08(09)(10).类比FridaXposed学eBPF（上.中.下）

# initialize BPF
b = BPF(text=bpf_text)   # 这是一个构造函数 , 构造了一个对象, 对象传递给了,  b的这个变量, 
if not is_support_kfunc:
    b.attach_kprobe(event=fnname_open, fn_name="syscall__trace_entry_open")
    b.attach_kretprobe(event=fnname_open, fn_name="trace_return")

    b.attach_kprobe(event=fnname_openat, fn_name="syscall__trace_entry_openat") # 这是 c定义的回调, syscall__trace_entry_openat, 这是系统调用定义的变量. fnname_openat
    b.attach_kretprobe(event=fnname_openat, fn_name="trace_return")

    if fnname_openat2:
        b.attach_kprobe(event=fnname_openat2, fn_name="syscall__trace_entry_openat2")
        b.attach_kretprobe(event=fnname_openat2, fn_name="trace_return")

initial_ts = 0

1. attach_kprobe()

Syntax: BPF.attach_kprobe(event="event", fn_name="name")

Instruments the kernel function event() using kernel dynamic tracing of the function entry, and attaches our C defined function name() to be called when the kernel function is called.
使用函数入口的内核动态跟踪来检测内核函数 event（），并附加我们的 C 定义的函数 name（） 以便在调用内核函数时调用。
For example:

b.attach_kprobe(event="sys_clone", fn_name="do_trace")

This will instrument the kernel sys_clone() function, which will then run our BPF defined do_trace() function each time it is called.
这将检测内核 sys_clone（） 函数，然后每次调用 BPF 定义的 do_trace（） 函数时，该函数都将运行该函数。
You can call attach_kprobe() more than once, and attach your BPF function to multiple kernel functions. You can also call attach_kprobe() more than once to attach multiple BPF functions to the same kernel function.
您可以多次调用 attach_kprobe（），并将 BPF 函数附加到多个内核函数。您还可以多次调用 attach_kprobe（） 以将多个 BPF 函数附加到同一个内核函数。
See the previous kprobes section for how to instrument arguments from BPF.
有关如何检测 BPF 中的参数，请参阅前面的 kprobes 部分。
Examples in situ: search /examples, search /tools

b = BPF(text='')
# open and openat are always in place since 2.6.16
fnname_open = b.get_syscall_prefix().decode() + 'open'
fnname_openat = b.get_syscall_prefix().decode() + 'openat'  # 通过 fnname_openat 这个函数来查找到的出处.
fnname_openat2 = b.get_syscall_prefix().decode() + 'openat2'

Syntax: BPF.get_syscall_fnname(name : str)

Return the corresponding kernel function name of the syscall. This helper function will try different prefixes and use the right one to concatenate with the syscall name. Note that the return value may vary in different versions of linux kernel and sometimes it will causing trouble. (see #2590)
他会跟着正确的前缀拼接起来.  返回值会不停的变化, 在不同的版本和linux 的内核上,  可能还会出现问题.  在最新的api上可能已经不是这个方式了.   

print("The function name of %s in kernel is %s" % ("clone", b.get_syscall_fnname("clone")))  # 应该使用这个api 来或者 真正系统调用的名字. 
# sys_clone or __x64_sys_clone or ...

Examples in situ: search /examples, search /tools

b.attach_uprobe(name="c", sym="strlen", fn_name="count")   // 这里可以直接 hook 一个 strlen C 的回调函数.

Syntax: BPF.attach_uprobe(name="location", sym="symbol", fn_name="name" [, sym_off=int]), BPF.attach_uprobe(name="location", sym_re="regex", fn_name="name"), BPF.attach_uprobe(name="location", addr=int, fn_name="name")

Instruments the user-level function symbol() from either the library or binary named by location using user-level dynamic tracing of the function entry, and attach our C defined function name() to be called whenever the user-level function is called. If sym_off is given, the function is attached to the offset within the symbol.
使用函数入口的用户级动态跟踪，从按位置命名的库或二进制文件中检测用户级函数 symbol（），并附加我们的 C 定义的函数 name（），以便在调用用户级函数时调用。如果给出了 sym_off ，则函数将附加到 symbol 内的偏移量。
The real address addr may be supplied in place of sym, in which case sym must be set to its default value. If the file is a non-PIE executable, addr must be a virtual address, otherwise it must be an offset relative to the file load address.
可以提供实际地址 addr 来代替 sym，在这种情况下，sym 必须设置为其默认值。如果文件是非 PIE 可执行文件，则 addr 必须是虚拟地址，否则它必须是相对于文件加载地址的偏移量。
Instead of a symbol name, a regular expression can be provided in sym_re. The uprobe will then attach to symbols that match the provided regular expression.
可以在 sym_re 中提供正则表达式，而不是元件名称。然后，uprobe 将附加到与提供的正则表达式匹配的符号。
Libraries can be given in the name argument without the lib prefix, or with the full path (/usr/lib/...). Binaries can be given only with the full path (/bin/sh).
库可以在 name 参数中给出，不带 lib 前缀，也可以给出完整路径 （/usr/lib/...）。二进制文件只能使用完整路径 （/bin/sh） 提供。

