ELF>@p@8 @ 1 1@@@II\I\I```4ppp  888$$PtdPPP,,QtdRtd```GNU`w:.OYoj(vG.!W%o 4` L"!"aP@ @ HC@A @H.oqrstuvwy{}~z%u0X{]3+Ct[եހqc""i?bΕx| jsFBn *TKwwї|?x", iWnSu:&H88+ܖfM2v.N(\ ,{%jQfN"P <‘wNR#3 Z?0Z')  8J# )6D RdN, eF" p,yWt<=HMOm*U/q0N8skO @ rr% lY ~ MB @`U 0c `ii _ 0uP lYL m3E p=l }1 r6 `1 px v/ T o9 qJv`@ PU9 T kY jBw d UYe cJ7 d" pw:{ pnYU@ pkb@ v @j}c nJ @vl @ `q} @} PV il 0 0O] wGa 0__gmon_start___ITM_deregisterTMCloneTable_ITM_registerTMCloneTable__cxa_finalizemetric_namesmetric_text_onelinemetric_text_longheadperf_buffer__pollmallocstrstrstrncpyperf_buffer__freebpf_object__destroy_skeletonfill_instids_log2round__asprintf_chkpow__stack_chk_failfill_instidspmNotifyErrexitpmIniFileLookup__isoc23_strtolensure_core_btfcallocbpf_object__open_skeletonbpf_object__load_skeletonbpf_object__attach_skeletonbpf_map__fdperf_buffer__newstrerror__errno_locationbpf_moduleall_modulesbpf_buffer__newprobe_ringbufbpf_map__set_autocreatebpf_map__set_typebpf_map__set_key_sizebpf_map__set_value_sizebpf_buffer__openring_buffer__newbpf_buffer__pollring_buffer__pollbpf_buffer__freering_buffer__freestrncmpstrcmpopen_elf_by_fdelf_nextscngelf_getshdrelf_getdatagelf_getsymelf_strptrbtf__add_strbtf__freeclose_elfreallocbtf__name_by_offsetqsortopen_elfputcharbpf_prog_loadbpf_raw_tracepoint_opengetpid__snprintf_chkfopen__isoc23_fscanf__ctype_b_locmemcpymkostempunlinkstderr__fprintf_chkfeoffcloseksyms__freeksyms__loadstrlenksyms__map_addrksyms__get_symbolsyms__load_filegelf_getehdrstrdupbtf__new_emptyelf_getshdrstrndxsyms__load_pidsyms__map_addr_dsosyms_cache__newsyms_cache__freesyms_cache__get_symspartitions__freepartitions__loadfgets__isoc23_sscanfpartitions__get_by_devpartitions__get_by_nameprint_log2_hist__printf_chkputsprint_linear_histget_ktime_nsclock_gettimeis_kernel_modulefentry_can_attachbtf__load_vmlinux_btflibbpf_get_errorbtf__load_module_btfbtf__find_by_name_kindkprobe_existsfwritefaccessattracepoint_existsaccessvmlinux_btf_existsmodule_btf_existsprobe_tp_btflibbpf_find_vmlinux_btf_idgetpagesizebpf_map_create_binary_min_core_btfs_tar_gz_startuname__getdelimmkstempfdopen_binary_min_core_btfs_tar_gz_endinflateInit2_inflateinflateEndferrorcleanup_core_btfget_pid_binary_pathreadlinkget_pid_lib_pathstrrchrstrnlenstrcpyresolve_binary_pathpopenpcloseelf_versionelf_beginelf_kindelf_endelf_errmsgget_elf_func_offsetelf_getphdrnumgelf_getphdrdump_hashbpf_map_lookup_batchbpf_map_get_next_keybpf_map_lookup_elemlibpcp_web.so.1libpcp.so.3libbpf.so.1libelf.so.1libz.so.1libm.so.6libc.so.6GLIBC_2.29GLIBC_2.2.5PCP_WEB_1.8PCP_3.22GLIBC_2.14GLIBC_2.4GLIBC_2.7GLIBC_2.3GLIBC_2.8GLIBC_2.38GLIBC_2.3.4GLIBC_2.17ELFUTILS_1.5ELFUTILS_1.6ELFUTILS_1.0LIBBPF_0.8.0LIBBPF_0.6.0LIBBPF_0.0.4LIBBPF_0.5.0LIBBPF_0.0.9LIBBPF_0.0.6LIBBPF_0.0.7LIBBPF_0.1.0LIBBPF_0.2.0LIBBPF_0.0.1          0ui  X  db   ii  ii  ii * ii 4  > ti I U ui @ `  m  z  P~0 P0 Tv0 Pq0 Yv0 Vv0 Wv0 Pu0 Pt0 Qv0 `Hh@HHHH@I P(M0K8J@HHI`hpϐxP!+EPXhu!+ɑؑ (08@"H4P?XG`OhYpaxkv$/4[q (08@HP X `hp x  y~u !("0#8%@&H'P(X)`*h+p,x-.012356789:;<=>?@AB C(D0E8@FHGPHXI`JhKpLxMNOPQRSTUVWXYZ\]^ _(`0a8b@cHdPeXf`ghhpixjklmnHHHtH5ʯ%̯@%ʯh%¯h%h%h%h%h%h%hp%h`%h P%zh @%rh 0%jh %bh %Zh%Rh%Jh%Bh%:h%2h%*h%"h%h%hp% h`%hP%h@%h0%h %h%ڮh%Үh%ʮh %®h!%h"%h#%h$%h%%h&%h'p%h(`%h)P%zh*@%rh+0%jh, %bh-%Zh.%Rh/%Jh0%Bh1%:h2%2h3%*h4%"h5%h6%h7p% h8`%h9P%h:@%h;0%h< %h=%ڭh>%ҭh?%ʭh@%­hA%hB%hC%hD%hE%hF%hGp%hH`%hIP%zhJ@%rhK0%jhL %bhM%ZhN%RhO%JhP%BhQ%:hR%2hS%*hT%"hU%hV%hWp% hX`%hYP%hZ@%h[0%h\ %h]%ڬh^%Ҭh_%ʬh`%¬ha%hb%hc%hd%he%hf%hgp%hh`%hiP%zhj@%rhk0%jhl %bhm%Zhn%Rho%Jhp%Bhq%:hr%2hs%*ht%Bf% fDH=HH9tHƧHt H=H5H)HH?HHHtHHtfD=Uu+UH=rHt H=^d-]wf.f.fDHHff.fDHӬ4ff.@HctHHH1HHH1ff.@ fo?F F@F`N(NHNh~FF0FPFpFF0FPFpF FF,F4FTFtdždžHHHH udždždžHZHJBf.DHуt|HH@H@HH1"ff.H@H@HHt*9uu@u+@ zf.t&t u:@뭋P؅ҺI‰똋@H‰1øÃu H(HÃ_H8Hff.@H=1ff.ATHUHSLe(H5ЧHHtLHHUHEH{(LHSHCH{8Hu8HmHǃ8HPH@HH8HX'9U};H8H8H@Ht5H@H8H?[]A\@ۨ[]A\fHHf.SH=ԨH=HHtH;HtHHH;Hu!FH@H8HH;Ht'H8H@HuHSHH;Hu[fAWAVAUATUSH8dL,%(Ll$(A?D9DF+Hf1ILt$ fDL,1Et4D$LD$L$6LD$f/{L$H,1LL$HAL$~ HD$ DeHEHD9x{A܃f*D$W{L$t\L{f/G{L$+\3{L,M1fD\{H,L1;HD$(dH+%(uH8[]A\A]A^A_ff.AWAVAUATUSHHHdL4%(Lt$IIHtp1IL%@tA1LL~IH $HHHLIHH9uHD$dH+%(u1H[]A\A]A^A_ÿH5@1AUfH@ATUSHhdH%(HD$X1H$XD$D$D$(D$8D$HHt 1HHAądpEHH:H*HHUHH Hh?HEHCHE H3yHE(HE0HHSHPH 4?HSHH $@HP(HS HH H ?HPHHShHH@HPPHxHE8HE@HHS(H+HHHPHSHH DHPHS0HP HSPHP(HS8HH DHP8HSXHHH 5DHP@HS@HH0H JDHPPHS`HHHHPXH3GHE0HEZŅ0HChHףPڡHChҡHChPȡHChP H;-HH8V.