hello.py (268B)
1 #!/usr/bin/env python3 2 from bcc import BPF 3 4 program = r""" 5 int hello(void *ctx) { 6 bpf_trace_printk("Hello eBPF!"); 7 return 0; 8 } 9 """ 10 11 b = BPF(text=program) 12 syscall = b.get_syscall_fnname("execve") 13 b.attach_kprobe(event=syscall, fn_name="hello") 14 15 b.trace_print()