Linux ubuntu 6.8.0-90-generic #91-Ubuntu SMP PREEMPT_DYNAMIC Tue Nov 18 14:14:30 UTC 2025 x86_64
nginx/1.24.0
: 67.217.245.49 | : 216.73.216.153
Cant Read [ /etc/named.conf ]
8.3.6
www-data
Bypass.pw
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
Backdoor Scanner
Backdoor Create
Alfa Webshell
CPANEL RESET
CREATE WP USER
README
+ Create Folder
+ Create File
/
usr /
sbin /
[ HOME SHELL ]
Name
Size
Permission
Action
ModemManager
2.07
MB
-rwxr-xr-x
a2disconf
15.75
KB
-rwxr-xr-x
a2dismod
15.75
KB
-rwxr-xr-x
a2dissite
15.75
KB
-rwxr-xr-x
a2enconf
15.75
KB
-rwxr-xr-x
a2enmod
15.75
KB
-rwxr-xr-x
a2ensite
15.75
KB
-rwxr-xr-x
a2query
9.6
KB
-rwxr-xr-x
aa-load
38.75
KB
-rwxr-xr-x
aa-remove-unknown
3.15
KB
-rwxr-xr-x
aa-status
39.06
KB
-rwxr-xr-x
aa-teardown
137
B
-rwxr-xr-x
accessdb
14.55
KB
-rwxr-xr-x
add-shell
1.03
KB
-rwxr-xr-x
addgnupghome
3
KB
-rwxr-xr-x
addgroup
53.9
KB
-rwxr-xr-x
adduser
53.9
KB
-rwxr-xr-x
agetty
59.56
KB
-rwxr-xr-x
apache2
736.55
KB
-rwxr-xr-x
apache2ctl
7.26
KB
-rwxr-xr-x
apachectl
7.26
KB
-rwxr-xr-x
apparmor_parser
1.55
MB
-rwxr-xr-x
apparmor_status
39.06
KB
-rwxr-xr-x
applygnupgdefaults
2.17
KB
-rwxr-xr-x
argdist-bpfcc
36
KB
-rwxr-xr-x
arp
61.61
KB
-rwxr-xr-x
arpd
26.33
KB
-rwxr-xr-x
arptables
219.16
KB
-rwxr-xr-x
arptables-nft
219.16
KB
-rwxr-xr-x
arptables-nft-restore
219.16
KB
-rwxr-xr-x
arptables-nft-save
219.16
KB
-rwxr-xr-x
arptables-restore
219.16
KB
-rwxr-xr-x
arptables-save
219.16
KB
-rwxr-xr-x
audisp-af_unix
14.31
KB
-rwxr-xr-x
audisp-remote
50.41
KB
-rwxr-xr-x
audisp-syslog
18.3
KB
-rwxr-xr-x
audispd-zos-remote
34.38
KB
-rwxr-xr-x
auditctl
50.5
KB
-rwxr-xr-x
auditd
118.41
KB
-rwxr-xr-x
augenrules
3.74
KB
-rwxr-xr-x
aureport
110.41
KB
-rwxr-xr-x
ausearch
110.45
KB
-rwxr-xr-x
autrace
18.3
KB
-rwxr-xr-x
badblocks
34.32
KB
-rwxr-xr-x
bashreadline-bpfcc
2.32
KB
-rwxr-xr-x
bashreadline.bt
698
B
-rwxr-xr-x
bcache-super-show
14.3
KB
-rwxr-xr-x
bindsnoop-bpfcc
15.96
KB
-rwxr-xr-x
biolatency-bpfcc
11.1
KB
-rwxr-xr-x
biolatency-kp.bt
664
B
-rwxr-xr-x
biolatency.bt
681
B
-rwxr-xr-x
biolatpcts-bpfcc
10.01
KB
-rwxr-xr-x
biopattern-bpfcc
3.86
KB
-rwxr-xr-x
biosdecode
27.2
KB
-rwxr-xr-x
biosnoop-bpfcc
10.58
KB
-rwxr-xr-x
biosnoop.bt
1.12
KB
-rwxr-xr-x
biostacks.bt
915
B
-rwxr-xr-x
biotop-bpfcc
9.34
KB
-rwxr-xr-x
bitesize-bpfcc
1.14
KB
-rwxr-xr-x
bitesize.bt
567
B
-rwxr-xr-x
blkdeactivate
15.97
KB
-rwxr-xr-x
blkdiscard
22.38
KB
-rwxr-xr-x
blkid
54.41
KB
-rwxr-xr-x
blkzone
34.38
KB
-rwxr-xr-x
blockdev
34.38
KB
-rwxr-xr-x
bpflist-bpfcc
2.54
KB
-rwxr-xr-x
bpftool
1.58
KB
-rwxr-xr-x
bridge
108.49
KB
-rwxr-xr-x
btrfsdist-bpfcc
6.47
KB
-rwxr-xr-x
btrfsslower-bpfcc
9.75
KB
-rwxr-xr-x
cache_check
1.36
MB
-rwxr-xr-x
cache_dump
1.36
MB
-rwxr-xr-x
cache_metadata_size
1.36
MB
-rwxr-xr-x
cache_repair
1.36
MB
-rwxr-xr-x
cache_restore
1.36
MB
-rwxr-xr-x
cache_writeback
1.36
MB
-rwxr-xr-x
cachestat-bpfcc
6.38
KB
-rwxr-xr-x
cachetop-bpfcc
9.15
KB
-rwxr-xr-x
capable-bpfcc
8.28
KB
-rwxr-xr-x
capable.bt
1.88
KB
-rwxr-xr-x
capsh
57.09
KB
-rwxr-xr-x
cfdisk
94.73
KB
-rwxr-xr-x
cgdisk
166.48
KB
-rwxr-xr-x
chcpu
30.38
KB
-rwxr-xr-x
check_forensic
952
B
-rwxr-xr-x
chgpasswd
58.32
KB
-rwxr-xr-x
chmem
34.38
KB
-rwxr-xr-x
chpasswd
54.43
KB
-rwxr-xr-x
chroot
38.51
KB
-rwxr-xr-x
cobjnew-bpfcc
53
B
-rwxr-xr-x
compactsnoop-bpfcc
11.1
KB
-rwxr-xr-x
cpgr
48.45
KB
-rwxr-xr-x
cppw
48.45
KB
-rwxr-xr-x
cpudist-bpfcc
6.85
KB
-rwxr-xr-x
cpuunclaimed-bpfcc
14.59
KB
-rwxr-xr-x
cpuwalk.bt
497
B
-rwxr-xr-x
criticalstat-bpfcc
8.41
KB
-rwxr-xr-x
cron
58.67
KB
-rwxr-xr-x
cryptdisks_start
1.51
KB
-rwxr-xr-x
cryptdisks_stop
844
B
-rwxr-xr-x
cryptsetup
225.9
KB
-rwxr-xr-x
ctrlaltdel
14.38
KB
-rwxr-xr-x
dbslower-bpfcc
7.22
KB
-rwxr-xr-x
dbstat-bpfcc
3.7
KB
-rwxr-xr-x
dcb
80.52
KB
-rwxr-xr-x
dcsnoop-bpfcc
4.03
KB
-rwxr-xr-x
dcsnoop.bt
1.23
KB
-rwxr-xr-x
dcstat-bpfcc
3.77
KB
-rwxr-xr-x
deadlock-bpfcc
20.45
KB
-rwxr-xr-x
debugfs
225.87
KB
-rwxr-xr-x
delgroup
18.53
KB
-rwxr-xr-x
deluser
18.53
KB
-rwxr-xr-x
depmod
170.24
KB
-rwxr-xr-x
devlink
150.86
KB
-rwxr-xr-x
dhcpcd
395.4
KB
-rwxr-xr-x
dirtop-bpfcc
8.37
KB
-rwxr-xr-x
dmeventd
50.38
KB
-rwxr-xr-x
dmidecode
135.25
KB
-rwxr-xr-x
dmsetup
171.05
KB
-rwxr-xr-x
dmstats
171.05
KB
-rwxr-xr-x
dosfsck
78.38
KB
-rwxr-xr-x
dosfslabel
38.38
KB
-rwxr-xr-x
dpkg-preconfigure
4.25
KB
-rwxr-xr-x
dpkg-reconfigure
4.43
KB
-rwxr-xr-x
drsnoop-bpfcc
6.73
KB
-rwxr-xr-x
dumpe2fs
34.31
KB
-rwxr-xr-x
e2freefrag
18.3
KB
-rwxr-xr-x
e2fsck
364.34
KB
-rwxr-xr-x
e2image
42.31
KB
-rwxr-xr-x
e2label
110.56
KB
-rwxr-xr-x
e2mmpstatus
34.31
KB
-rwxr-xr-x
e2scrub
7.12
KB
-rwxr-xr-x
e2scrub_all
5.27
KB
-rwxr-xr-x
e2undo
22.3
KB
-rwxr-xr-x
e4crypt
30.38
KB
-rwxr-xr-x
e4defrag
34.3
KB
-rwxr-xr-x
ebtables
219.16
KB
-rwxr-xr-x
ebtables-nft
219.16
KB
-rwxr-xr-x
ebtables-nft-restore
219.16
KB
-rwxr-xr-x
ebtables-nft-save
219.16
KB
-rwxr-xr-x
ebtables-restore
219.16
KB
-rwxr-xr-x
ebtables-save
219.16
KB
-rwxr-xr-x
ebtables-translate
219.16
KB
-rwxr-xr-x
era_check
1.36
MB
-rwxr-xr-x
era_dump
1.36
MB
-rwxr-xr-x
era_invalidate
1.36
MB
-rwxr-xr-x
era_restore
1.36
MB
-rwxr-xr-x
ethtool
651.68
KB
-rwxr-xr-x
execsnoop-bpfcc
9.82
KB
-rwxr-xr-x
execsnoop.bt
928
B
-rwxr-xr-x
exitsnoop-bpfcc
9.42
KB
-rwxr-xr-x
ext4dist-bpfcc
6.53
KB
-rwxr-xr-x
ext4slower-bpfcc
9.71
KB
-rwxr-xr-x
faillock
22.31
KB
-rwxr-xr-x
fatlabel
38.38
KB
-rwxr-xr-x
fdisk
114.42
KB
-rwxr-xr-x
filefrag
18.32
KB
-rwxr-xr-x
filegone-bpfcc
5.64
KB
-rwxr-xr-x
filelife-bpfcc
6.38
KB
-rwxr-xr-x
fileslower-bpfcc
7.2
KB
-rwxr-xr-x
filetop-bpfcc
6.35
KB
-rwxr-xr-x
findfs
14.38
KB
-rwxr-xr-x
fixparts
58.48
KB
-rwxr-xr-x
fsadm
24
KB
-rwxr-xr-x
fsck
42.42
KB
-rwxr-xr-x
fsck.btrfs
1.16
KB
-rwxr-xr-x
fsck.cramfs
30.44
KB
-rwxr-xr-x
fsck.ext2
364.34
KB
-rwxr-xr-x
fsck.ext3
364.34
KB
-rwxr-xr-x
fsck.ext4
364.34
KB
-rwxr-xr-x
fsck.fat
78.38
KB
-rwxr-xr-x
fsck.minix
54.41
KB
-rwxr-xr-x
fsck.msdos
78.38
KB
-rwxr-xr-x
fsck.vfat
78.38
KB
-rwxr-xr-x
fsck.xfs
2.51
KB
-rwxr-xr-x
fsfreeze
14.38
KB
-rwxr-xr-x
fstab-decode
14.3
KB
-rwxr-xr-x
fstrim
42.38
KB
-rwxr-xr-x
funccount-bpfcc
12.68
KB
-rwxr-xr-x
funcinterval-bpfcc
5.46
KB
-rwxr-xr-x
funclatency-bpfcc
11.28
KB
-rwxr-xr-x
funcslower-bpfcc
10.38
KB
-rwxr-xr-x
gdisk
198.48
