linux 内核进程监控 针对bash下启动的程序
2017-05-20 13:55
246 查看
#include #include #include #include /* For each probe you need to allocate a kprobe structure */ static struct kprobe kp = { .symbol_name = "sys_execve", }; /* kprobe pre_handler: called just before the probed instruction is executed */ static int handler_pre(struct kprobe *p, struct pt_regs *regs) { #ifdef CONFIG_X86 printk(KERN_INFO "pre_handler: p->addr = 0x%p, ip = %lx," " flags = 0x%lx,pid=%d,comm=%s,name=%s\n", p->addr, regs->ip, regs->flags,current->pid,current->comm,*((char **)regs->si)); char ** argv = (char **) regs->si; size_t exec_line_size=0; while(NULL!=*argv) { exec_line_size=exec_line_size+strlen(*argv)+1; argv++; } char *str = vmalloc(exec_line_size); if (NULL!=str) { memset(str,0,exec_line_size); argv = (char **) regs->si; while (NULL != *argv) { snprintf(str, exec_line_size, "%s%s",str, *argv); argv++; } printk("%s",str); vfree(str); } #endif #ifdef CONFIG_PPC printk(KERN_INFO "pre_handler: p->addr = 0x%p, nip = 0x%lx," " msr = 0x%lx\n", p->addr, regs->nip, regs->msr); #endif #ifdef CONFIG_MIPS printk(KERN_INFO "pre_handler: p->addr = 0x%p, epc = 0x%lx," " status = 0x%lx\n", p->addr, regs->cp0_epc, regs->cp0_status); #endif /* A dump_stack() here will give a stack backtrace */ return 0; } /* kprobe post_handler: called after the probed instruction is executed */ static void handler_post(struct kprobe *p, struct pt_regs *regs, unsigned long flags) { #ifdef CONFIG_X86 printk(KERN_INFO "post_handler: p->addr = 0x%p, flags = 0x%lx,pid=%d,comm=%s,name=%s\n", p->addr, regs->flags,current->pid,current->comm,(char *)regs->di); #endif #ifdef CONFIG_PPC printk(KERN_INFO "post_handler: p->addr = 0x%p, msr = 0x%lx\n", p->addr, regs->msr); #endif #ifdef CONFIG_MIPS printk(KERN_INFO "post_handler: p->addr = 0x%p, status = 0x%lx\n", p->addr, regs->cp0_status); #endif } /* * fault_handler: this is called if an exception is generated for any * instruction within the pre- or post-handler, or when Kprobes * single-steps the probed instruction. */ static int handler_fault(struct kprobe *p, struct pt_regs *regs, int trapnr) { printk(KERN_INFO "fault_handler: p->addr = 0x%p, trap #%dn", p->addr, trapnr); /* Return 0 because we don't handle the fault. */ return 0; } static int __init kprobe_init(void) { int ret; kp.pre_handler = handler_pre; kp.post_handler = handler_post; kp.fault_handler = handler_fault; ret = register_kprobe(&kp); if (ret < 0) { printk(KERN_INFO "register_kprobe failed, returned %d\n", ret); return ret; } printk(KERN_INFO "Planted kprobe at %p\n", kp.addr); return 0; } static void __exit kprobe_exit(void) { unregister_kprobe(&kp); printk(KERN_INFO "kprobe at %p unregistered\n", kp.addr); } module_init(kprobe_init) module_exit(kprobe_exit) MODULE_LICENSE("GPL");
相关文章推荐
- Linux内核启动进程流程
- [实践Ok]Linux下查看进程(程序)启动时的环境变量
- linux下用脚本实现:监控一个进程,不存在则将其启动。
- Linux进程启动过程分析do_execve(可执行程序的加载和运行)---Linux进程的管理与调度(十一)
- Linux下查看进程(程序)启动时的环境变量
- Linux内核分析-使用gdb跟踪调试内核从start_kernel到init进程启动
- shell 脚本监控程序是否正在执行, 如果没有执行, 则自动启动该进程
- linux根据进程号PID查找启动程序的全路径
- 通过简单的Linux内核启动程序代码窥探操作系统的启动原理
- shell 脚本监控程序是否正在执行, 如果没有执行, 则自动启动该进程
- linux内核完全注释---学习札记--引导启动程序boot
- 通过简单的Linux内核启动程序代码窥探操作系统的启动原理
- linux根据进程号PID查找启动程序的全路径
- 全面解析Linux 内核 3.10.x - 启动1号进程
- linux监控某进程是否存在,不存在则启动
- linux用文件锁实现保证一个程序只能启动一个进程
- linux如何根据进程ID查找启动程序的路径
- linux用文件锁实现保证一个程序只能启动一个进程
- Linux内核分析7:Linux内核装载和启动一个可执行程序的分析
- 我在delphi中用shellExecute启动了一个程序(ftp);然后想做一个等待,只到ftp进程结束,再继续下面的操作,请问如何监控这个进程是否已结束?