.

Author: umanwizard

support/ebpf/tracemgmt.h

@@ -98,6 +98,8 @@ static inline EBPF_INLINE bool pid_information_exists(int pid)
 #define RATELIMIT_ACTION_DEFAULT 1
 // Set PID to fast timer mode
 #define RATELIMIT_ACTION_FAST    2
+// Skip rate limiting
+#define RATELIMIT_ACTION_NONE    3
 
 // pid_event_ratelimit determines if the PID event should be inhibited or not
 // based on rate limiting rules.
@@ -111,7 +113,7 @@ static inline EBPF_INLINE bool pid_event_ratelimit(u32 pid, int ratelimit_action
   u8 attempt                    = 0;
   u8 fast_timer                 = (ratelimit_action == RATELIMIT_ACTION_FAST) ? fast_timer_flag : 0;
 
-  if (ratelimit_action == RATELIMIT_ACTION_RESET) {
+  if (ratelimit_action == RATELIMIT_ACTION_RESET || ratelimit_action == RATELIMIT_ACTION_NONE) {
     return false;
   }
 

support/ebpf/tracer.ebpf.amd64

@@ -351,6 +351,9 @@ enum {
   // number of failures to read Go custom labels
   metricID_UnwindGoLabelsFailures,
 
+  // number of times dlopen uprobe was fired
+  metricID_DlopenUprobeHits,
+
   //
   // Metric IDs above are for counters (cumulative values)
   //

support/ebpf/tracer.ebpf.arm64

@@ -18,3 +18,22 @@ int uprobe__generic(void *ctx)
 
   return collect_trace(ctx, TRACE_UPROBE, pid, tid, ts, 0, 0);
 }
+
+SEC("uprobe/dlopen")
+int uprobe_dlopen(struct pt_regs *ctx)
+{
+  u64 pid_tgid = bpf_get_current_pid_tgid();
+  u32 pid      = pid_tgid >> 32;
+  u32 tid      = pid_tgid & 0xFFFFFFFF;
+
+  DEBUG_PRINT("uprobe_dlopen fired: PID=%u TID=%u", pid, tid);
+
+  // Increment the metric for dlopen uprobe hits
+  increment_metric(metricID_DlopenUprobeHits);
+
+  if (report_pid(ctx, pid_tgid, RATELIMIT_ACTION_NONE)) {
+    DEBUG_PRINT("Reported PID %u from uprobe_dlopen", pid);
+  }
+
+  return 0;
+}