Struct redbpf::UProbe

pub struct UProbe { /* fields omitted */ }

Type to work with uprobes or uretprobes.

Implementations

impl UProbe

pub fn attach_uprobe(
    &mut self,
    fn_name: Option<&str>,
    offset: u64,
    target: &str,
    pid: Option<pid_t>
) -> Result<()>

Attach the uprobe or uretprobe.

Attach the probe to the function fn_name defined in the library or binary at path. If an offset is given, the probe will be attached at that byte offset inside the function. If fn_name is None, then offset is treated as an absolute address.

If a pid is passed, only the corresponding process is traced.

Example

use redbpf::Module;
let mut module = Module::parse(&std::fs::read("file.elf").unwrap()).unwrap();
for uprobe in module.uprobes_mut() {
    uprobe.attach_uprobe(Some(&uprobe.name()), 0, "/lib/x86_64-linux-gnu/libc-2.30.so", None).unwrap();
}

pub fn detach_uprobe(
    &mut self,
    fn_name: Option<&str>,
    offset: u64,
    target: &str,
    pid: Option<pid_t>
) -> Result<()>

Detach the uprobe or uretprobe

This method is not needed to be called manually because all attachment points are detached and closed automatically when UProbe is dropped. But this method provides a feature for detaching a bpf program from uprobe event selectively.

Example

use redbpf::Module;
let mut module = Module::parse(&std::fs::read("file.elf").unwrap()).unwrap();
let uprobe = module.uprobe_mut("count_strlen").expect("bpf program not found");
uprobe.attach_uprobe(Some(&uprobe.name()), 0, "/lib/x86_64-linux-gnu/libc-2.30.so", None).unwrap();
// do some stuff...
uprobe.detach_uprobe(Some(&uprobe.name()), 0, "/lib/x86_64-linux-gnu/libc-2.30.so", None);

pub fn name(&self) -> String