asmlinkage()
if (int_arg(1) != %{ SYS_ACCEPT %}) next;
__args = pointer_arg(2)
- sockfd = __int32(user_ulong(&@cast(__args, "ulong")[0]))
- addr_uaddr = user_ulong(&@cast(__args, "ulong")[1])
- addrlen_uaddr = user_ulong(&@cast(__args, "ulong")[2])
+ sockfd = __int32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[0]))
+ addr_uaddr = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[1])
+ addrlen_uaddr = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[2])
}
probe __nd_syscall.compat_socketcall.accept =
kprobe.function("compat_sys_socketcall").call ?
asmlinkage()
if (int_arg(1) != %{ SYS_ACCEPT %}) next;
__args = pointer_arg(2)
- sockfd = user_int(&@cast(__args, "unsigned int")[0])
- addr_uaddr = user_uint32(&@cast(__args, "unsigned int")[1])
- addrlen_uaddr = user_uint32(&@cast(__args, "unsigned int")[2])
+ sockfd = user_int(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[0])
+ addr_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[1])
+ addrlen_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[2])
}
probe nd_syscall.accept.return = __nd_syscall.accept.return ?,
__nd_syscall.socketcall.accept.return ?
asmlinkage()
if (int_arg(1) != %{ SYS_ACCEPT4 %}) next;
__args = pointer_arg(2)
- sockfd = __int32(user_ulong(&@cast(__args, "ulong")[0]))
- addr_uaddr = user_ulong(&@cast(__args, "ulong")[1])
- addrlen_uaddr = user_ulong(&@cast(__args, "ulong")[2])
- flags = __int32(user_ulong(&@cast(__args, "ulong")[3]))
+ sockfd = __int32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[0]))
+ addr_uaddr = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[1])
+ addrlen_uaddr = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[2])
+ flags = __int32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[3]))
}
probe __nd_syscall.compat_socketcall.accept4 =
kprobe.function("compat_sys_socketcall").call ?
asmlinkage()
if (int_arg(1) != %{ SYS_ACCEPT4 %}) next;
__args = pointer_arg(2)
- sockfd = user_int(&@cast(__args, "unsigned int")[0])
- addr_uaddr = user_uint32(&@cast(__args, "unsigned int")[1])
- addrlen_uaddr = user_uint32(&@cast(__args, "unsigned int")[2])
- flags = user_int(&@cast(__args, "unsigned int")[3])
+ sockfd = user_int(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[0])
+ addr_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[1])
+ addrlen_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[2])
+ flags = user_int(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[3])
}
probe nd_syscall.accept4.return = __nd_syscall.accept4.return ?,
__nd_syscall.socketcall.accept4.return ?
asmlinkage()
if (int_arg(1) != %{ SYS_RECV %}) next;
__args = pointer_arg(2)
- s = __int32(user_ulong(&@cast(__args, "ulong")[0]))
- buf_uaddr = user_ulong(&@cast(__args, "ulong")[1])
- len = user_ulong(&@cast(__args, "ulong")[2])
- flags = __uint32(user_ulong(&@cast(__args, "ulong")[3]))
+ s = __int32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[0]))
+ buf_uaddr = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[1])
+ len = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[2])
+ flags = __uint32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[3]))
}
probe __nd_syscall.compat_socketcall.recv =
kprobe.function("compat_sys_socketcall").call ?
asmlinkage()
if (int_arg(1) != %{ SYS_RECV %}) next;
__args = pointer_arg(2)
- s = user_int(&@cast(__args, "unsigned int")[0])
- buf_uaddr = user_uint32(&@cast(__args, "unsigned int")[1])
- len = user_uint32(&@cast(__args, "unsigned int")[2])
- flags = user_uint32(&@cast(__args, "unsigned int")[3])
+ s = user_int(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[0])
+ buf_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[1])
+ len = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[2])
+ flags = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[3])
}
probe __nd_syscall.recv = kprobe.function("sys_recv").call ?
{
asmlinkage()
if (int_arg(1) != %{ SYS_RECVFROM %}) next
__args = pointer_arg(2)
- s = __int32(user_ulong(&@cast(__args, "ulong")[0]))
- buf_uaddr = user_ulong(&@cast(__args, "ulong")[1])
- len = user_ulong(&@cast(__args, "ulong")[2])
- flags = __uint32(user_ulong(&@cast(__args, "ulong")[3]))
- addr_uaddr = user_ulong(&@cast(__args, "ulong")[4])
- addrlen_uaddr = __uint32(user_ulong(&@cast(__args, "ulong")[5]))
+ s = __int32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[0]))
+ buf_uaddr = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[1])
+ len = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[2])
+ flags = __uint32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[3]))
+ addr_uaddr = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[4])
+ addrlen_uaddr = __uint32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[5]))
}
probe __nd_syscall.compat_socketcall.recvfrom =
kprobe.function("compat_sys_socketcall").call ?
