Struct TextPoke

pub struct TextPoke {
    pub record_id: Option<RecordId>,
    pub addr: u64,
    pub old_bytes: Vec<u8>,
    pub new_bytes: Vec<u8>,
}

Records changes to kernel text i.e. self-modified code.

Examples

Running this example may require root privileges.

use std::fs::File;
use std::os::fd::AsRawFd;

use perf_event_open::config::{Cpu, Opts, Proc, WakeUpOn};
use perf_event_open::count::Counter;
use perf_event_open::event::sw::Software;

let event = Software::Dummy;
let target = (Proc::CURRENT, Cpu::ALL);

let mut opts = Opts::default();
opts.wake_up.on = WakeUpOn::Bytes(1);
opts.extra_record.ksymbol = true;
opts.extra_record.text_poke = true;

let counter = Counter::new(event, target, opts).unwrap();
let sampler = counter.sampler(5).unwrap();
counter.enable().unwrap();

// Insert a kernel module that registers a kprobe.
let file = File::open("register_kprobe_module.ko").unwrap();
unsafe {
    libc::syscall(libc::SYS_finit_module, file.as_raw_fd(), c"".as_ptr(), 0);
    libc::syscall(libc::SYS_delete_module, c"register_kprobe_module".as_ptr(), 0);
}

for it in sampler.iter() {
    println!("{:-?}", it);
}

Since linux-5.9: https://github.com/torvalds/linux/commit/e17d43b93e544f5016c0251d2074c15568d5d963

Fields

record_id: Option<RecordId>

Record IDs.

addr: u64

Address.

old_bytes: Vec<u8>

Old bytes.

new_bytes: Vec<u8>

New bytes.

Trait Implementations

impl Clone for TextPoke

fn clone(&self) -> TextPoke

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TextPoke

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.