From 225caf134ff77b46cd6e8ac6648b01b915412d64 Mon Sep 17 00:00:00 2001
From: alexn1st0r <alexandernesterenko837@gmail.com>
Date: Tue, 4 Jul 2023 12:04:04 +0300
Subject: [PATCH] Add new command kprobe_table.py to pykdump repository

 This commit adds a new command, kprobe_table.py, to the pykdump repository.
The command is designed to display all kprobes found in a Linux kernel dump.
It provides a convenient way to inspect and analyze kprobes within the
kernel dump, aiding in debugging and performance analysis.

 The kprobe_table.py command enhances the functionality of pykdump by
providing insights into the kprobes present in the kernel dump.
This information can be invaluable for understanding the behavior of
the kernel and diagnosing issues.

 This commit contributes to the ongoing development and enrichment of
the pykdump repository, empowering users with a comprehensive set of
tools for kernel dump analysis.

example usage:
```
epython pykdump/progs/kprobe_table.py
```

result:
```
Kprobe <struct kprobe 0xffff99668274a6c0>
  addr: <tPtr addr=0xffffffff858fc3a0 ctype='kprobe_opcode_t *'>
  opcode: 0
  pre_handler:
         addr 0xffffffff851ea4d0
         name aggr_pre_handler
  post_handler:
         addr 0x0
         name aggr_pre_handler
  symbol_name: None
  addr to sym: devlink_nl_param_fill
  offset: 0
  flags: 8
```

Signed-off-by: alexn1st0r <alexandernesterenko837@gmail.com>
---
 progs/kprobe_table.py | 70 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 progs/kprobe_table.py

diff --git a/progs/kprobe_table.py b/progs/kprobe_table.py
new file mode 100644
index 0000000..c6452ca
--- /dev/null
+++ b/progs/kprobe_table.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python
+
+# --------------------------------------------------------------------
+#
+# Author: Aleksandr Nesterenko <anesterenko@cloudlinux.com>
+#
+# --------------------------------------------------------------------
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+from pykdump.API import *
+from LinuxDump.inet import *
+from LinuxDump import percpu
+from LinuxDump.inet.proto import print_skbuff_head
+from LinuxDump.KernLocks import spin_is_locked
+import string
+
+from collections import defaultdict
+from io import StringIO
+
+__KPROBE_HASH_BITS = 6
+__KPROBE_TABLE_SIZE  = (1 << __KPROBE_HASH_BITS)
+
+def get_all_kprobes():
+    kprobes_list_result = defaultdict(list)
+    ptrsz = sys_info.pointersize
+    kprobe_table = sym2addr('kprobe_table')
+
+    if (kprobe_table == 0):
+        pylog.warning("kprobe_table not found")
+        return
+    
+    kps = 'struct kprobe'
+    if (not struct_exists(kps)):
+        pylog.warning("kprobe structures definitions missing")
+        return
+
+    offset = member_offset(kps, "hlist")
+    for h in readSymbol('kprobe_table'):
+        for kp in hlist_for_each_entry(kps, h, "hlist"):
+            kprobes_list_result[kp.symbol_name].append(kp) 
+           
+    return kprobes_list_result
+
+def print_kprobes():
+    kprobes_list = get_all_kprobes()
+    for k in kprobes_list:
+        for kp in kprobes_list[k]:
+            print("Kprobe {}".format(kp))
+            print("  addr: {}".format(kp.addr))
+            print("  opcode: {}".format(kp.opcode))
+            print("  pre_handler:\n\t addr {}\n\t name {}".format(
+                hex(kp.pre_handler), addr2sym(kp.pre_handler)))
+            print("  post_handler:\n\t addr {}\n\t name {}".format(
+                hex(kp.post_handler), addr2sym(kp.pre_handler)))
+            print("  symbol_name: {}".format(kp.symbol_name))
+            print("  addr to sym: {}".format(addr2sym(kp.addr)))
+            print("  offset: {}".format(kp.offset))
+            print("  flags: {}".format(kp.flags))
+            print("=========================================")
+
+print_kprobes()