[20261008]bpftrace定义结构体例子.txt

--//前几天确定sskgphpjw函数计算Semaphore Arrays key。sskgphpjw函数仅仅传递1个参数，并且字符串长度实际0x108，rdi的地址实
--//际上指向某个结构体的指针。

--//当时就有1个想法，能否在bpftrace脚本定义1个结构体，实现类似功能。

$ cat sskgphpjw1.bt
struct sskgphpjw_input {
    unsigned char data[0x100];  // 偏移 0x00，字符串/名字数据
    uint64_t len;               // 偏移 0x100，8 字节长度
};

uprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:sskgphpjw,
uprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:sskgph2
/ $1 == 0 || pid == $1 /
{
    $ss = (struct sskgphpjw_input *) arg0;
    //$len = * (uint64 *)(arg0 + 0x100);
    printf("[%s] %s pid=%d ptr=0x%016lx len=%lu str=%s\n", strftime("%H:%M:%S", nsecs), func, pid, arg0, $ss->len ,buf($ss->data,$ss->len));
    //print(ustack);
}

uretprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:sskgphpjw,
uretprobe:/u01/app/oracle/product/21.0.0/dbhome_1/bin/oracle:sskgph2
/ $1 == 0 || pid == $1 /
{
    printf("[%s] %s pid=%d return hash_value=0x%08lx %lu\n", strftime("%H:%M:%S", nsecs), func, pid, retval, retval);
}
--//sskgph2函数类似sskgphpjw函数。

--//简单测试如下：
# bpftrace sskgphpjw1.bt 0
Attached 4 probes
[15:46:29] sskgphpjw pid=5196 ptr=0x00007ffcc4471ee0 len=43 str=book/u01/app/oracle/product/21.0.0/dbhome_1
[15:46:29] sskgphpjw pid=5196 return hash_value=0x5507207c 1426530428
[15:46:29] sskgphpjw pid=5196 ptr=0x00007ffcc4471ee0 len=43 str=cppl0v120bqq0psbdmf0qspevdu032/1/10ecipnf`2
[15:46:29] sskgphpjw pid=5196 return hash_value=0x7e0edb60 2114902880
[15:46:29] sskgphpjw pid=5196 ptr=0x00007ffcc4471ee0 len=43 str=dqqm1w231crr1qtceng1rtqfwev14302021fdjqoga3
[15:46:29] sskgphpjw pid=5196 return hash_value=0x99eaaedc 2582294236
[15:46:29] sskgphpjw pid=5196 ptr=0x00007ffcc4471ee0 len=43 str=errn2x342dss2rudfoh2surgxfw25413132gekrphb4
[15:46:29] sskgphpjw pid=5196 return hash_value=0x32fcf5bc 855438780
[15:46:29] sskgph2 pid=5196 ptr=0x00007ffcc4472738 len=43 str=book/u01/app/oracle/product/21.0.0/dbhome_1
[15:46:29] sskgph2 pid=5196 return hash_value=0x9937c3fd 2570568701

$ ipcs -s
------ Semaphore Arrays --------
key        semid      owner      perms      nsems
0x5507207c 27         oracle     600        250