1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
package main
import "C"
import (
"os"
"runtime"
"time"
"unsafe"
"fmt"
"syscall"
bpf "github.com/aquasecurity/libbpfgo"
)
func resizeMap(module *bpf.Module, name string, size uint32) error {
m, err := module.GetMap("events")
if err != nil {
return err
}
if err = m.Resize(size); err != nil {
return err
}
if actual := m.GetMaxEntries(); actual != size {
return fmt.Errorf("map resize failed, expected %v, actual %v", size, actual)
}
return nil
}
func main() {
bpfModule, err := bpf.NewModuleFromFile("main.bpf.o")
if err != nil {
fmt.Fprintln(os.Stderr, err)
os.Exit(-1)
}
defer bpfModule.Close()
if err = resizeMap(bpfModule, "events", 8192); err != nil {
fmt.Fprintln(os.Stderr, err)
os.Exit(-1)
}
bpfModule.BPFLoadObject()
prog, err := bpfModule.GetProgram("kprobe__sys_mmap")
if err != nil {
fmt.Fprintln(os.Stderr, err)
os.Exit(-1)
}
testerMap, err := bpfModule.GetMap("tester")
if err != nil {
fmt.Fprintln(os.Stderr, err)
os.Exit(-1)
}
if testerMap.Name() != "tester" {
fmt.Fprintln(os.Stderr, "wrong map")
os.Exit(-1)
}
if testerMap.Type() != bpf.MapTypeHash {
fmt.Fprintln(os.Stderr, "wrong map type")
os.Exit(-1)
}
key1 := uint32(1)
value1 := struct{ x int }{50}
key1Unsafe := unsafe.Pointer(&key1)
value1Unsafe := unsafe.Pointer(&value1)
testerMap.Update(key1Unsafe, value1Unsafe)
key2 := int64(42069420)
value2 := []byte{'a', 'b', 'c'}
key2Unsafe := unsafe.Pointer(&key2)
value2Unsafe := unsafe.Pointer(&value2[0])
testerMap.Update(key2Unsafe, value2Unsafe)
funcName := fmt.Sprintf("__%s_sys_mmap", ksymArch())
_, err = prog.AttachKprobe(funcName)
if err != nil {
fmt.Fprintln(os.Stderr, err)
os.Exit(-1)
}
eventsChannel := make(chan []byte)
lostChannel := make(chan uint64)
pb, err := bpfModule.InitPerfBuf("events", eventsChannel, lostChannel, 1)
if err != nil {
fmt.Fprintln(os.Stderr, err)
os.Exit(-1)
}
pb.Poll(300)
go func() {
time.Sleep(time.Second)
syscall.Mmap(999, 999, 999, 1, 1)
syscall.Mmap(999, 999, 999, 1, 1)
}()
ev := <-eventsChannel
fmt.Println("Received ", string(ev))
pb.Stop()
pb.Close()
}
func ksymArch() string {
switch runtime.GOARCH {
case "amd64":
return "x64"
case "arm64":
return "arm64"
default:
panic("unsupported architecture")
}
}
|