KB
-rwxr-xr-x
genl
120.58
KB
-rwxr-xr-x
getcap
14.3
KB
-rwxr-xr-x
gethostlatency-bpfcc
3.82
KB
-rwxr-xr-x
gethostlatency.bt
1.19
KB
-rwxr-xr-x
getpcaps
14.3
KB
-rwxr-xr-x
getty
59.56
KB
-rwxr-xr-x
groupadd
71.13
KB
-rwxr-xr-x
groupdel
62.91
KB
-rwxr-xr-x
groupmems
58.34
KB
-rwxr-xr-x
groupmod
71.04
KB
-rwxr-xr-x
grpck
58.32
KB
-rwxr-xr-x
grpconv
50.16
KB
-rwxr-xr-x
grpunconv
50.16
KB
-rwxr-xr-x
grub-bios-setup
958.55
KB
-rwxr-xr-x
grub-install
1.17
MB
-rwxr-xr-x
grub-macbless
946.41
KB
-rwxr-xr-x
grub-mkconfig
8.63
KB
-rwxr-xr-x
grub-mkdevicemap
70.69
KB
-rwxr-xr-x
grub-probe
954.66
KB
-rwxr-xr-x
grub-reboot
4.73
KB
-rwxr-xr-x
grub-set-default
3.47
KB
-rwxr-xr-x
halt
1.43
MB
-rwxr-xr-x
hardirqs-bpfcc
6.85
KB
-rwxr-xr-x
hdparm
139.43
KB
-rwxr-xr-x
httxt2dbm
14.3
KB
-rwxr-xr-x
iconvconfig
34.47
KB
-rwxr-xr-x
ifconfig
77.17
KB
-rwxr-xr-x
iftop
62.62
KB
-rwxr-xr-x
init
98.45
KB
-rwxr-xr-x
inject-bpfcc
16.06
KB
-rwxr-xr-x
insmod
170.24
KB
-rwxr-xr-x
install-sgmlcatalog
4.44
KB
-rwxr-xr-x
installkernel
2.6
KB
-rwxr-xr-x
integritysetup
67.06
KB
-rwxr-xr-x
invoke-rc.d
16.13
KB
-rwxr-xr-x
iotop
113.64
KB
-rwxr-xr-x
iotop-c
113.64
KB
-rwxr-xr-x
ip
754.8
KB
-rwxr-xr-x
ip6tables
219.16
KB
-rwxr-xr-x
ip6tables-apply
6.89
KB
-rwxr-xr-x
ip6tables-legacy
92.95
KB
-rwxr-xr-x
ip6tables-legacy-restore
92.95
KB
-rwxr-xr-x
ip6tables-legacy-save
92.95
KB
-rwxr-xr-x
ip6tables-nft
219.16
KB
-rwxr-xr-x
ip6tables-nft-restore
219.16
KB
-rwxr-xr-x
ip6tables-nft-save
219.16
KB
-rwxr-xr-x
ip6tables-restore
219.16
KB
-rwxr-xr-x
ip6tables-restore-translate
219.16
KB
-rwxr-xr-x
ip6tables-save
219.16
KB
-rwxr-xr-x
ip6tables-translate
219.16
KB
-rwxr-xr-x
ipmaddr
18.3
KB
-rwxr-xr-x
iptables
219.16
KB
-rwxr-xr-x
iptables-apply
6.89
KB
-rwxr-xr-x
iptables-legacy
92.95
KB
-rwxr-xr-x
iptables-legacy-restore
92.95
KB
-rwxr-xr-x
iptables-legacy-save
92.95
KB
-rwxr-xr-x
iptables-nft
219.16
KB
-rwxr-xr-x
iptables-nft-restore
219.16
KB
-rwxr-xr-x
iptables-nft-save
219.16
KB
-rwxr-xr-x
iptables-restore
219.16
KB
-rwxr-xr-x
iptables-restore-translate
219.16
KB
-rwxr-xr-x
iptables-save
219.16
KB
-rwxr-xr-x
iptables-translate
219.16
KB
-rwxr-xr-x
iptunnel
18.3
KB
-rwxr-xr-x
iscsi-iname
18.3
KB
-rwxr-xr-x
iscsi_discovery
5.17
KB
-rwxr-xr-x
iscsiadm
370.43
KB
-rwxr-xr-x
iscsid
286.55
KB
-rwxr-xr-x
iscsistart
274.49
KB
-rwxr-xr-x
isosize
14.38
KB
-rwxr-xr-x
javacalls-bpfcc
55
B
-rwxr-xr-x
javaflow-bpfcc
54
B
-rwxr-xr-x
javagc-bpfcc
52
B
-rwxr-xr-x
javaobjnew-bpfcc
56
B
-rwxr-xr-x
javastat-bpfcc
54
B
-rwxr-xr-x
javathreads-bpfcc
57
B
-rwxr-xr-x
kbdrate
18.31
KB
-rwxr-xr-x
killall5
26.23
KB
-rwxr-xr-x
killsnoop-bpfcc
4.45
KB
-rwxr-xr-x
killsnoop.bt
873
B
-rwxr-xr-x
klockstat-bpfcc
13.04
KB
-rwxr-xr-x
kpartx
42.16
KB
-rwxr-xr-x
kvmexit-bpfcc
11.19
KB
-rwxr-xr-x
ldattach
26.38
KB
-rwxr-xr-x
ldconfig
387
B
-rwxr-xr-x
ldconfig.real
1
MB
-rwxr-xr-x
llcstat-bpfcc
4.48
KB
-rwxr-xr-x
loads.bt
1.1
KB
-rwxr-xr-x
locale-gen
4.21
KB
-rwxr-xr-x
logrotate
94.24
KB
-rwxr-xr-x
logsave
14.16
KB
-rwxr-xr-x
losetup
74.52
KB
-rwxr-xr-x
lsmod
170.24
KB
-rwxr-xr-x
luksformat
3.32
KB
-rwxr-xr-x
lvchange
3.01
MB
-rwxr-xr-x
lvconvert
3.01
MB
-rwxr-xr-x
lvcreate
3.01
MB
-rwxr-xr-x
lvdisplay
3.01
MB
-rwxr-xr-x
lvextend
3.01
MB
-rwxr-xr-x
lvm
3.01
MB
-rwxr-xr-x
lvmconfig
3.01
MB
-rwxr-xr-x
lvmdiskscan
3.01
MB
-rwxr-xr-x
lvmdump
10.12
KB
-rwxr-xr-x
lvmpolld
235.97
KB
-rwxr-xr-x
lvmsadc
3.01
MB
-rwxr-xr-x
lvmsar
3.01
MB
-rwxr-xr-x
lvreduce
3.01
MB
-rwxr-xr-x
lvremove
3.01
MB
-rwxr-xr-x
lvrename
3.01
MB
-rwxr-xr-x
lvresize
3.01
MB
-rwxr-xr-x
lvs
3.01
MB
-rwxr-xr-x
lvscan
3.01
MB
-rwxr-xr-x
lxc
589
B
-rwxr-xr-x
lxd
589
B
-rwxr-xr-x
make-bcache
22.38
KB
-rwxr-xr-x
make-ssl-cert
6.65
KB
-rwxr-xr-x
mariadbd
26.09
MB
-rwxr-xr-x
mdadm
622.21
KB
-rwxr-xr-x
mdflush-bpfcc
2.24
KB
-rwxr-xr-x
mdflush.bt
775
B
-rwxr-xr-x
mdmon
258.8
KB
-rwxr-xr-x
memleak-bpfcc
20.8
KB
-rwxr-xr-x
mii-tool
26.73
KB
-rwxr-xr-x
mkdosfs
50.83
KB
-rwxr-xr-x
mke2fs
130.62
KB
-rwxr-xr-x
mkfs
14.38
KB
-rwxr-xr-x
mkfs.bfs
22.38
KB
-rwxr-xr-x
mkfs.btrfs
560.3
KB
-rwxr-xr-x
mkfs.cramfs
34.32
KB
-rwxr-xr-x
mkfs.ext2
130.62
KB
-rwxr-xr-x
mkfs.ext3
130.62
KB
-rwxr-xr-x
mkfs.ext4
130.62
KB
-rwxr-xr-x
mkfs.fat
50.83
KB
-rwxr-xr-x
mkfs.minix
42.39
KB
-rwxr-xr-x
mkfs.msdos
50.83
KB
-rwxr-xr-x
mkfs.ntfs
66.38
KB
-rwxr-xr-x
mkfs.vfat
50.83
KB
-rwxr-xr-x
mkfs.xfs
438.99
KB
-rwxr-xr-x
mkhomedir_helper
22.34
KB
-rwxr-xr-x
mkinitramfs
15.39
KB
-rwxr-xr-x
mklost+found
14.3
KB
-rwxr-xr-x
mkntfs
66.38
KB
-rwxr-xr-x
mkswap
50.38
KB
-rwxr-xr-x
modinfo
170.24
KB
-rwxr-xr-x
modprobe
170.24
KB
-rwxr-xr-x
mount.fuse
18.3
KB
-rwxr-xr-x
mount.fuse3
18.3
KB
-rwxr-xr-x
mount.lowntfs-3g
118.98
KB
-rwxr-xr-x
mount.ntfs
159.01
KB
-rwxr-xr-x
mount.ntfs-3g
159.01
KB
-rwxr-xr-x
mountsnoop-bpfcc
14.62
KB
-rwxr-xr-x
mpathpersist
31.21
KB
-rwxr-xr-x
multipath
34.3
KB
-rwxr-xr-x
multipathc
18.3
KB
-rwxr-xr-x
multipathd
142.46
KB
-rwxr-xr-x
mysqld
26.09
MB
-rwxr-xr-x
mysqld_qslower-bpfcc
3.05
KB
-rwxr-xr-x
nameif
14.39
KB
-rwxr-xr-x
naptime.bt
1.01
KB
-rwxr-xr-x
needrestart
40.13
KB
-rwxr-xr-x
netplan
802
B
-rwxr-xr-x
netqtop-bpfcc
5.59
KB
-rwxr-xr-x
newusers
86.96
KB
-rwxr-xr-x
nfnl_osf
18.3
KB
-rwxr-xr-x
nfsdist-bpfcc
4.95
KB
-rwxr-xr-x
nfsslower-bpfcc
13.61
KB
-rwxr-xr-x
nft
26.23
KB
-rwxr-xr-x
nginx
1.25
MB
-rwxr-xr-x
nodegc-bpfcc
52
B
-rwxr-xr-x
nodestat-bpfcc
54
B
-rwxr-xr-x
nologin
14.3
KB
-rwxr-xr-x
ntfsclone
50.38
KB
-rwxr-xr-x
ntfscp
30.38
KB
-rwxr-xr-x
ntfslabel
22.38
KB
-rwxr-xr-x
ntfsresize
62.39
KB
-rwxr-xr-x
ntfsundelete
50.38
KB
-rwxr-xr-x
offcputime-bpfcc
13.46
KB
-rwxr-xr-x
offwaketime-bpfcc
15.31
KB
-rwxr-xr-x
on_ac_power
3.7
KB
-rwxr-xr-x
oomkill-bpfcc
2.04
KB
-rwxr-xr-x
oomkill.bt
1.17
KB
-rwxr-xr-x
opensnoop-bpfcc
14.24
KB
-rwxr-xr-x
opensnoop.bt
953
B
-rwxr-xr-x
overlayroot-chroot
2.45
KB
-rwxr-xr-x
ownership
14.45
KB
-rwxr-xr-x
pam-auth-update
20.96
KB
-rwxr-xr-x
pam_extrausers_chkpwd
26.31
KB
-rwxr-sr-x
pam_extrausers_update
34.31
KB
-rwxr-xr-x
pam_getenv
2.82
KB
-rwxr-xr-x
pam_namespace_helper
467
B
-rwxr-xr-x
pam_timestamp_check
14.31
KB
-rwxr-xr-x
parted
94.4
KB
-rwxr-xr-x
partprobe
14.38
KB
-rwxr-xr-x
pdata_tools
1.36
MB
-rwxr-xr-x
perlcalls-bpfcc
55
B
-rwxr-xr-x
