probe begin { curr = task_current() // Compare PIDs pid = pid() cast_pid = @cast(curr, "task_struct")->tgid if (pid == cast_pid) println("PID OK") else printf("PID %d != %d\n", pid, cast_pid) // Compare PIDs using a generated kernel module cast_pid = @cast(curr, "task_struct", "kernel")->tgid if (pid == cast_pid) println("PID2 OK") else printf("PID2 %d != %d\n", pid, cast_pid) // Compare execnames name = execname() cast_name = kernel_string(@cast(curr, "task_struct")->comm) if (name == cast_name) println("execname OK") else printf("execname \"%s\" != \"%s\"\n", name, cast_name) // Compare sa_data using a generated user module data = 42 cast_data = @cast(get_sockaddr(data), "sockaddr", "")->sa_data[0] if (data == cast_data) println("sa_data OK") else printf("sa_data %d != %d\n", data, cast_data) // Compare usage counter values through a struct address usage = @cast(curr, "task_struct")->usage->counter pusage = & @cast(curr, "task_struct")->usage cast_usage = @cast(pusage, "atomic_t")->counter if (usage == cast_usage) println("usage OK") else printf("usage %d != %d\n", usage, cast_usage) exit() } %{ #include %} function get_sockaddr:long(data:long) %{ static struct sockaddr sa = {0}; sa.sa_data[0] = THIS->data; THIS->__retvalue = (long)&sa; %}