one-liner examples not work

[cheng-zhongliang]

my machine: ubuntu x86

one-liner example: ply 'kprobe:do_sys_open { printf("%v(%v): %s\n", comm, uid, str(arg1)); }'

not work:

[wkz]

Yeah, since writing that example, the kernel implementation has changed, and it seems that the call to do_sys_open() is now inlined into the syscall.

kprobes are not stable across kernel versions, so these issues continue to crop up. I have debated with myself if I should just stick to tracepoints in the examples, but they are just not as exciting 😄 . I will keep this issue open as a reminder to make a decision on this.

Anyway, for you particular example, I think you might have better luck with do_sys_openat2() on recent kernels:

kprobe:do_sys_openat2
{
    if (!strcmp(str(arg1), "TODO")) {
        print(pid, comm, str(arg1));
        exit(0);
    }
}