X7ROOT File Manager
Current Path:
/usr/share/systemtap/tapset/linux/x86_64
usr
/
share
/
systemtap
/
tapset
/
linux
/
x86_64
/
📁
..
📄
aux_syscalls.stp
(3.58 KB)
📄
sysc_arch_prctl.stp
(3.21 KB)
📄
sysc_compat_execve.stp
(1.59 KB)
📄
sysc_compat_fadvise64.stp
(6.92 KB)
📄
sysc_compat_fallocate.stp
(3.54 KB)
📄
sysc_compat_ftruncate64.stp
(3.34 KB)
📄
sysc_compat_lookup_dcookie.stp
(3.72 KB)
📄
sysc_compat_readahead.stp
(3.18 KB)
📄
sysc_compat_truncate64.stp
(3.45 KB)
📄
sysc_execve.stp
(1.62 KB)
📄
sysc_get_thread_area.stp
(3.18 KB)
📄
sysc_iopl.stp
(2.27 KB)
📄
sysc_mmap.stp
(4.04 KB)
📄
sysc_mmap2.stp
(2.62 KB)
📄
sysc_pipe32.stp
(1.54 KB)
📄
sysc_set_thread_area.stp
(3.13 KB)
📄
sysc_sigaltstack.stp
(2.24 KB)
📄
sysc_sysctl32.stp
(1.12 KB)
📄
sysc_vm86_warning.stp
(1.17 KB)
📄
syscall_num.stp
(53.77 KB)
Editing: sysc_compat_truncate64.stp
# truncate _______________________________________________________ # # asmlinkage long sys32_truncate64(const char __user *filename, # unsigned long offset_low, # unsigned long offset_high) # COMPAT_SYSCALL_DEFINE3(x86_truncate64, const char __user *, filename, # unsigned long, offset_low, unsigned long, offset_high) # @define _SYSCALL_COMPAT_TRUNCATE64_NAME %( name = "truncate" %) @define _SYSCALL_COMPAT_TRUNCATE64_ARGSTR %( argstr = sprintf("%s, %d", path, length) %) @define _SYSCALL_COMPAT_TRUNCATE64_REGARGS %( path_uaddr = pointer_arg(1) path = user_string_quoted(path_uaddr) length = ((uint_arg(3) << 32) | uint_arg(2)) %) probe syscall.compat_truncate64 = dw_syscall.compat_truncate64 !, nd_syscall.compat_truncate64 ? {} probe syscall.compat_truncate64.return = dw_syscall.compat_truncate64.return !, nd_syscall.compat_truncate64.return ? {} # dw_compat_truncate64 _____________________________________________________ probe dw_syscall.compat_truncate64 = kernel.function("sys32_truncate64").call ?, kernel.function("compat_sys_x86_truncate64").call ? { @_SYSCALL_COMPAT_TRUNCATE64_NAME path_uaddr = $filename path = user_string_quoted(path_uaddr) length = (($offset_high << 32) | $offset_low) @_SYSCALL_COMPAT_TRUNCATE64_ARGSTR } probe dw_syscall.compat_truncate64.return = kernel.function("sys32_truncate64").return ?, kernel.function("compat_sys_x86_truncate64").return ? { @_SYSCALL_COMPAT_TRUNCATE64_NAME @SYSC_RETVALSTR($return) } # nd_compat_truncate64 _____________________________________________________ probe nd_syscall.compat_truncate64 = nd1_syscall.compat_truncate64!, nd2_syscall.compat_truncate64!, tp_syscall.compat_truncate64 { } probe nd1_syscall.compat_truncate64 = kprobe.function("sys32_truncate64") ?, kprobe.function("compat_sys_x86_truncate64") ? { asmlinkage() @_SYSCALL_COMPAT_TRUNCATE64_NAME @_SYSCALL_COMPAT_TRUNCATE64_REGARGS @_SYSCALL_COMPAT_TRUNCATE64_ARGSTR } /* kernel 4.17+ */ probe nd2_syscall.compat_truncate64 = kprobe.function(@arch_syscall_prefix "compat_sys_x86_truncate64") ? { __set_syscall_pt_regs(pointer_arg(1)) @_SYSCALL_COMPAT_TRUNCATE64_NAME @_SYSCALL_COMPAT_TRUNCATE64_REGARGS @_SYSCALL_COMPAT_TRUNCATE64_ARGSTR } /* kernel 3.5+, but undesirable because it affects all syscalls */ probe tp_syscall.compat_truncate64 = kernel.trace("sys_enter") { __set_syscall_pt_regs($regs) @__compat_syscall_gate(@const("__NR_ia32_truncate64")) @_SYSCALL_COMPAT_TRUNCATE64_NAME @_SYSCALL_COMPAT_TRUNCATE64_REGARGS @_SYSCALL_COMPAT_TRUNCATE64_ARGSTR } probe nd_syscall.compat_truncate64.return = nd1_syscall.compat_truncate64.return!, nd2_syscall.compat_truncate64.return!, tp_syscall.compat_truncate64.return { } probe nd1_syscall.compat_truncate64.return = kprobe.function("sys32_truncate64").return ?, kprobe.function("compat_sys_x86_truncate64").return ? { @_SYSCALL_COMPAT_TRUNCATE64_NAME @SYSC_RETVALSTR(returnval()) } /* kernel 4.17+ */ probe nd2_syscall.compat_truncate64.return = kprobe.function(@arch_syscall_prefix "compat_sys_x86_truncate64").return ? { @_SYSCALL_COMPAT_TRUNCATE64_NAME @SYSC_RETVALSTR(returnval()) } /* kernel 3.5+, but undesirable because it affects all syscalls */ probe tp_syscall.compat_truncate64.return = kernel.trace("sys_exit") { __set_syscall_pt_regs($regs) @__compat_syscall_gate(@const("__NR_ia32_truncate64")) @_SYSCALL_COMPAT_TRUNCATE64_NAME @SYSC_RETVALSTR($ret) }
Upload File
Create Folder