ugwis / ebpf-http-parser

Parse HTTP(S) requests by eBPF hooks without APM
Apache License 2.0
3 stars 0 forks source link

Cannot load BTF #3

Open clientcli opened 1 month ago

clientcli commented 1 month ago

Following the instruction, I make successfully the binary file but when I try to run it under sudo permission, some errors happened as below

2024/10/21 09:12:08 loading objects: field KprobeSysClose: program kprobe__sys_close: load BTF: invalid argument: magic: 0xeb9f
version: 1
flags: 0x0
hdr_len: 24
type_off: 0
type_len: 1292
str_off: 1292
str_len: 2593
btf_total_size: 3909
[1] PTR (anon) type_id=2
[2] STRUCT pt_regs size=168 vlen=21
        r15 type_id=3 bits_offset=0
        r14 type_id=3 bits_offset=64
        r13 type_id=3 bits_offset=128
        r12 type_id=3 bits_offset=192
        rbp type_id=3 bits_offset=256
        rbx type_id=3 bits_offset=320
        r11 type_id=3 bits_offset=384
        r10 type_id=3 bits_offset=448
        r9 type_id=3 bits_offset=512
        r8 type_id=3 bits_offset=576
        rax type_id=3 bits_offset=640
        rcx type_id=3 bits_offset=704
        rdx type_id=3 bits_offset=768
        rsi type_id=3 bits_offset=832
        rdi type_id=3 bits_offset=896
        orig_rax type_id=3 bits_offset=960
        rip type_id=3 bits_offset=1024
        cs type_id=3 bits_offset=1088
        eflags type_id=3 bits_offset=1152
        rsp type_id=3 bits_offset=1216
        ss type_id=3 bits_offset=1280
[3] INT long unsigned int size=8 bits_offset=0 nr_bits=64 encoding=(none)
[4] FUNC_PROTO (anon) return=5 args=(1 ctx)
[5] INT int size=4 bits_offset=0 nr_bits=32 encoding=SIGNED
[6] FUNC kprobe__sys_connect type_id=4
[7] FUNC_PROTO (anon) return=5 args=(1 ctx)
[8] FUNC kretprobe__sys_connect type_id=7
[9] FUNC_PROTO (anon) return=5 args=(1 ctx)
[10] FUNC kprobe__sys_read type_id=9
[11] FUNC_PROTO (anon) return=5 args=(1 ctx)
[12] FUNC kretprobe__sys_read type_id=11
[13] FUNC_PROTO (anon) return=5 args=(1 ctx)
[14] FUNC kprobe__sys_recv type_id=13
[15] FUNC_PROTO (anon) return=5 args=(1 ctx)
[16] FUNC kretprobe__sys_recv type_id=15
[17] FUNC_PROTO (anon) return=5 args=(1 ctx)
[18] FUNC kprobe__sys_recvfrom type_id=17
[19] FUNC_PROTO (anon) return=5 args=(1 ctx)
[20] FUNC kretprobe__sys_recvfrom type_id=19
[21] FUNC_PROTO (anon) return=5 args=(1 ctx)
[22] FUNC kprobe__sys_write type_id=21
[23] FUNC_PROTO (anon) return=5 args=(1 ctx)
[24] FUNC kretprobe__sys_write type_id=23
[25] FUNC_PROTO (anon) return=5 args=(1 ctx)
[26] FUNC kprobe__sys_send type_id=25
[27] FUNC_PROTO (anon) return=5 args=(1 ctx)
[28] FUNC kretprobe__sys_send type_id=27
[29] FUNC_PROTO (anon) return=5 args=(1 ctx)
[30] FUNC kprobe__sys_sendto type_id=29
[31] FUNC_PROTO (anon) return=5 args=(1 ctx)
[32] FUNC kretprobe__sys_sendto type_id=31
[33] FUNC_PROTO (anon) return=5 args=(1 ctx)
[34] FUNC kprobe__sys_close type_id=33
[35] INT char size=1 bits_offset=0 nr_bits=8 encoding=SIGNED
[36] ARRAY (anon) type_id=35 index_type_id=37 nr_elems=13
[37] INT __ARRAY_SIZE_TYPE__ size=4 bits_offset=0 nr_bits=32 encoding=(none)
[38] VAR __license type_id=36 linkage=1
[39] STRUCT bpf_map_def size=20 vlen=5
        type type_id=40 bits_offset=0
        key_size type_id=40 bits_offset=32
        value_size type_id=40 bits_offset=64
        max_entries type_id=40 bits_offset=96
        map_flags type_id=40 bits_offset=128
[40] INT unsigned int size=4 bits_offset=0 nr_bits=32 encoding=(none)
[41] VAR connectlist type_id=39 linkage=1
[42] VAR probe_cache type_id=39 linkage=1
[43] VAR dataevent type_id=39 linkage=1
[44] VAR messagelist type_id=39 linkage=1
[45] PTR (anon) type_id=46
[46] CONST (anon) type_id=47
[47] STRUCT dataevent_t size=1032 vlen=3
        type type_id=48 bits_offset=0
        sock_fd type_id=51 bits_offset=32
        buf type_id=53 bits_offset=64
[48] TYPEDEF u8 type_id=49
[49] TYPEDEF __u8 type_id=50
[50] INT unsigned char size=1 bits_offset=0 nr_bits=8 encoding=(none)
[51] TYPEDEF u32 type_id=52
[52] TYPEDEF __u32 type_id=40
[53] ARRAY (anon) type_id=48 index_type_id=37 nr_elems=1024
[54] DATASEC license size=13 vlen=1
         type_id=38 offset=0 size=13
[55] DATASEC maps/connectlist size=20 vlen=1 Invalid name

I tried to comment KprobeSysClose inside main.go file, but it still can't be solved.