réseau kprobe




echo 'p:test_kprobe sys_bind fd=%di sa_family=+0(%si):u16 sin_port=+2(%si):u16 sin_addr=+4(%si):u32 sun_path=+2(%si):string sin6_port=+2(%si):u16 sin6_addr_high=+8(%si):u64 sin6_addr_low=+16(%si):u64' > /sys/kernel/debug/tracing/kprobe_events
echo 1 > /sys/kernel/debug/tracing/events/kprobes/test_kprobe/enable
echo > /sys/kernel/debug/tracing/trace&&cat /sys/kernel/debug/tracing/trace


echo 'p:test_kprobe sys_connect fd=%di sa_family=+0(%si):u16 sin_port=+2(%si):u16 sin_addr=+4(%si):u32 sun_path=+2(%si):string sin6_port=+2(%si):u16 sin6_addr_high=+8(%si):u64 sin6_addr_low=+16(%si):u64' > /sys/kernel/debug/tracing/kprobe_events


sin_port=24862

Guess you like

Origin blog.csdn.net/SHELLCODE_8BIT/article/details/131543497