root@VM-20-5-ubuntu:~/bpftrace-developing# bpftrace -e 'uprobe:/bin/bash:readline { printf("PS1: %sn", str(*uaddr("ps1_prompt"))); }'
Attaching 1 probe...
PS1:
上述命令，不支持Address space layout randomization (ASLR)的命令。
如果命令是ASLR的，可以使用以下命令查看，
root@VM-20-5-ubuntu:~/bpftrace-developing# bpftrace --include linux/sched.h -e 'uprobe:/bin/bash:readline { printf("PS1: %sn", str(*(curtask->mm->mmap->vm_start + uaddr("ps1_prompt")))); }'
Attaching 1 probe...
PS1: [e]0;u@h: wa]${debian_chroot:+($debian_chroot)}u@h:w
参考资料
https://github.com/iovisor/bpftrace/blob/master/docs/reference_guide.md#9-uaddr-address-resolution-user-levelhttps://github.com/iovisor/bpftrace/blob/master/docs/reference_guide.md#9-uaddr-address-resolution-user-level
uaddr(), usym(), ustack to support PIE ASLR · Issue #75 · iovisor/bpftrace · GitHubUbuntu 18.04 Bionic (and other OSes) have switched to randomizing the address space layout, which breaks simple approaches for symbol resolution. From https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes#Security_Improvements: In Ubuntu 18....https://github.com/iovisor/bpftrace/issues/75#issuecomment-555386648