perlflow-bpfcc
54
B
-rwxr-xr-x
perlstat-bpfcc
54
B
-rwxr-xr-x
php-fpm8.3
5.49
MB
-rwxr-xr-x
phpcalls-bpfcc
54
B
-rwxr-xr-x
phpdismod
7.11
KB
-rwxr-xr-x
phpenmod
7.11
KB
-rwxr-xr-x
phpflow-bpfcc
53
B
-rwxr-xr-x
phpquery
6.24
KB
-rwxr-xr-x
phpstat-bpfcc
53
B
-rwxr-xr-x
pidpersec-bpfcc
1.08
KB
-rwxr-xr-x
pidpersec.bt
628
B
-rwxr-xr-x
pivot_root
14.38
KB
-rwxr-xr-x
plipconfig
14.3
KB
-rwxr-xr-x
plymouthd
146.57
KB
-rwxr-xr-x
poweroff
1.43
MB
-rwxr-xr-x
ppchcalls-bpfcc
13.89
KB
-rwxr-xr-x
profile-bpfcc
14.41
KB
-rwxr-xr-x
pvchange
3.01
MB
-rwxr-xr-x
pvck
3.01
MB
-rwxr-xr-x
pvcreate
3.01
MB
-rwxr-xr-x
pvdisplay
3.01
MB
-rwxr-xr-x
pvmove
3.01
MB
-rwxr-xr-x
pvremove
3.01
MB
-rwxr-xr-x
pvresize
3.01
MB
-rwxr-xr-x
pvs
3.01
MB
-rwxr-xr-x
pvscan
3.01
MB
-rwxr-xr-x
pwck
54.29
KB
-rwxr-xr-x
pwconv
46.16
KB
-rwxr-xr-x
pwhistory_helper
22.31
KB
-rwxr-xr-x
pwunconv
46.16
KB
-rwxr-xr-x
pythoncalls-bpfcc
57
B
-rwxr-xr-x
pythonflow-bpfcc
56
B
-rwxr-xr-x
pythongc-bpfcc
54
B
-rwxr-xr-x
pythonstat-bpfcc
56
B
-rwxr-xr-x
rarp
32.33
KB
-rwxr-xr-x
rdmaucma-bpfcc
4.95
KB
-rwxr-xr-x
readahead-bpfcc
6.54
KB
-rwxr-xr-x
readprofile
22.41
KB
-rwxr-xr-x
reboot
1.43
MB
-rwxr-xr-x
remove-shell
1.08
KB
-rwxr-xr-x
reset-trace-bpfcc
3.42
KB
-rwxr-xr-x
resize2fs
70.3
KB
-rwxr-xr-x
resolvconf
158.67
KB
-rwxr-xr-x
rmmod
170.24
KB
-rwxr-xr-x
rmt
54.71
KB
-rwxr-xr-x
rmt-tar
54.71
KB
-rwxr-xr-x
route
68.27
KB
-rwxr-xr-x
rsyslogd
771.67
KB
-rwxr-xr-x
rtacct
28.31
KB
-rwxr-xr-x
rtcwake
34.38
KB
-rwxr-xr-x
rtmon
116.52
KB
-rwxr-xr-x
rubycalls-bpfcc
55
B
-rwxr-xr-x
rubyflow-bpfcc
54
B
-rwxr-xr-x
rubygc-bpfcc
52
B
-rwxr-xr-x
rubyobjnew-bpfcc
56
B
-rwxr-xr-x
rubystat-bpfcc
54
B
-rwxr-xr-x
runlevel
1.43
MB
-rwxr-xr-x
runqlat-bpfcc
9.3
KB
-rwxr-xr-x
runqlat.bt
788
B
-rwxr-xr-x
runqlen-bpfcc
8.05
KB
-rwxr-xr-x
runqlen.bt
1.01
KB
-rwxr-xr-x
runqslower-bpfcc
9.01
KB
-rwxr-xr-x
runuser
54.38
KB
-rwxr-xr-x
service
8.89
KB
-rwxr-xr-x
setcap
14.3
KB
-rwxr-xr-x
setuids.bt
1.76
KB
-rwxr-xr-x
setvesablank
14.37
KB
-rwxr-xr-x
setvtrgb
14.43
KB
-rwxr-xr-x
sfdisk
106.38
KB
-rwxr-xr-x
sgdisk
178.48
KB
-rwxr-xr-x
shadowconfig
2.22
KB
-rwxr-xr-x
shmsnoop-bpfcc
7.8
KB
-rwxr-xr-x
shutdown
1.43
MB
-rwxr-xr-x
slabratetop-bpfcc
6.38
KB
-rwxr-xr-x
slattach
36.08
KB
-rwxr-xr-x
sofdsnoop-bpfcc
8.06
KB
-rwxr-xr-x
softirqs-bpfcc
5.59
KB
-rwxr-xr-x
solisten-bpfcc
5.96
KB
-rwxr-xr-x
split-logfile
2.36
KB
-rwxr-xr-x
sshd
899.82
KB
-rwxr-xr-x
ssllatency.bt
2.08
KB
-rwxr-xr-x
sslsniff-bpfcc
13.68
KB
-rwxr-xr-x
sslsnoop.bt
1.99
KB
-rwxr-xr-x
stackcount-bpfcc
16.26
KB
-rwxr-xr-x
start-stop-daemon
47.49
KB
-rwxr-xr-x
statsnoop-bpfcc
4.92
KB
-rwxr-xr-x
statsnoop.bt
1.26
KB
-rwxr-xr-x
sudo_logsrvd
248.5
KB
-rwxr-xr-x
sudo_sendlog
131.67
KB
-rwxr-xr-x
sulogin
42.38
KB
-rwxr-xr-x
swapin.bt
600
B
-rwxr-xr-x
swaplabel
18.38
KB
-rwxr-xr-x
swapoff
22.38
KB
-rwxr-xr-x
swapon
42.38
KB
-rwxr-xr-x
switch_root
22.38
KB
-rwxr-xr-x
syncsnoop-bpfcc
1.27
KB
-rwxr-xr-x
syncsnoop.bt
839
B
-rwxr-xr-x
syscount-bpfcc
8.57
KB
-rwxr-xr-x
syscount.bt
872
B
-rwxr-xr-x
sysctl
30.38
KB
-rwxr-xr-x
tarcat
936
B
-rwxr-xr-x
tc
630.08
KB
-rwxr-xr-x
tclcalls-bpfcc
54
B
-rwxr-xr-x
tclflow-bpfcc
53
B
-rwxr-xr-x
tclobjnew-bpfcc
55
B
-rwxr-xr-x
tclstat-bpfcc
53
B
-rwxr-xr-x
tcpaccept-bpfcc
9
KB
-rwxr-xr-x
tcpaccept.bt
1.71
KB
-rwxr-xr-x
tcpcong-bpfcc
20.11
KB
-rwxr-xr-x
tcpconnect-bpfcc
18.46
KB
-rwxr-xr-x
tcpconnect.bt
1.58
KB
-rwxr-xr-x
tcpconnlat-bpfcc
9.07
KB
-rwxr-xr-x
tcpdrop-bpfcc
7.44
KB
-rwxr-xr-x
tcpdrop.bt
2.41
KB
-rwxr-xr-x
tcplife-bpfcc
16.55
KB
-rwxr-xr-x
tcplife.bt
2.72
KB
-rwxr-xr-x
tcpretrans-bpfcc
13.77
KB
-rwxr-xr-x
tcpretrans.bt
2.07
KB
-rwxr-xr-x
tcprtt-bpfcc
8.7
KB
-rwxr-xr-x
tcpstates-bpfcc
13.73
KB
-rwxr-xr-x
tcpsubnet-bpfcc
7.63
KB
-rwxr-xr-x
tcpsynbl-bpfcc
2.12
KB
-rwxr-xr-x
tcpsynbl.bt
962
B
-rwxr-xr-x
tcptop-bpfcc
12.64
KB
-rwxr-xr-x
tcptracer-bpfcc
17.71
KB
-rwxr-xr-x
telinit
1.43
MB
-rwxr-xr-x
thin_check
1.36
MB
-rwxr-xr-x
thin_delta
1.36
MB
-rwxr-xr-x
thin_dump
1.36
MB
-rwxr-xr-x
thin_ls
1.36
MB
-rwxr-xr-x
thin_metadata_size
1.36
MB
-rwxr-xr-x
thin_repair
1.36
MB
-rwxr-xr-x
thin_restore
1.36
MB
-rwxr-xr-x
thin_rmap
1.36
MB
-rwxr-xr-x
thin_trim
1.36
MB
-rwxr-xr-x
threadsnoop-bpfcc
1.81
KB
-rwxr-xr-x
threadsnoop.bt
712
B
-rwxr-xr-x
tipc
90.52
KB
-rwxr-xr-x
tplist-bpfcc
4.06
KB
-rwxr-xr-x
trace-bpfcc
42.86
KB
-rwxr-xr-x
ttysnoop-bpfcc
7.51
KB
-rwxr-xr-x
tune2fs
110.56
KB
-rwxr-xr-x
ucalls
11.69
KB
-rwxr-xr-x
uflow
7.92
KB
-rwxr-xr-x
ufw
4.84
KB
-rwxr-xr-x
ugc
7.64
KB
-rwxr-xr-x
umount.udisks2
14.3
KB
-rwxr-xr-x
undump.bt
789
B
-rwxr-xr-x
unix_chkpwd
30.31
KB
-rwxr-sr-x
unix_update
34.31
KB
-rwxr-xr-x
uobjnew
6.04
KB
-rwxr-xr-x
update-ca-certificates
5.32
KB
-rwxr-xr-x
update-catalog
9.17
KB
-rwxr-xr-x
update-grub
64
B
-rwxr-xr-x
update-grub-gfxpayload
301
B
-rwxr-xr-x
update-grub2
64
B
-rwxr-xr-x
update-ieee-data
3.41
KB
-rwxr-xr-x
update-info-dir
1.66
KB
-rwxr-xr-x
update-initramfs
6.75
KB
-rwxr-xr-x
update-locale
2.99
KB
-rwxr-xr-x
update-passwd
34.56
KB
-rwxr-xr-x
update-pciids
1.74
KB
-rwxr-xr-x
update-rc.d
17.72
KB
-rwxr-xr-x
update-secureboot-policy
7.43
KB
-rwxr-xr-x
update-shells
3.89
KB
-rwxr-xr-x
update-xmlcatalog
16.88
KB
-rwxr-xr-x
upgrade-from-grub-legacy
1.56
KB
-rwxr-xr-x
usb_modeswitch
59.66
KB
-rwxr-xr-x
usb_modeswitch_dispatcher
26.78
KB
-rwxr-xr-x
useradd
139.88
KB
-rwxr-xr-x
userdel
91.01
KB
-rwxr-xr-x
usermod
127.65
KB
-rwxr-xr-x
ustat
12.12
KB
-rwxr-xr-x
uthreads
4
KB
-rwxr-xr-x
uuidd
30.88
KB
-rwxr-xr-x
validlocale
1.73
KB
-rwxr-xr-x
vcstime
14.3
KB
-rwxr-xr-x
vdpa
34.56
KB
-rwxr-xr-x
veritysetup
43.94
KB
-rwxr-xr-x
vfscount-bpfcc
1.36
KB
-rwxr-xr-x
vfscount.bt
515
B
-rwxr-xr-x
vfsstat-bpfcc
4.06
KB
-rwxr-xr-x
vfsstat.bt
721
B
-rwxr-xr-x
vgcfgbackup
3.01
MB
-rwxr-xr-x
vgcfgrestore
3.01
MB
-rwxr-xr-x
vgchange
3.01
MB
-rwxr-xr-x
vgck
3.01
MB
-rwxr-xr-x
vgconvert
3.01
MB
-rwxr-xr-x
vgcreate
3.01
MB
-rwxr-xr-x
vgdisplay
3.01
MB
-rwxr-xr-x
vgexport
3.01
MB
-rwxr-xr-x
vgextend
3.01
MB
-rwxr-xr-x
vgimport
3.01
MB
-rwxr-xr-x
vgimportclone
3.01
MB
-rwxr-xr-x
vgmerge
3.01
MB
-rwxr-xr-x
vgmknodes
3.01
MB
-rwxr-xr-x
vgreduce
3.01
MB
-rwxr-xr-x
vgremove
3.01
MB
-rwxr-xr-x
vgrename
3.01
MB
-rwxr-xr-x
vgs
3.01
