ebpf:拦截函数调用

时间:2018-03-16 11:15:16

标签: linux-kernel system-calls bpf kprobe ebpf

我正在阅读有关private FlexTable flexTable=new FlexTable(); private Button[]buyAndSellButtons = new Button[2]; private TextBox[] textField=new TextBox[2]; private Label alert=new Label(); private LinkedList <String> stock=new LinkedList<>(); public View(){ createComponents(); } public VerticalPanel createComponents() { // Assume that the host HTML has elements defined whose // IDs are "slot1", "slot2". In a real app, you probably would not want // to hard-code IDs. Instead, you could, for example, search for all // elements with a particular CSS class and replace them with widgets. // HorizontalPanel[] horizontalPanel = new HorizontalPanel[4]; for (int x = 0; x < horizontalPanel.length; x++) { horizontalPanel[x] = new HorizontalPanel(); } alert.setStyleName("alert"); add(alert); flexTable.setText(0, 0, "BUY Orders"); flexTable.getCellFormatter().setStyleName(0, 0, "orderMatcherListHeader"); flexTable.setText(0, 1, "SELL Orders"); flexTable.getCellFormatter().setStyleName(0, 1, "orderMatcherListHeader"); flexTable.setStyleName("flexTable"); flexTable.setWidth("33em"); flexTable.setCellSpacing(5); flexTable.setCellPadding(3); add(flexTable); Label[] labels = new Label[2]; labels[0] = new Label("Volume"); labels[1] = new Label("Price"); for (Label label : labels) { label.setStyleName("label"); horizontalPanel[1].add(label); horizontalPanel[1].setStyleName("labelPosition"); } textField[0] = new TextBox(); textField[0].setTitle("Volume"); textField[1] = new TextBox(); textField[1].setTitle("Price"); for (TextBox textBox : textField) { textBox.setStyleName("textField"); textBox.setFocus(true); horizontalPanel[2].add(textBox); } buyAndSellButtons[0] = new Button("BUY"); buyAndSellButtons[1] = new Button("SELL"); for (Button button : buyAndSellButtons) { horizontalPanel[3].add(button); button.setStyleName("buttons"); horizontalPanel[3].setStyleName("buttonPosition"); } VerticalPanel[] mainPanel = new VerticalPanel[1]; mainPanel[0] = new VerticalPanel(); for (HorizontalPanel aHorizontalPanel : horizontalPanel) { mainPanel[0].add(aHorizontalPanel); mainPanel[0].setStyleName("mainPanel_1"); setStyleName("mainPanel"); add(mainPanel[0]); Window.addResizeHandler(new ResizeHandler() { @Override public void onResize(ResizeEvent event) { alert.setText("" + Window.getClientWidth()); } }); } Timer timer=new Timer() { int x; @Override public void run() { alert.setText(Window.getClientWidth()+"Attach" + x++); String[] gadget=new String[10]; gadget[0]=("354"); //android portrait gadget[1]=("625"); gadget[2]=("314"); gadget[3]=("474"); gadget[4]=("369"); gadget[5]=("562"); gadget[6]=("617");// android landscape gadget[7]=("48"); gadget[8]=("730"); alert.setText("" + Window.getClientWidth()+x++); if(Window.getClientWidth()<=425) { flexTable.getCellFormatter().setStyleName(0, 0, "orderMatcherListHeader_1"); flexTable.getCellFormatter().setStyleName(0, 1, "orderMatcherListHeader_1"); mainPanel[0].setStyleName("phonePortrait_1"); setStyleName("phonePortrait"); flexTable.setStyleName("flexTable_1"); if(Window.getClientWidth()==414){ flexTable.setWidth("26.2em"); }{ flexTable.setWidth("24.2em"); } flexTable.setCellSpacing(5); flexTable.setCellPadding(3); } else if((Window.getClientWidth()>425)&&(Window.getClientWidth()<=812)) { alert.setText("" + Window.getClientWidth()); flexTable.getCellFormatter().setStyleName(0, 0, "orderMatcherListHeader_1"); flexTable.getCellFormatter().setStyleName(0, 1, "orderMatcherListHeader_1"); mainPanel[0].setStyleName("phoneLandScape_1"); setStyleName("phoneLandScape"); flexTable.setStyleName("flexTable_1"); flexTable.setWidth("24.2em"); flexTable.setCellSpacing(5); flexTable.setCellPadding(3); }else { return; } } }; timer.scheduleRepeating(500); return this; } BPF程序类型的内容,我想知道是否有可能不仅为了跟踪目的而拦截函数调用或收集一些低级信息(寄存器,堆栈等),而且< em>替换一个调用并执行而不是实际的函数?

kprobes是否提供此功能,或者我正在查看错误的工具?

1 个答案:

答案 0 :(得分:4)

不,kprobes BPF程序只能读取对syscall参数和返回值的访问权限,它们无法修改寄存器,因此无法拦截函数调用。这是BPF验证者施加的限制。

但是,

内核模块可以使用kprobes拦截函数调用。