kprobes使用例子

1:

ifneq ($(KERNELRELEASE),)

 obj-m = myjprobe.o
# Otherwise we were called directly from the command
# line; invoke the kernel build system.
else

KERNELDIR ?= /lib/modules/$(shell uname -r)/build
PWD := $(shell pwd)
default:
 $(MAKE) -C $(KERNELDIR) M=$(PWD) modules

clean:
 rm -fr .*cmd .tmp* *odule* *o *mod.c 
endif

 

 

 

2:

/*
 * Here's a sample kernel module showing the use of jprobes to dump
 * the arguments of do_fork().
 *
 * For more information on theory of operation of jprobes, see
 * Documentation/kprobes.txt
 *
 */

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kprobes.h>
#include <linux/kbd_kern.h>
#include <linux/kbd_diacr.h>
#include <linux/vt_kern.h>
#include <linux/sysrq.h>
#include <linux/input.h>

static void jkbd_event(struct input_handle *handle, unsigned int event_type,
                      unsigned int event_code, int value)
{
 if (event_type == EV_KEY)
  goto end;
  
 printk(KERN_INFO "jkbd_event+dump_stack: etype:0x%x, ecode:0x%x, value:0x%x\n",
        event_type, event_code, value);

 dump_stack();
end:
 /* Always end with a call to jprobe_return(). */
 jprobe_return();
 return;
}

static struct jprobe my_jprobe = {
 .entry   = jkbd_event,
 .kp = {
  .symbol_name = "kbd_event",
 },
};

static int __init jprobe_init(void)
{
 int ret;

 ret = register_jprobe(&my_jprobe);
 if (ret < 0) {
  printk(KERN_INFO "register_jprobe failed, returned %d\n", ret);
  return -1;
 }
 printk(KERN_INFO "Planted jprobe at %p, handler addr %p\n",
        my_jprobe.kp.addr, my_jprobe.entry);
 return 0;
}

static void __exit jprobe_exit(void)
{
 unregister_jprobe(&my_jprobe);
 printk(KERN_INFO "jprobe at %p unregistered\n", my_jprobe.kp.addr);
}

module_init(jprobe_init)
module_exit(jprobe_exit)
MODULE_LICENSE("GPL");