diff --git a/tap/tlstapper/bpf/golang_uprobes.c b/tap/tlstapper/bpf/golang_uprobes.c index be3b4adee..f47d98127 100644 --- a/tap/tlstapper/bpf/golang_uprobes.c +++ b/tap/tlstapper/bpf/golang_uprobes.c @@ -81,8 +81,17 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { b->conn_addr = ctx->rsi; // go.itab.*net.TCPConn,net.Conn address b->is_request = false; - // Address at ctx->rbx & 0xfffffff000 holds the data - __u32 status = bpf_probe_read_str(&b->data, sizeof(b->data), (void*)(ctx->rbx & 0xfffffff000)); + void* stack_addr = (void*)ctx->rsp; + __u64 data_p; + // Address at ctx->rsp + 0xd8 holds the data + __u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8); + if (status < 0) { + bpf_printk("[golang_net_http_read_uprobe] error reading data pointer: %d", status); + bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); + return 0; + } + + status = bpf_probe_read_str(&b->data, sizeof(b->data), (void*)(data_p)); if (status < 0) { bpf_printk("[golang_crypto_tls_read_uprobe] error reading data: %d", status); bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index 71f39d94c..22a317685 100644 Binary files a/tap/tlstapper/tlstapper_bpfeb.o and b/tap/tlstapper/tlstapper_bpfeb.o differ diff --git a/tap/tlstapper/tlstapper_bpfel.o b/tap/tlstapper/tlstapper_bpfel.o index 0ec10183d..be0b3bf4f 100644 Binary files a/tap/tlstapper/tlstapper_bpfel.o and b/tap/tlstapper/tlstapper_bpfel.o differ