CODEWITHSUNDEEP
ebpfbccbcc-bpf
bbpfuser
bbpfuser

Reputation: 1

How to get syscall table address with eBPF (BCC)

I want to use Kprobe in eBPF to fetch the syscall addresses from the syscall table. How can I perform this task?

I wrote, but I do not know how to find the symbol table corresponding to the kernel.

Upvotes: 0

Views: 188

Answers (1)

ANISH SAJI KUMAR
ANISH SAJI KUMAR

Reputation: 130

There are a few ways to do this:

  1. Use the bpf_probe_read() function to read the syscall table from memory.

  2. Use the bpf_kprobe__read() function to read the syscall table from the kernel's kprobes.

  3. Use the bpf_usdt_read() function to read the syscall table from the kernel's USDT probes.

Upvotes: 0

Related Questions