Using static kprobes – traditional approaches to probing

In this section, we'll cover writing kernel modules that can probe a kernel or module function in the traditional manner – statically. Any modifications will require a recompile of the source.

Demo 1 – static kprobe – trapping into the file open the traditional static kprobes way – simplest case

Right, let's see how we can trap into (or intercept) the do_sys_open() kernel routine by planting a kprobe. This code snippet will typically be within the init function of a kernel module. You'll find the code for this demo here: ch4/kprobes/1_kprobe:

// ch4/kprobes/1_kprobe/1_kprobe.c

#include "<...>/convenient.h"

#include <linux/kprobes.h>

[...]

static struct kprobe kpb; 

[...]  

/* Register the kprobe handler */

kpb.pre_handler = handler_pre;

kpb.post_handler = handler_post;

kpb.fault_handler = handler_fault;

kpb...