MB
-rwxr-xr-x
vgscan
3.01
MB
-rwxr-xr-x
vgsplit
3.01
MB
-rwxr-xr-x
vigr
60.69
KB
-rwxr-xr-x
vipw
60.69
KB
-rwxr-xr-x
virtiostat-bpfcc
8.69
KB
-rwxr-xr-x
visudo
252.71
KB
-rwxr-xr-x
vnstatd
93.28
KB
-rwxr-xr-x
vpddecode
14.58
KB
-rwxr-xr-x
vsftpd
156.48
KB
-rwxr-xr-x
wakeuptime-bpfcc
8.1
KB
-rwxr-xr-x
wipefs
38.38
KB
-rwxr-xr-x
writeback.bt
1.66
KB
-rwxr-xr-x
xfs_admin
2.12
KB
-rwxr-xr-x
xfs_bmap
695
B
-rwxr-xr-x
xfs_copy
90.44
KB
-rwxr-xr-x
xfs_db
688.56
KB
-rwxr-xr-x
xfs_estimate
14.16
KB
-rwxr-xr-x
xfs_freeze
800
B
-rwxr-xr-x
xfs_fsr
42.18
KB
-rwxr-xr-x
xfs_growfs
38.23
KB
-rwxr-xr-x
xfs_info
1.26
KB
-rwxr-xr-x
xfs_io
203.65
KB
-rwxr-xr-x
xfs_logprint
78.27
KB
-rwxr-xr-x
xfs_mdrestore
34.23
KB
-rwxr-xr-x
xfs_metadump
816
B
-rwxr-xr-x
xfs_mkfile
1.02
KB
-rwxr-xr-x
xfs_ncheck
685
B
-rwxr-xr-x
xfs_quota
90.16
KB
-rwxr-xr-x
xfs_repair
643.32
KB
-rwxr-xr-x
xfs_rtcp
18.15
KB
-rwxr-xr-x
xfs_scrub
106.27
KB
-rwxr-xr-x
xfs_scrub_all
7.66
KB
-rwxr-xr-x
xfs_spaceman
42.3
KB
-rwxr-xr-x
xfsdist-bpfcc
4.61
KB
-rwxr-xr-x
xfsdist.bt
972
B
-rwxr-xr-x
xfsslower-bpfcc
7.78
KB
-rwxr-xr-x
xtables-legacy-multi
92.95
KB
-rwxr-xr-x
xtables-monitor
219.16
KB
-rwxr-xr-x
xtables-nft-multi
219.16
KB
-rwxr-xr-x
zerofree
14.15
KB
-rwxr-xr-x
zfsdist-bpfcc
5.3
KB
-rwxr-xr-x
zfsslower-bpfcc
8.45
KB
-rwxr-xr-x
zic
66.39
KB
-rwxr-xr-x
zramctl
54.52
KB
-rwxr-xr-x
Delete
Unzip
Zip
${this.title}
Close
Code Editor : trace-bpfcc
#! /usr/bin/python3 # # trace Trace a function and print a trace message based on its # parameters, with an optional filter. # # usage: trace [-h] [-p PID] [-L TID] [-v] [-Z STRING_SIZE] [-S] [-c cgroup_path] # [-M MAX_EVENTS] [-s SYMBOLFILES] [-T] [-t] [-K] [-U] [-a] [-I header] # [-A] # probe [probe ...] # # Licensed under the Apache License, Version 2.0 (the "License") # Copyright (C) 2016 Sasha Goldshtein. from __future__ import print_function from bcc import BPF, USDT, StrcmpRewrite from functools import partial from time import strftime import time import argparse import re import ctypes as ct import os import traceback import sys class Probe(object): probe_count = 0 streq_index = 0 max_events = None event_count = 0 first_ts = 0 first_ts_real = None print_time = False print_unix_timestamp = False use_localtime = True time_field = False print_cpu = False print_address = False tgid = -1 pid = -1 uid = -1 page_cnt = None build_id_enabled = False aggregate = False symcount = {} done = False @classmethod def configure(cls, args): cls.max_events = args.max_events cls.print_time = args.timestamp or args.time cls.print_unix_timestamp = args.unix_timestamp cls.use_localtime = not args.timestamp cls.time_field = cls.print_time and (not cls.use_localtime) cls.print_cpu = args.print_cpu cls.print_address = args.address cls.first_ts = BPF.monotonic_time() cls.first_ts_real = time.time() cls.tgid = args.tgid or -1 cls.pid = args.pid or -1 cls.uid = args.uid or -1 cls.page_cnt = args.buffer_pages cls.bin_cmp = args.bin_cmp cls.build_id_enabled = args.sym_file_list is not None cls.aggregate = args.aggregate if cls.aggregate and cls.max_events is None: raise ValueError("-M/--max-events should be specified" " with -A/--aggregate") def __init__(self, probe, string_size, kernel_stack, user_stack, cgroup_map_name, name, msg_filter): self.usdt = None self.streq_functions = "" self.raw_probe = probe self.string_size = string_size self.kernel_stack = kernel_stack self.user_stack = user_stack self.probe_user_list = set() Probe.probe_count += 1 self._parse_probe() self.probe_num = Probe.probe_count self.probe_name = "probe_%s_%d" % \ (self._display_function(), self.probe_num) self.probe_name = re.sub(r'[^A-Za-z0-9_]', '_', self.probe_name) self.cgroup_map_name = cgroup_map_name if name is None: # An empty bytestring is always contained in the command # name so this will always succeed. self.name = b'' else: self.name = name.encode('ascii') self.msg_filter = msg_filter # compiler can generate proper codes for function # signatures with "syscall__" prefix if self.is_syscall_kprobe: self.probe_name = "syscall__" + self.probe_name[6:] def __str__(self): return "%s:%s:%s FLT=%s ACT=%s/%s" % (self.probe_type, self.library, self._display_function(), self.filter, self.types, self.values) def is_default_action(self): return self.python_format == "" def _bail(self, error): raise ValueError("error in probe '%s': %s" % (self.raw_probe, error)) def _parse_probe(self): text = self.raw_probe # There might be a function signature preceding the actual # filter/print part, or not. Find the probe specifier first -- # it ends with either a space or an open paren ( for the # function signature part. # opt. signature # probespec | rest # --------- ---------- -- (spec, sig, rest) = re.match(r'([^ \t\(]+)(\([^\(]*\))?(.*)', text).groups() self._parse_spec(spec) # Remove the parens self.signature = sig[1:-1] if sig else None if self.signature and self.probe_type in ['u', 't']: self._bail("USDT and tracepoint probes can't have " + "a function signature; use arg1, arg2, " + "... instead") text = rest.lstrip() # If we now have a (, wait for the balanced closing ) and that # will be the predicate self.filter = None if len(text) > 0 and text[0] == "(": balance = 1 for i in range(1, len(text)): if text[i] == "(": balance += 1 if text[i] == ")": balance -= 1 if balance == 0: self._parse_filter(text[:i + 1]) text = text[i + 1:] break if self.filter is None: self._bail("unmatched end of predicate") if self.filter is None: self.filter = "1" # The remainder of the text is the printf action self._parse_action(text.lstrip()) def _parse_offset(self, func_and_offset): func, offset_str = func_and_offset.split("+") try: if "x" in offset_str or "X" in offset_str: offset = int(offset_str, 16) else: offset = int(offset_str) except ValueError: self._bail("invalid offset format " + " '%s', must be decimal or hexadecimal" % offset_str) return func, offset def _parse_spec(self, spec): parts = spec.split(":") # Two special cases: 'func' means 'p::func', 'lib:func' means # 'p:lib:func'. Other combinations need to provide an empty # value between delimiters, e.g. 