)r+ r[ rV rL rW r r perf_reader_consume)r/ r! rj r" s r perf_buffer_consumezBPF.perf_buffer_consume s_ ;;T%6%6!77: d / / 6 6 89DAqGAJ : G g6r c & | j | y)zMkprobe_poll(self) Deprecated. Use perf_buffer_poll instead. N)r# r/ r s r kprobe_pollzBPF.kprobe_poll s g&r c | j s4t j ||| | _ | j s t d y t j | j ||| }|dk r t d y )NzCould not open ring bufferr )rN r bpf_new_ringbufr- bpf_add_ringbuf)r/ r r ctxrets r _open_ring_bufferzBPF._open_ring_buffer sr $$$'$7$7C$HD !(( <== ) %%d&;&;VRMCQw <== r c r | j s t d t j | j | y)zring_buffer_poll(self) Poll from all open ringbuf buffers, calling the callback that was provided when calling open_ring_buffer for each entry. No ring buffers to pollN)rN r- r bpf_poll_ringbufr( s r ring_buffer_pollzBPF.ring_buffer_poll s/ $$ 56 6 T 2 2G<r c p | j s t d t j | j y)a/ ring_buffer_consume(self) Consume all open ringbuf buffers, regardless of whether or not they currently contain events data. This is best for use cases where low latency is desired, but it can impact performance. If you are unsure, use ring_buffer_poll instead. r1 N)rN r- r bpf_consume_ringbufr s r ring_buffer_consumezBPF.ring_buffer_consume s- $$ 56 6 5 56r c * t j S r )r bcc_free_memoryr s r free_bcc_memoryzBPF.free_bcc_memory s ""$$r c t j t j | j y# t $ r!}t dt | z Y d}~yd}~ww xY w)zJadd_module(modname) Add a library or exe to buildsym cache z&Error adding module to build sym cacheN)r bcc_buildsymcache_add_moduler r r= r- r r )modnamer s r add_modulezBPF.add_module sG ? (( 9IJ ? 6s1v=>>?s 25 A AA c y)zthe do nothing exit handlerNr r s r r z BPF.donothing s r c t | j j D ]1 \ }}t j |j | j |= 3 | j r't j | j d| _ yy)zvclose(self) Closes all associated files descriptors. Attached BPF programs are not detached. N) r rT r r ry r! r6 r bpf_module_destroy)r/ r< r s r ry z BPF.close sf TZZ - - /0HD" HHRUUO 4 1 ;; " "4;; / DK r c P t | j j D ] \ }}| j | t | j j D ] \ }}| j | t | j j D ] \ }}| j | t | j j D ] \ }}| j | t | j j D ] \ }}| j | t | j j D ] \ }}| j | t | j j D ] \ }}| j | t | j j# }|D ]- }t% | j | t& s!| j |= / t | j( j# D ] \ }}| j+ || | j, r!| j, j/ d | _ | j/ | j0 r't3 j4 | j0 d | _ y y r )r rE r r= rF r rG r rH rz rI r rJ r rK r rU r: r r rM r rO ry rN r bpf_free_ringbuf)r/ kr" table_keysr r r s r rR z BPF.cleanup s ..01DAq $ $Q ' 2 ..01DAq $ $Q ' 2,,2245DAq " "1 % 6006689DAq & &q ) :--3356DAq a 7,,2245DAq # 6 ++-.DAq OOA / $++**,- C$++c*N;KK$ %))>)>)C)C)E$F Wi " "7I 6 %G >> NN " !DN !6!6 7$(D ! !r c | S r r r s r __enter__z BPF.__enter__ s r c $ | j y r )rR )r/ exc_typeexc_valexc_tbs r __exit__z BPF.__exit__ s r )NrD )F)NNN)r )r r r r )r r r r r )r r r )r r )r )rD rD r r r rD rD rD )rD r rD rD rD )rD rD )r r r Nr rD r )r r r Nr rD )r r NrD r )r r NrD )FFT)FF)rD )rH rI rJ r r r r r rQ r r r r r r r r r r r r r r r r r r r r r r r XDP_FLAGS_UPDATE_IF_NOEXISTr XDP_FLAGS_SKB_MODEr XDP_FLAGS_DRV_MODEr XDP_FLAGS_HW_MODEr XDP_FLAGS_REPLACEr compiler r r bcc_buildsymcache_newr r r r r+ r r CDLL_librt clock_gettimer c_intr- argtypes classmethodr r r objectr" staticmethodr0 rA r1 ry ru r r r c_boolc_charc_wcharc_ubytec_shortc_ushortc_uintr c_ulong c_longlongrE c_floatc_double c_longdoublec_int64c_uint64r r r r r r r r r r r r r r r r r r r r! r# r. r8 r= r; rD rG rL rN rW r] rk rm rq rw rz r| r r r r r r r r r r r r r r r r r r r r r r r r r r r` r r r r r r? r r r r r r# r& r) r/ r3 r6 r9 r= r ry rR rF rK r r r r r s, --M F%%I%%I ''J //C ''J ''J ))K F!!G##H##H F --M F //N"33!!G //C''K!!H!!H F ))L"*"<"< !**!** (( (( "** -.KK***,J Vn ), ' 6 N OC2<< C RWW\T 2F))N !xxH)= >N * * E6 8 !$cARd4#(N ` $* @ )3P ")) BJJ "** "** 2;; "** bmm r~~ "** 2;; RZZ!^!" bkkAo#I& ) )VU& & O O O O I IVO ( ( )0 D D= D .. - -& - - % %$ & &$L0 ( *) " D D $* CFEG : > 8 I I I I \ AE)*7r DH @ % * * 38 !DF & $ $ . . ` B B ; ;$$( = 7'>= 7% ? ?* !)Fr r )D __future__r rP ctypesr+ r r r r r r' r libbccr r r r r tabler r r r r perfr utilsr r r r r versionr disassemblerr r rm r r r NameErrorr r r r r r% r) ra exists DEBUG_LLVM_IRr DEBUG_PREPROCESSOR DEBUG_SOURCEr~ DEBUG_BTFrY r( rL rV re rs r r r r r r r r <module>rw s3 & ] ] Y Y V V 6 % '',,w * ww~~g #G )& )V 8 0( (T P& P} Js 2D) )D32D3