%{ #include %} global mypage function change_name:long (filename:long) %{ /* pure */ char *page = (char *)__get_free_page(GFP_KERNEL); page[0] = 't'; page[1] = 't'; page[2] = '\0'; THIS->__retvalue = (long)page; %} # function change_name2:long (filename:long) %{ /* pure */ # char *p = (char *)(long)THIS->filename; # p[0] = 't'; # p[1] = 't'; # p[2] = 0; # THIS->__retvalue = (long)p; # %} probe syscall.open { if (pid() == target()) { println("====================") println(argstr) if (($flags & 07) == 1 || ($flags & 07) == 2) { change_flag = 1 } mypage = 0 if (change_flag == 1) { # $filename = $filename + 0x1 # printf("%s\n", kernel_string($filename)) #print_backtrace() print_regs() printf("%p\n", $filename) $filename = change_name($filename) mypage = $filename printf("%p\n", $filename) println(kernel_string($filename)) } } } function my_free_page (paddr:long) %{ if (THIS->paddr) { free_page(THIS->paddr); } %} probe syscall.open.return { println(retstr) if (mypage) { printf("syscall open returns: %d\n", $return) my_free_page(mypage); } println("--------------------") }