github/kubeshark
1
0
Fork 0
mirror of https://github.com/kubeshark/kubeshark.git synced 2025-08-14 06:37:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix the key_gzip offsets

Browse Source
This commit is contained in:
M. Mert Yildiran 2022-06-02 01:48:09 +03:00
parent 9868a7723a
commit 308d3cfd87
No known key found for this signature in database
GPG Key ID: D42ADB236521BF7A
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
tap/tlstapper/bpf/golang_uprobes.c
View File

@ -138,8 +138,8 @@ static __always_inline int golang_net_http_gzipreader_read_uprobe(struct pt_regs
__u64 pid_tgid = bpf_get_current_pid_tgid();
__u64 pid = pid_tgid >> 32;
__u32 key_gzip;
// Address at ctx->rsp + 0x150 is common between golang_net_http_gzipreader_read_uprobe and golang_net_http_dialconn_uprobe
__u32 status = bpf_probe_read(&key_gzip, sizeof(key_gzip), stack_addr + 0x150);
// Address at ctx->rsp + 0x1b0 is common between golang_net_http_gzipreader_read_uprobe and golang_net_http_dialconn_uprobe
__u32 status = bpf_probe_read(&key_gzip, sizeof(key_gzip), stack_addr + 0x1b0);
if (status < 0) {
bpf_printk("[golang_net_http_gzipreader_read_uprobe] error reading key_gzip: %d", status);
return 0;
@ -226,8 +226,8 @@ static __always_inline int golang_net_http_dialconn_uprobe(struct pt_regs *ctx)
}
__u32 key_gzip;
// Address at ctx->rsp + 0x1d0 is common between golang_net_http_gzipreader_read_uprobe and golang_net_http_dialconn_uprobe
status = bpf_probe_read(&key_gzip, sizeof(key_gzip), stack_addr + 0x1d0);
// Address at ctx->rsp + 0x58 is common between golang_net_http_gzipreader_read_uprobe and golang_net_http_dialconn_uprobe
status = bpf_probe_read(&key_gzip, sizeof(key_gzip), stack_addr + 0x58);
if (status < 0) {
bpf_printk("[golang_net_http_dialconn_uprobe] error reading key_gzip: %d", status);
return 0;

BIN
tap/tlstapper/tlstapper_bpfeb.o
View File

Binary file not shown.

BIN
tap/tlstapper/tlstapper_bpfel.o
View File

Binary file not shown.