'r::func' for a kretprobe on # the function func. if len(parts) == 1: parts = ["p", "", parts[0]] elif len(parts) == 2: parts = ["p", parts[0], parts[1]] if len(parts[0]) == 0: self.probe_type = "p" elif parts[0] in ["p", "r", "t", "u"]: self.probe_type = parts[0] else: self._bail("probe type must be '', 'p', 't', 'r', " + "or 'u', but got '%s'" % parts[0]) self.offset = 0 if "+" in parts[-1]: parts[-1], self.offset = self._parse_offset(parts[-1]) if self.probe_type == "t": self.tp_category = parts[1] self.tp_event = parts[2] self.library = "" # kernel self.function = "" # from TRACEPOINT_PROBE elif self.probe_type == "u": # u:<library>[:<provider>]:<probe> where :<provider> is optional self.library = parts[1] self.usdt_name = ":".join(parts[2:]) self.function = "" # no function, just address # We will discover the USDT provider by matching on # the USDT name in the specified library self._find_usdt_probe() else: self.library = ':'.join(parts[1:-1]) self.function = parts[-1] # only x64 syscalls needs checking, no other syscall wrapper yet. self.is_syscall_kprobe = False if self.probe_type == "p" and len(self.library) == 0 and \ self.function[:10] == "__x64_sys_": self.is_syscall_kprobe = True def _find_usdt_probe(self): target = Probe.pid if Probe.pid and Probe.pid != -1 \ else Probe.tgid self.usdt = USDT(path=self.library, pid=target) parts = self.usdt_name.split(":") if len(parts) == 1: provider_name = None usdt_name = parts[0].encode("ascii") else: provider_name = parts[0].encode("ascii") usdt_name = parts[1].encode("ascii") for probe in self.usdt.enumerate_probes(): if ((not provider_name or probe.provider == provider_name) and probe.name == usdt_name): return # Found it, will enable later self._bail("unrecognized USDT probe %s" % self.usdt_name) def _parse_filter(self, filt): self.filter = self._rewrite_expr(filt) def _parse_types(self, fmt): for match in re.finditer( r'[^%]%(s|u|d|lu|llu|ld|lld|hu|hd|x|lx|llx|c|K|U)', fmt): self.types.append(match.group(1)) fmt = re.sub(r'([^%]%)(u|d|lu|llu|ld|lld|hu|hd)', r'\1d', fmt) fmt = re.sub(r'([^%]%)(x|lx|llx)', r'\1x', fmt) fmt = re.sub('%K|%U', '%s', fmt) self.python_format = fmt.strip('"') def _parse_action(self, action): self.values = [] self.types = [] self.python_format = "" if len(action) == 0: return action = action.strip() match = re.search(r'(\".*?\"),?(.*)', action) if match is None: self._bail("expected format string in \"s") self.raw_format = match.group(1) self._parse_types(self.raw_format) for part in re.split('(?<!"),', match.group(2)): part = self._rewrite_expr(part) if len(part) > 0: self.values.append(part) aliases_arg = { "arg1": "PT_REGS_PARM1(ctx)", "arg2": "PT_REGS_PARM2(ctx)", "arg3": "PT_REGS_PARM3(ctx)", "arg4": "PT_REGS_PARM4(ctx)", "arg5": "PT_REGS_PARM5(ctx)", "arg6": "PT_REGS_PARM6(ctx)", } aliases_indarg = { "arg1": "({u64 _val; struct pt_regs *_ctx = (struct pt_regs *)PT_REGS_PARM1(ctx);" " bpf_probe_read_kernel(&_val, sizeof(_val), &(PT_REGS_PARM1(_ctx))); _val;})", "arg2": "({u64 _val; struct pt_regs *_ctx = (struct pt_regs *)PT_REGS_PARM1(ctx);" " bpf_probe_read_kernel(&_val, sizeof(_val), &(PT_REGS_PARM2(_ctx))); _val;})", "arg3": "({u64 _val; struct pt_regs *_ctx = (struct pt_regs *)PT_REGS_PARM1(ctx);" " bpf_probe_read_kernel(&_val, sizeof(_val), &(PT_REGS_PARM3(_ctx))); _val;})", "arg4": "({u64 _val; struct pt_regs *_ctx = (struct pt_regs *)PT_REGS_PARM1(ctx);" " bpf_probe_read_kernel(&_val, sizeof(_val), &(PT_REGS_PARM4(_ctx))); _val;})", "arg5": "({u64 _val; struct pt_regs *_ctx = (struct pt_regs *)PT_REGS_PARM1(ctx);" " bpf_probe_read_kernel(&_val, sizeof(_val), &(PT_REGS_PARM5(_ctx))); _val;})", "arg6": "({u64 _val; struct pt_regs *_ctx = (struct pt_regs *)PT_REGS_PARM1(ctx);" " bpf_probe_read_kernel(&_val, sizeof(_val), &(PT_REGS_PARM6(_ctx))); _val;})", } aliases_common = { "retval": "PT_REGS_RC(ctx)", "$uid": "(unsigned)(bpf_get_current_uid_gid() & 0xffffffff)", "$gid": "(unsigned)(bpf_get_current_uid_gid() >> 32)", "$pid": "(unsigned)(bpf_get_current_pid_tgid() & 0xffffffff)", "$tgid": "(unsigned)(bpf_get_current_pid_tgid() >> 32)", "$cpu": "bpf_get_smp_processor_id()", "$task": "((struct task_struct *)bpf_get_current_task())" } def _rewrite_expr(self, expr): # Find the occurances of any arg[1-6]@user. Use it later to # identify bpf_probe_read_user for matches in re.finditer(r'(arg[1-6])(@user)', expr): if matches.group(1).strip() not in self.probe_user_list: self.probe_user_list.add(matches.group(1).strip()) # Remove @user occurrences from arg before resolving to its # corresponding aliases. expr = re.sub(r'(arg[1-6])@user', r'\1', expr) rdict = StrcmpRewrite.rewrite_expr(expr, self.bin_cmp, self.library, self.probe_user_list, self.streq_functions, Probe.streq_index) expr = rdict["expr"] self.streq_functions = rdict["streq_functions"] Probe.streq_index = rdict["probeid"] alias_to_check = Probe.aliases_indarg \ if self.is_syscall_kprobe \ else Probe.aliases_arg # For USDT probes, we replace argN values with the # actual arguments for that probe obtained using # bpf_readarg_N macros emitted at BPF construction. if not self.probe_type == "u": for alias, replacement in alias_to_check.items(): expr = expr.replace(alias, replacement) for alias, replacement in Probe.aliases_common.items(): expr = expr.replace(alias, replacement) return expr c_type = {"u": "unsigned int", "d": "int", "lu": "unsigned long", "ld": "long", "llu": "unsigned long long", "lld": "long long", "hu": "unsigned short", "hd": "short", "x": "unsigned int", "lx": "unsigned long", "llx": "unsigned long long", "c": "char", "K": "unsigned long long", "U": "unsigned long long"} fmt_types = c_type.keys() def _generate_field_decl(self, idx): field_type = self.types[idx] if field_type == "s": return "char v%d[%d];\n" % (idx, self.string_size) if field_type in Probe.fmt_types: return "%s v%d;\n" % (Probe.c_type[field_type], idx) self._bail("unrecognized format specifier %s" % field_type) def _generate_data_decl(self): # The BPF program will populate values into the struct # according to the format string, and the Python program will # construct the final display string. self.events_name = "%s_events" % self.probe_name self.struct_name = "%s_data_t" % self.probe_name self.stacks_name = "%s_stacks" % self.probe_name stack_type = "BPF_STACK_TRACE" if self.build_id_enabled is False \ else "BPF_STACK_TRACE_BUILDID" stack_table = "%s(%s, 1024);" % (stack_type, self.stacks_name) \ if (self.kernel_stack or self.user_stack) else "" data_fields = "" for i, field_type in enumerate(self.types): data_fields += " " + \ self._generate_field_decl(i) time_str = "u64 timestamp_ns;" if self.time_field else "" cpu_str = "int cpu;" if self.print_cpu else "" kernel_stack_str = " int kernel_stack_id;" \ if self.kernel_stack else "" user_stack_str = " int user_stack_id;" \ if self.user_stack else "" text = """ struct %s { %s %s u32 tgid; u32 pid; char comm[TASK_COMM_LEN]; %s %s %s u32 uid; }; BPF_PERF_OUTPUT(%s); %s """ return text % (self.struct_name, time_str, cpu_str, data_fields, kernel_stack_str, user_stack_str, self.events_name, stack_table) def _generate_field_assign(self, idx): field_type = self.types[idx] expr = self.values[idx].strip() text = "" if self.probe_type == "u" and expr[0:3] == "arg": arg_index = int(expr[3]) arg_ctype = self.usdt.get_probe_arg_ctype( self.usdt_name, arg_index - 1) text = (" %s %s = 0;\n" + " bpf_usdt_readarg(%s, ctx, &%s);\n") \ % (arg_ctype, expr, expr[3], expr) probe_read_func = "bpf_probe_read_kernel" if field_type == "s": if self.library: probe_read_func = "bpf_probe_read_user" else: alias_to_check = Probe.aliases_indarg \ if self.is_syscall_kprobe \ else Probe.aliases_arg for arg, alias in alias_to_check.items(): if alias == expr and arg in self.probe_user_list: probe_read_func = "bpf_probe_read_user" break return text + """ if (%s != 0) { void *__tmp = (void *)%s; %s(&__data.v%d, sizeof(__data.v%d), __tmp); } """ % (expr, expr, probe_read_func, idx, idx) if field_type in Probe.fmt_types: return text + " __data.v%d = (%s)%s;\n" % \ (idx, Probe.c_type[field_type], expr) self._bail("unrecognized field type %s" % field_type) def _generate_usdt_filter_read(self): text = "" if self.probe_type != "u": return text for arg, _ in Probe.aliases_arg.items(): if not (arg in self.filter): continue arg_index = int(arg.replace("arg", "")) arg_ctype = self.usdt.get_probe_arg_ctype( self.usdt_name, arg_index - 1) if not arg_ctype: self._bail("Unable to determine type of {} " "in the filter".format(arg)) text += """ {} {}_filter; bpf_usdt_readarg({}, ctx, &{}_filter); """.format(arg_ctype, arg, arg_index, arg) self.filter = self.filter.replace( arg, "{}_filter".format(arg)) return text def generate_program(self, include_self): data_decl = self._generate_data_decl() if Probe.pid != -1: pid_filter = """ if (__pid != %d) { return 0; } """ % Probe.pid # uprobes can have a built-in tgid filter passed to # attach_uprobe, hence the check here -- for kprobes, we # need to do the tgid test by hand: elif len(self.library) == 0 and Probe.tgid != -1: pid_filter = """ if (__tgid != %d) { return 0; } """ % Probe.tgid elif not include_self: pid_filter = """ if (__tgid == %d) { return 0; } """ % os.getpid() else: pid_filter = "" if Probe.uid != -1: uid_filter = """ if (__uid != %d) { return 0; } """ % Probe.uid else: uid_filter = "" if self.cgroup_map_name is not None: cgroup_filter = """ if (%s.check_current_task(0) <= 0) { return 0; } """ % self.cgroup_map_name else: cgroup_filter = "" prefix = "" signature = "struct pt_regs *ctx" if self.signature: signature += ", " + self.signature data_fields = "" for i, expr in enumerate(self.values): data_fields += self._generate_field_assign(i) if self.probe_type == "t": heading = "TRACEPOINT_PROBE(%s, %s)" % \ (self.tp_category, self.tp_event) ctx_name = "args" else: heading = "int %s(%s)" % (self.probe_name, signature) ctx_name = "ctx" time_str = """ __data.timestamp_ns = bpf_ktime_get_ns();""" if self.time_field else "" cpu_str = """ __data.cpu = bpf_get_smp_processor_id();""" if self.print_cpu else "" stack_trace = "" if self.user_stack: stack_trace += """ __data.user_stack_id = %s.get_stackid( %s, BPF_F_USER_STACK );""" % (self.stacks_name, ctx_name) if self.kernel_stack: stack_trace += """ __data.kernel_stack_id = %s.get_stackid( %s, 0 );""" % (self.stacks_name, ctx_name) text = heading + """ { u64 __pid_tgid = bpf_get_current_pid_tgid(); u32 __tgid = __pid_tgid >> 32; u32 __pid = __pid_tgid; // implicit cast to u32 for bottom half u32 __uid = bpf_get_current_uid_gid(); %s %s %s %s %s if (!(%s)) return 0; struct %s __data = {0}; %s %s __data.tgid = __tgid; __data.pid = __pid; __data.uid = __uid; bpf_get_current_comm(&__data.comm, sizeof(__data.comm)); %s %s %s.perf_submit(%s, &__data, sizeof(__data)); return 0; } """ text = text % (pid_filter, uid_filter, cgroup_filter, prefix, self._generate_usdt_filter_read(), self.filter, self.struct_name, time_str, cpu_str, data_fields, stack_trace, self.events_name, ctx_name) return self.streq_functions + data_decl + "\n" + text @classmethod def _time_off_str(cls, timestamp_ns): offset = 1e-9 * (timestamp_ns - cls.first_ts) if cls.print_unix_timestamp: return "%.6f" % (offset + cls.first_ts_real) else: return "%.6f" % offset def _display_function(self): if self.probe_type == 'p' or self.probe_type == 'r': return self.function elif self.probe_type == 'u': return self.usdt_name else: # self.probe_type == 't' return self.tp_event def _stack_to_string(self, bpf, stack_id, tgid): if stack_id < 0: return (" %d" % stack_id) stackstr = '' stack = list(bpf.get_table(self.stacks_name).walk(stack_id)) for addr in stack: stackstr += ' ' if Probe.print_address: stackstr += ("%16x " % addr) symstr = bpf.sym(addr, tgid, show_module=True, show_offset=True) stackstr += ('%s\n' % (symstr.decode('utf-8'))) return stackstr def _format_message(self, bpf, tgid, values): # Replace each %K with kernel sym and %U with user sym in tgid kernel_placeholders = [i for i, t in enumerate(self.types) if t == 'K'] user_placeholders = [i for i, t in enumerate(self.types) if t == 'U'] string_placeholders = [i for i, t in enumerate(self.types) if t == 's'] for kp in kernel_placeholders: values[kp] = bpf.ksym(values[kp], show_offset=True) for up in user_placeholders: values[up] = bpf.sym(values[up], tgid, show_module=True, show_offset=True) for