def attach_openssl(lib):
    b.attach_uprobe(name=lib, sym="SSL_write",
                    fn_name="probe_SSL_rw_enter", pid=args.pid or -1)
    b.attach_uretprobe(name=lib, sym="SSL_write",
                       fn_name="probe_SSL_write_exit", pid=args.pid or -1)
    b.attach_uprobe(name=lib, sym="SSL_read",
                    fn_name="probe_SSL_rw_enter", pid=args.pid or -1)
    b.attach_uretprobe(name=lib, sym="SSL_read",
                       fn_name="probe_SSL_read_exit", pid=args.pid or -1)
    if args.latency and args.handshake:
        b.attach_uprobe(name="ssl", sym="SSL_do_handshake",
                        fn_name="probe_SSL_do_handshake_enter", pid=args.pid or -1)
        b.attach_uretprobe(name="ssl", sym="SSL_do_handshake",
                           fn_name="probe_SSL_do_handshake_exit", pid=args.pid or -1)

/***********************************************************
 * BPF probe function entry-points
 ***********************************************************/

// Function signature being probed:
// int SSL_write(SSL *ssl, const void *buf, int num);
SEC("uprobe/SSL_write")                           // 这里即使 u --> user -->  代表用户的空间的探针
int probe_entry_SSL_write(struct pt_regs* ctx) {
    u64 current_pid_tgid = bpf_get_current_pid_tgid();
    u32 pid = current_pid_tgid >> 32;
    u64 current_uid_gid = bpf_get_current_uid_gid();
    u32 uid = current_uid_gid;

#ifndef KERNEL_LESS_5_2
    // if target_ppid is 0 then we target all pids
    if (target_pid != 0 && target_pid != pid) {
        return 0;
    }
    if (target_uid != 0 && target_uid != uid) {
        return 0;
    }
#endif


SEC("uretprobe/SSL_write")  // uretprobe/SSL_write 这里是 用户空间探针--> SSL_write
int probe_ret_SSL_write(struct pt_regs* ctx) {
    u64 current_pid_tgid = bpf_get_current_pid_tgid();
    u32 pid = current_pid_tgid >> 32;
    u64 current_uid_gid = bpf_get_current_uid_gid();
    u32 uid = current_uid_gid;

#ifndef KERNEL_LESS_5_2
    // if target_ppid is 0 then we target all pids
    if (target_pid != 0 && target_pid != pid) {
        return 0;
    }
    if (target_uid != 0 && target_uid != uid) {
        return 0;
    }
#endif
    debug_bpf_printk("openssl uretprobe/SSL_write pid :%d\n", pid);
    struct active_ssl_buf* active_ssl_buf_t =
        bpf_map_lookup_elem(&active_ssl_write_args_map, &current_pid_tgid);
    if (active_ssl_buf_t != NULL) {
        const char* buf;
        u32 fd = active_ssl_buf_t->fd;
        s32 version = active_ssl_buf_t->version;
        bpf_probe_read(&buf, sizeof(const char*), &active_ssl_buf_t->buf);
        process_SSL_data(ctx, current_pid_tgid, kSSLWrite, buf, fd, version);
    }
    bpf_map_delete_elem(&active_ssl_write_args_map, &current_pid_tgid);
    return 0;
}

4. uprobes

These are instrumented by declaring a normal function in C, then associating it as a uprobe probe in Python via BPF.attach_uprobe() (covered later).

Arguments can be examined using PT_REGS_PARM macros.

For example:

int count(struct pt_regs *ctx) {
    char buf[64];
    bpf_probe_read_user(&buf, sizeof(buf), (void *)PT_REGS_PARM1(ctx));
    bpf_trace_printk("%s %d", buf, PT_REGS_PARM2(ctx));
    return(0);
}

This reads the first argument as a string, and then prints it with the second argument as an integer.

Examples in situ: code