wkz

$s:
       0
	[   0,    1]	       7 ▏
	[   2,    4)	       8 ▏
	[   4,    8)	       0 
	[   8,   16)	     682 ██████████▉
	[  16,   32)	     120 █▉
	[  32,   64)	       0 
	[  64,  128)	       0 
	[ 128,  256)	       0 

wkz

stdio.h
--
#include <stdio.h>

#define printf(_fmt) printf("LOCAL: " _fmt)


inc1.c
--
#include "stdio.h"

wkz

wkz@wkz-box:~/code/github/wkz/dtl/src$ make all && ./ply -dD ~/tmp/test.ply
  CC     compile.o
  LINK   ply
DEBUG annotate_script: static inference done: 0
DEBUG annotate_script: dynamic inference done: 0
DEBUG annotate_script: location assigment done: 0
ast:
   <script> (type:script/none size:0x0 loc:nowhere)
      kprobe:netif_rx (type:probe/none size:0x0 loc:nowhere)
         = (type:assign/none size:0x0 loc:reg/0)

wkz

#!/usr/bin/env ply
/* -*- mode: c -*- */

kprobe:SyS_read
{
	sizes[arg(2)].count();
	dist.quantize(arg(2));
	sum.count();
}

wkz

wkz@wkz-box:~$ time cat /proc/kallsyms | awk '{ print $NF; exit 0 }'
irq_stack_union

real	0m0.003s
user	0m0.000s
sys	0m0.000s
wkz@wkz-box:~$ time cat /proc/kallsyms | awk 'END{ print $NF }'
[wmi]

real	0m0.064s

wkz

flip:
	@echo '\\/' | sed -e 's:\\/://\\:'

flip-adv:
	@echo '\\/' | sed -e 's/\\\//\/\/\\/'

flip-evil:
	@echo "\\\\\/" | sed -e "s/\\\\\\\\\//\/\/\\\/"

wkz

wkz@wkz-box:~$ cat test.ply 
kprobe:SyS_read {
	/* on x86_64, di contains first argument to read, the fd */
	fds[pid(), execname(), reg("di")] += 1
}
wkz@wkz-box:~$ sudo ply test.ply 
[sudo] password for wkz: 
^C
fds:
[     2315, xmobar          ,       11 ]	       3

wkz

#!/bin/ply -f

kprobe:SyS_* {
	syscall[reg("pc")] += 1
}

--

000:	mov	r9, r1
001:	mov	r0, #0x0

wkz

open.fs:
--
kprobe:SyS_open {
	opens[comm()] += 1;
}
--

~ # dtl -f open.fs &
<DO RANDOM STUFF>
~ # fg

wkz

TroglOS Linux 1.0-beta5 chaos /dev/ttyAMA0
chaos login: root

 (@-
 //\   TroglOS Linux  ::  Troglobit Software
 V_/_  Chaos Release  ::  http://troglobit.com

~ # echo 'kprobe:do_sys_open { trace("hello, world!\n") }' | /dtl
         syslogd-37    [000] d...     6.067101: : hello, world!
              sh-63    [000] d...     6.074971: : hello, world!