sp in string_placeholders: values[sp] = values[sp].decode('utf-8', 'replace') return self.python_format % tuple(values) def print_aggregate_events(self): for k, v in sorted(self.symcount.items(), key=lambda item: \ item[1], reverse=True): print("%s-->COUNT %d\n\n" % (k, v), end="") def print_event(self, bpf, cpu, data, size): event = bpf[self.events_name].event(data) if self.name not in event.comm: return values = list(map(lambda i: getattr(event, "v%d" % i), range(0, len(self.values)))) msg = self._format_message(bpf, event.tgid, values) if self.msg_filter and self.msg_filter not in msg: return eventstr = '' if Probe.print_time: time = strftime("%H:%M:%S") if Probe.use_localtime else \ Probe._time_off_str(event.timestamp_ns) if Probe.print_unix_timestamp: eventstr += ("%-17s " % time[:17]) else: eventstr += ("%-8s " % time[:8]) if Probe.print_cpu: eventstr += ("%-3s " % event.cpu) eventstr += ("%-7d %-7d %-15s %-16s %s\n" % (event.tgid, event.pid, event.comm.decode('utf-8', 'replace'), self._display_function(), msg)) if self.kernel_stack: eventstr += self._stack_to_string(bpf, event.kernel_stack_id, -1) if self.user_stack: eventstr += self._stack_to_string(bpf, event.user_stack_id, event.tgid) if self.aggregate is False: print(eventstr, end="") if self.kernel_stack or self.user_stack: print("") else: if eventstr in self.symcount: self.symcount[eventstr] += 1 else: self.symcount[eventstr] = 1 Probe.event_count += 1 if Probe.max_events is not None and \ Probe.event_count >= Probe.max_events: if self.aggregate: self.print_aggregate_events() sys.stdout.flush() Probe.done = True; def attach(self, bpf, verbose): if len(self.library) == 0: self._attach_k(bpf) else: self._attach_u(bpf) callback = partial(self.print_event, bpf) bpf[self.events_name].open_perf_buffer(callback, page_cnt=self.page_cnt) def _attach_k(self, bpf): if self.probe_type == "r": bpf.attach_kretprobe(event=self.function, fn_name=self.probe_name) elif self.probe_type == "p": bpf.attach_kprobe(event=self.function, fn_name=self.probe_name, event_off=self.offset) # Note that tracepoints don't need an explicit attach def _attach_u(self, bpf): libpath = BPF.find_library(self.library) if libpath is None: # This might be an executable (e.g. 'bash') libpath = BPF.find_exe(self.library) if libpath is None or len(libpath) == 0: self._bail("unable to find library %s" % self.library) if self.probe_type == "u": pass # Was already enabled by the BPF constructor elif self.probe_type == "r": bpf.attach_uretprobe(name=libpath, sym=self.function, fn_name=self.probe_name, pid=Probe.tgid) else: bpf.attach_uprobe(name=libpath, sym=self.function, fn_name=self.probe_name, pid=Probe.tgid, sym_off=self.offset) class Tool(object): DEFAULT_PERF_BUFFER_PAGES = 64 examples = """ EXAMPLES: trace do_sys_open Trace the open syscall and print a default trace message when entered trace kfree_skb+0x12 Trace the kfree_skb kernel function after the instruction on the 0x12 offset trace 'do_sys_open "%s", arg2@user' Trace the open syscall and print the filename being opened @user is added to arg2 in kprobes to ensure that char * should be copied from the userspace stack to the bpf stack. If not specified, previous behaviour is expected. trace 'do_sys_open "%s", arg2@user' -n main Trace the open syscall and only print event that process names containing "main" trace 'do_sys_open "%s", arg2@user' --uid 1001 Trace the open syscall and only print event that processes with user ID 1001 trace 'do_sys_open "%s", arg2@user' -f config Trace the open syscall and print the filename being opened filtered by "config" trace 'sys_read (arg3 > 20000) "read %d bytes", arg3' Trace the read syscall and print a message for reads >20000 bytes trace 'r::do_sys_open "%llx", retval' Trace the return from the open syscall and print the return value trace 'c:open (arg2 == 42) "%s %d", arg1, arg2' Trace the open() call from libc only if the flags (arg2) argument is 42 trace 'c:malloc "size = %d", arg1' Trace malloc calls and print the size being allocated trace 'p:c:write (arg1 == 1) "writing %d bytes to STDOUT", arg3' Trace the write() call from libc to monitor writes to STDOUT trace 'r::__kmalloc (retval == 0) "kmalloc failed!"' Trace returns from __kmalloc which returned a null pointer trace 'r:c:malloc (retval) "allocated = %x", retval' Trace returns from malloc and print non-NULL allocated buffers trace 't:block:block_rq_complete "sectors=%d", args->nr_sector' Trace the block_rq_complete kernel tracepoint and print # of tx sectors trace 'u:pthread:pthread_create (arg4 != 0)' Trace the USDT probe pthread_create when its 4th argument is non-zero trace 'u:pthread:libpthread:pthread_create (arg4 != 0)' Ditto, but the provider name "libpthread" is specified. trace 'p::SyS_nanosleep(struct timespec *ts) "sleep for %lld ns", ts->tv_nsec' Trace the nanosleep syscall and print the sleep duration in ns trace -c /sys/fs/cgroup/system.slice/workload.service '__x64_sys_nanosleep' '__x64_sys_clone' Trace nanosleep/clone syscall calls only under workload.service cgroup hierarchy. trace -I 'linux/fs.h' \\ 'p::uprobe_register(struct inode *inode) "a_ops = %llx", inode->i_mapping->a_ops' Trace the uprobe_register inode mapping ops, and the symbol can be found in /proc/kallsyms trace -I 'kernel/sched/sched.h' \\ 'p::__account_cfs_rq_runtime(struct cfs_rq *cfs_rq) "%d", cfs_rq->runtime_remaining' Trace the cfs scheduling runqueue remaining runtime. The struct cfs_rq is defined in kernel/sched/sched.h which is in kernel source tree and not in kernel-devel package. So this command needs to run at the kernel source tree root directory so that the added header file can be found by the compiler. trace -I 'net/sock.h' \\ 'udpv6_sendmsg(struct sock *sk) (sk->sk_dport == 13568)' Trace udpv6 sendmsg calls only if socket's destination port is equal to 53 (DNS; 13568 in big endian order) trace -I 'linux/fs_struct.h' 'mntns_install "users = %d", $task->fs->users' Trace the number of users accessing the file system of the current task trace -s /lib/x86_64-linux-gnu/libc.so.6,/bin/ping 'p:c:inet_pton' -U Trace inet_pton system call