Struct redbpf::KProbe

pub struct KProbe { /* fields omitted */ }

Type to work with kprobes or kretprobes.

Implementations

impl KProbe

pub fn attach_kprobe(&mut self, fn_name: &str, offset: u64) -> Result<()>

Attach the kprobe or kretprobe.

Attach the probe to the function fn_name inside the kernel. If offset is given, the probe will be attached at that byte offset inside the function.

Example

use redbpf::Module;
let mut module = Module::parse(&std::fs::read("file.elf").unwrap()).unwrap();
for kprobe in module.kprobes_mut() {
    kprobe.attach_kprobe(&kprobe.name(), 0).unwrap();
}

pub fn detach_kprobe(&mut self, fn_name: &str, offset: u64) -> Result<()>

Detach the kprobe or kretprobe

This method is not needed to be called manually because all attachment points are detached and closed automatically when KProbe is dropped. But this method provides a feature for detaching a bpf program from kprobe event selectively.

Example

use redbpf::Module;
let mut module = Module::parse(&std::fs::read("file.elf").unwrap()).unwrap();
for kprobe in module.kprobes_mut() {
    kprobe.attach_kprobe(&kprobe.name(), 0).unwrap();
    // do some stuff...
    kprobe.detach_kprobe(&kprobe.name(), 0).unwrap();
}

pub fn name(&self) -> String

pub fn attach_type_str(&self) -> &'static str