__ __ __ __ _____ _ _ _____ _ _ _ | \/ | \ \ / / | __ \ (_) | | / ____| | | | | | \ / |_ __\ V / | |__) | __ ___ ____ _| |_ ___ | (___ | |__ ___| | | | |\/| | '__|> < | ___/ '__| \ \ / / _` | __/ _ \ \___ \| '_ \ / _ \ | | | | | | |_ / . \ | | | | | |\ V / (_| | || __/ ____) | | | | __/ | | |_| |_|_(_)_/ \_\ |_| |_| |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1 if you need WebShell for Seo everyday contact me on Telegram Telegram Address : @jackleetFor_More_Tools:
Demonstrations of kvm_hypercall.py, showing eBPF/bcc based hypercall analysis This example demonstrates how we can statefully save static tracepoint events based on conditions being met for other events with which they are associated. Here, we wish to record kvm_exit and kvm_entry events which are linked to the kvm_hypercall event. We are interested in kvm_exit with exit reason as VMCALL (18). This may be useful to analyze latency caused by a hypercall itself. To test this, while the python script is run, induce a hypercall from a guest based on the following example: https://gist.github.com/abenbachir/344822b5ba9fc5ac384cdec3f087e018 # ./kvm_hypercall.py TIME(s) COMM PID MESSAGE 2445.577087000 CPU 0/KVM 8896 KVM_EXIT exit_reason : 18 2445.577122000 CPU 0/KVM 8896 HYPERCALL nr : 0 2445.577129000 CPU 0/KVM 8896 KVM_ENTRY vcpu_id : 0 2445.577136000 CPU 0/KVM 8896 KVM_EXIT exit_reason : 18 2445.577145000 CPU 0/KVM 8896 HYPERCALL nr : 1 2445.577149000 CPU 0/KVM 8896 KVM_ENTRY vcpu_id : 0 2445.577155000 CPU 0/KVM 8896 KVM_EXIT exit_reason : 18 2445.577160000 CPU 0/KVM 8896 HYPERCALL nr : 2 2445.577164000 CPU 0/KVM 8896 KVM_ENTRY vcpu_id : 0 2445.577170000 CPU 0/KVM 8896 KVM_EXIT exit_reason : 18 2445.577175000 CPU 0/KVM 8896 HYPERCALL nr : 3 2445.577179000 CPU 0/KVM 8896 KVM_ENTRY vcpu_id : 0 2445.577185000 CPU 0/KVM 8896 KVM_EXIT exit_reason : 18 2445.577190000 CPU 0/KVM 8896 HYPERCALL nr : 4 2445.577194000 CPU 0/KVM 8896 KVM_ENTRY vcpu_id : 0 This output shows a sequence of exit -> hypercall -> entry where the exit_reason was VMCALL.
| Name | Type | Size | Permission | Actions |
|---|---|---|---|---|
| CMakeLists.txt | File | 276 B | 0644 |
|
| biolatpcts.py | File | 3.23 KB | 0755 |
|
| biolatpcts_example.txt | File | 650 B | 0644 |
|
| bitehist.py | File | 1.36 KB | 0755 |
|
| bitehist_example.txt | File | 1.18 KB | 0644 |
|
| dddos.py | File | 3.73 KB | 0755 |
|
| dddos_example.txt | File | 2.06 KB | 0644 |
|
| disksnoop.py | File | 1.9 KB | 0755 |
|
| disksnoop_example.txt | File | 1.55 KB | 0644 |
|
| hello_fields.py | File | 679 B | 0755 |
|
| hello_perf_output.py | File | 1.24 KB | 0755 |
|
| hello_perf_output_using_ns.py | File | 1.8 KB | 0755 |
|
| kvm_hypercall.py | File | 1.48 KB | 0755 |
|
| kvm_hypercall.txt | File | 1.74 KB | 0644 |
|
| mallocstacks.py | File | 1.9 KB | 0755 |
|
| mysqld_query.py | File | 1.66 KB | 0755 |
|
| mysqld_query_example.txt | File | 499 B | 0644 |
|
| nflatency.py | File | 6.07 KB | 0755 |
|
| nodejs_http_server.py | File | 1.34 KB | 0755 |
|
| nodejs_http_server_example.txt | File | 276 B | 0644 |
|
| stack_buildid_example.py | File | 3.03 KB | 0755 |
|
| stacksnoop.py | File | 3.18 KB | 0755 |
|
| stacksnoop_example.txt | File | 2.8 KB | 0644 |
|
| strlen_count.py | File | 1.3 KB | 0755 |
|
| strlen_hist.py | File | 1.81 KB | 0755 |
|
| strlen_hist_ifunc.py | File | 3.71 KB | 0755 |
|
| strlen_snoop.py | File | 1.35 KB | 0755 |
|
| sync_timing.py | File | 1.36 KB | 0755 |
|
| task_switch.c | File | 499 B | 0644 |
|
| task_switch.py | File | 486 B | 0755 |
|
| tcpv4connect.py | File | 2.36 KB | 0755 |
|
| tcpv4connect_example.txt | File | 1.04 KB | 0644 |
|
| trace_fields.py | File | 589 B | 0755 |
|
| trace_perf_output.py | File | 1.56 KB | 0755 |
|
| undump.py | File | 3.52 KB | 0755 |
|
| undump_example.txt | File | 886 B | 0644 |
|
| urandomread-explicit.py | File | 1.48 KB | 0755 |
|
| urandomread.py | File | 1.01 KB | 0755 |
|
| urandomread_example.txt | File | 675 B | 0644 |
|
| vfsreadlat.c | File | 896 B | 0644 |
|
| vfsreadlat.py | File | 1.3 KB | 0755 |
|
| vfsreadlat_example.txt | File | 3.53 KB | 0644 |
|