and use the specified libraries/executables for symbol resolution. """ def __init__(self): parser = argparse.ArgumentParser(description="Attach to " + "functions and print trace messages.", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=Tool.examples) parser.add_argument("-b", "--buffer-pages", type=int, default=Tool.DEFAULT_PERF_BUFFER_PAGES, help="number of pages to use for perf_events ring buffer " "(default: %(default)d)") # we'll refer to the userspace concepts of "pid" and "tid" by # their kernel names -- tgid and pid -- inside the script parser.add_argument("-p", "--pid", type=int, metavar="PID", dest="tgid", help="id of the process to trace (optional)") parser.add_argument("-L", "--tid", type=int, metavar="TID", dest="pid", help="id of the thread to trace (optional)") parser.add_argument("--uid", type=int, metavar="UID", dest="uid", help="id of the user to trace (optional)") parser.add_argument("-v", "--verbose", action="store_true", help="print resulting BPF program code before executing") parser.add_argument("-Z", "--string-size", type=int, default=80, help="maximum size to read from strings") parser.add_argument("-S", "--include-self", action="store_true", help="do not filter trace's own pid from the trace") parser.add_argument("-M", "--max-events", type=int, help="number of events to print before quitting") parser.add_argument("-t", "--timestamp", action="store_true", help="print timestamp column (offset from trace start)") parser.add_argument("-u", "--unix-timestamp", action="store_true", help="print UNIX timestamp instead of offset from trace start, requires -t") parser.add_argument("-T", "--time", action="store_true", help="print time column") parser.add_argument("-C", "--print_cpu", action="store_true", help="print CPU id") parser.add_argument("-c", "--cgroup-path", type=str, metavar="CGROUP_PATH", dest="cgroup_path", help="cgroup path") parser.add_argument("-n", "--name", type=str, help="only print process names containing this name") parser.add_argument("-f", "--msg-filter", type=str, dest="msg_filter", help="only print the msg of event containing this string") parser.add_argument("-B", "--bin_cmp", action="store_true", help="allow to use STRCMP with binary values") parser.add_argument('-s', "--sym_file_list", type=str, metavar="SYM_FILE_LIST", dest="sym_file_list", help="comma separated list of symbol files to use \ for symbol resolution") parser.add_argument("-K", "--kernel-stack", action="store_true", help="output kernel stack trace") parser.add_argument("-U", "--user-stack", action="store_true", help="output user stack trace") parser.add_argument("-a", "--address", action="store_true", help="print virtual address in stacks") parser.add_argument(metavar="probe", dest="probes", nargs="+", help="probe specifier (see examples)") parser.add_argument("-I", "--include", action="append", metavar="header", help="additional header files to include in the BPF program " "as either full path, " "or relative to current working directory, " "or relative to default kernel header search path") parser.add_argument("-A", "--aggregate", action="store_true", help="aggregate amount of each trace") parser.add_argument("--ebpf", action="store_true", help=argparse.SUPPRESS) self.args = parser.parse_args() if self.args.tgid and self.args.pid: parser.error("only one of -p and -L may be specified") if self.args.cgroup_path is not None: self.cgroup_map_name = "__cgroup" else: self.cgroup_map_name = None def _create_probes(self): Probe.configure(self.args) self.probes = [] for probe_spec in self.args.probes: self.probes.append(Probe( probe_spec, self.args.string_size, self.args.kernel_stack, self.args.user_stack, self.cgroup_map_name, self.args.name, self.args.msg_filter)) def _generate_program(self): self.program = """ #include <linux/ptrace.h> #include <linux/sched.h> /* For TASK_COMM_LEN */ """ for include in (self.args.include or []): if include.startswith((".", "/")): include = os.path.abspath(include) self.program += "#include \"%s\"\n" % include else: self.program += "#include <%s>\n" % include self.program += BPF.generate_auto_includes( map(lambda p: p.raw_probe, self.probes)) if self.cgroup_map_name is not None: self.program += "BPF_CGROUP_ARRAY(%s, 1);\n" % \ self.cgroup_map_name for probe in self.probes: self.program += probe.generate_program( self.args.include_self) if self.args.verbose or self.args.ebpf: print(self.program) if self.args.ebpf: exit() def _attach_probes(self): usdt_contexts = [] for probe in self.probes: if probe.usdt: # USDT probes must be enabled before the BPF object # is initialized, because that's where the actual # uprobe is being attached. probe.usdt.enable_probe( probe.usdt_name, probe.probe_name) if self.args.verbose: print(probe.usdt.get_text()) usdt_contexts.append(probe.usdt) self.bpf = BPF(text=self.program, usdt_contexts=usdt_contexts) if self.args.sym_file_list is not None: print("Note: Kernel bpf will report stack map with ip/build_id") map(lambda x: self.bpf.add_module(x), self.args.sym_file_list.split(',')) # if cgroup filter is requested, update the cgroup array map if self.cgroup_map_name is not None: cgroup_array = self.bpf.get_table(self.cgroup_map_name) cgroup_array[0] = self.args.cgroup_path for probe in self.probes: if self.args.verbose: print(probe) probe.attach(self.bpf, self.args.verbose) def _main_loop(self): all_probes_trivial = all(map(Probe.is_default_action, self.probes)) # Print header if self.args.timestamp or self.args.time: col_fmt = "%-17s " if self.args.unix_timestamp else "%-8s " print(col_fmt % "TIME", end="") if self.args.print_cpu: print("%-3s " % "CPU", end="") print("%-7s %-7s %-15s %-16s %s" % ("PID", "TID", "COMM", "FUNC", "-" if not all_probes_trivial else "")) sys.stdout.flush() while not Probe.done: self.bpf.perf_buffer_poll() def run(self): try: self._create_probes() self._generate_program() self._attach_probes() self._main_loop() except: exc_info = sys.exc_info() sys_exit = exc_info[0] is SystemExit if self.args.verbose: traceback.print_exc() elif not sys_exit: print(exc_info[1]) exit(0 if sys_exit else 1) if __name__ == "__main__": Tool().run()
Close