asmlinkage()
if (int_arg(1) != %{ SYS_RECVFROM %}) next
__args = pointer_arg(2)
- s = user_int(&@cast(__args, "unsigned int")[0])
- buf_uaddr = user_uint32(&@cast(__args, "unsigned int")[1])
- len = user_uint32(&@cast(__args, "unsigned int")[2])
- flags = user_uint32(&@cast(__args, "unsigned int")[3])
- addr_uaddr = user_uint32(&@cast(__args, "unsigned int")[4])
- addrlen_uaddr = user_uint32(&@cast(__args, "unsigned int")[5])
+ s = user_int(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[0])
+ buf_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[1])
+ len = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[2])
+ flags = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[3])
+ addr_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[4])
+ addrlen_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[5])
}
probe __nd_syscall.recvfrom = kprobe.function("sys_recvfrom").call ?
{
if (int_arg(1) != %{ SYS_RECVMSG %}) next;
name = "recvmsg"
__args = pointer_arg(2)
- s = user_int(&@cast(__args, "unsigned int")[0])
- msg_uaddr = user_uint32(&@cast(__args, "unsigned int")[1])
- flags = user_uint32(&@cast(__args, "unsigned int")[2])
+ s = user_int(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[0])
+ msg_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[1])
+ flags = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[2])
flags_str = _msg_flags_str(flags)
argstr = sprintf("%d, %p, %s", s, msg_uaddr, _msg_flags_str(flags))
}
if (int_arg(1) != %{ SYS_SENDMSG %}) next;
name = "sendmsg"
__args = pointer_arg(2)
- s = user_int(&@cast(__args, "unsigned int")[0])
- msg_uaddr = user_uint32(&@cast(__args, "unsigned int")[1])
- flags = user_uint32(&@cast(__args, "unsigned int")[2])
+ s = user_int(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[0])
+ msg_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[1])
+ flags = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[2])
flags_str = _msg_flags_str(flags)
argstr = sprintf("%d, %p, %s", s, msg_uaddr, _msg_flags_str(flags))
}
asmlinkage()
if (int_arg(1) != %{ SYS_SENDMMSG %}) next;
__args = pointer_arg(2)
- s = user_int(&@cast(__args, "unsigned int")[0])
- mmsg_uaddr = user_uint32(&@cast(__args, "unsigned int")[1])
- vlen = user_uint32(&@cast(__args, "unsigned int")[2])
- flags = user_uint32(&@cast(__args, "unsigned int")[3])
+ s = user_int(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[0])
+ mmsg_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[1])
+ vlen = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[2])
+ flags = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[3])
}
probe __nd_syscall.compat_sendmmsg =
kprobe.function("compat_sys_sendmmsg").call ?
asmlinkage()
if (int_arg(1) != %{ SYS_SENDTO %}) next;
__args = pointer_arg(2)
- s = __int32(user_ulong(&@cast(__args, "ulong")[0]))
- buf_uaddr = user_ulong(&@cast(__args, "ulong")[1])
- len = user_ulong(&@cast(__args, "ulong")[2])
- flags = __uint32(user_ulong(&@cast(__args, "ulong")[3]))
- to_uaddr = user_ulong(&@cast(__args, "ulong")[4])
- tolen = __uint32(user_ulong(&@cast(__args, "ulong")[5]))
+ s = __int32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[0]))
+ buf_uaddr = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[1])
+ len = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[2])
+ flags = __uint32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[3]))
+ to_uaddr = user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[4])
+ tolen = __uint32(user_ulong(&@cast(__args, "ulong", "kernel<linux/types.h>")[5]))
}
probe __nd_syscall.compat_socketcall.sendto =
kprobe.function("compat_sys_socketcall").call ?
asmlinkage()
if (int_arg(1) != %{ SYS_SENDTO %}) next;
__args = pointer_arg(2)
- s = user_int(&@cast(__args, "unsigned int")[0])
- buf_uaddr = user_uint32(&@cast(__args, "unsigned int")[1])
- len = user_uint32(&@cast(__args, "unsigned int")[2])
- flags = user_uint32(&@cast(__args, "unsigned int")[3])
- to_uaddr = user_uint32(&@cast(__args, "unsigned int")[4])
- tolen = user_uint32(&@cast(__args, "unsigned int")[5])
+ s = user_int(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[0])
+ buf_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[1])
+ len = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[2])
+ flags = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[3])
+ to_uaddr = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[4])
+ tolen = user_uint32(&@cast(__args, "unsigned int", "kernel<linux/types.h>")[5])
}
probe nd_syscall.sendto.return = __nd_syscall.sendto.return ?,
__nd_syscall.socketcall.sendto.return ?