=H5HCH1[]A\A]@HkE1ILLcH@dHuzH[]A\A]ff.G t$tfHWH'HtOSG Ht+tH[]DH?H[FfDHH[.fDf.f.U1SH?H5l<H H5W<HH5E<HtzH5<<HtbH5+<HstJH5<H[t2 H5<HCt H5;H+@H[]ff.HFH9Gtr f.H6H?Df.HFH9Gtr f.H6H?Df.AWAVAUIATUSHt$Ht$XH$LI$Mt$ H5+HAG(fH<$gH|$@H<$|1HD$@H$8dH+%(HD$@HH[]A\A]A^A_T$LH|$PHcH4HHtHt$@fHHcVHJHL<ЉNIG@AAGAG AG0I&IG@DAG(+AG(Ht$dHD$dIHHt$hH1L-~*@HLHHtcHt$8HHtۋ$Ht$hLHHtL7uH$t$dLIGH$IG ?jt$dL.ZH<$ft$d1> 32; if (targ_pid && targ_pid != pid) if (valid_uid(targ_uid)) { uid = (u32)bpf_get_current_uid_gid(); if (targ_uid != uid) { struct args_t args = {};0:2:0 args.fname = (const char *)ctx->args[0];0:2:1 args.flags = (int)ctx->args[1]; bpf_map_update_elem(&start, &pid, &args, 0); return 0;tracepoint__syscalls__sys_enter_openattracepoint/syscalls/sys_enter_openatint tracepoint__syscalls__sys_enter_openat(struct trace_event_raw_sys_enter* ctx) args.fname = (const char *)ctx->args[1];0:2:2 args.flags = (int)ctx->args[2];trace_event_raw_sys_exitrettracepoint__syscalls__sys_exit_opentracepoint/syscalls/sys_exit_openint tracepoint__syscalls__sys_exit_open(struct trace_event_raw_sys_exit* ctx) struct event event = {}; u32 pid = bpf_get_current_pid_tgid(); ap = bpf_map_lookup_elem(&start, &pid); if (!ap)0:2 ret = ctx->ret; if (targ_failed && ret >= 0) event.pid = bpf_get_current_pid_tgid() >> 32; event.uid = bpf_get_current_uid_gid(); bpf_get_current_comm(&event.comm, sizeof(event.comm)); bpf_probe_read_user_str(&event.fname, sizeof(event.fname), ap->fname); event.flags = ap->flags; event.ret = ret; bpf_get_stack(ctx, &stack, sizeof(stack), event.callers[0] = stack[1]; event.callers[1] = stack[2]; bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, bpf_map_delete_elem(&start, &pid); return trace_exit(ctx);tracepoint__syscalls__sys_exit_openattracepoint/syscalls/sys_exit_openatint tracepoint__syscalls__sys_exit_openat(struct trace_event_raw_sys_exit* ctx)pid_t__kernel_pid_ttarg_pidtarg_tgiduid_t__kernel_uid32_ttarg_uidbool_Booltarg_failedLICENSE.maps.rodatalicense DD$h( "&((KK K K0K8K@K>PKXKTpKTxKTK  KTKvKvKKK KKKKK%K%@KG`KvKK K $K0K8K@K> PKXKTpKTxKTK  $KTKvKvKKK KK4K8K8KP<KP<@KG@`KvHKK#`HK= pPK=phKdxK|K KKKK)K KK K!K! KYA(KY!8KYHKPKXK pKKKKKK4Kl KK K#`HK= pPK=phKdxK|K KKKK)K KK K!K! KYA(KY!8KYHKPKXK pKKKKKK4Kl K(J$$ p z q  hp0   0 X@ X@ h    h       ,<L\p 0@P`p(8HXhx(8HXhx 0@P`p 0@P`p(8HXhx(8HXhx.text.rel.BTF.extstarttracepoint__syscalls__sys_exit_openat.reltracepoint/syscalls/sys_exit_openattracepoint__syscalls__sys_enter_openat.reltracepoint/syscalls/sys_enter_openatevents.mapstracepoint__syscalls__sys_exit_open.reltracepoint/syscalls/sys_exit_opentracepoint__syscalls__sys_enter_open.reltracepoint/syscalls/sys_enter_open.llvm_addrsiglicensetarg_uidtarg_pidtarg_tgidtarg_failed.strtab.symtab.rodata.rel.BTFLICENSE#*@8@p4 @!@p @H!@ 0 @!@DP0@ @!@   8i   @"p x  @x"[Lo* @?C ./%s/%s/%s/%s.bt/tmp/bcc-libbpf-tools.btf.XXXXXX;,DuH0}pp} P~`~~~~~`p(<xP,pЉ`@8`t $T0 `tЙ`Lpp  С< 0h У  d  Ч `H ` D ``  D е 0h zRx $s`FJ w?;*3$"Dz\{ p{{ {{1{fX} T}`~8l~FFD  ABE J ABC L0EHhFBB B(A0A8Dpb 8A0A(B BBBA HFBB B(A0C8KP 8A0A(B BBBA @|FMA A(D (D ABBI D(!(XDFCD ~ ABB HFED D(G0q (C ABBE t(A ADB9$(YJT J M K M$ pACD CA486Hd6L\BBB E(A0A8G 8A0A(B BBBA H FHE I(A0K (A BBBA A(F BBB,dAAG L! AAD P($BBB B(A0A8G L! 8C0A(B BBBA 4|ADG  AAA t CAG 81JXL؎FIB B(A0A8G! 8D0A(B BBBF 4x4HJFAA t ABA FAB4KDA VDBT dtFBB B(A0A8G L##M#D#B#b# 8A0A(B BBBH iE`} AA DlH  I V A (dX}EJ J AF T CA $BEFK fDA(ԗYJDD wDA(FAD w ABK (YJDD wDAL<YFIB B(A0A8G 8D0A(B BBBD Й34JFAA t ABA FAB\YNJH B(D0A8GPXH`aXAPI 8A0A(B BBBH xP89NJH E(D0D8IP 8A0A(B BBBG XJH0| A 84FIA A(D (C ABBA 4FDA d CBD ADBL rFIE B(A0A8Gj 8A0A(B BBBE @l @FAA G I o H q _  AABE  ܟ/EZ A N lEDp\ AA 8EO CA  Ԡ:Hq`4 GFGB B(A0A8G[DAS0 8D0A(B BBBA  p  ĥ1JV H AG8 FMP A(L`K (A ABBA L tFLJ B(A0A8IZ 8C0A(B BBBA \h 4FBF D(Dx (G ABBF  (A ABBF X (G ABBL 8 ĩ0FDA V ABD f ABG 4 EHD t DAF f DAE < pEJPX tFBB B(A0A8GK 8D0A(B BBBA , @=EC M A H@H @ `ho`  (&X  oXooo3p6@F@V@f@v@@@@@@@@@AA&A6AFAVAfAvAAAAAAAAABB&B6BFBVBfBvBBBBBBBBBCC&C6CFCVCfCvCCCCCCCCCDD&D6DFDVDfDvDDDDDDDDDEE&E6EFEVEfEvEEEEEEEEEFF&F6FFFVFfFvFFFFFFFFFGG&G6GFGVGfGvGHHH@IPMKJHIϐP!+EPXhu!+ɑؑ"4?GOYakv.shstrtab.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.got.plt.data.bss 88$o``( 0 8o@EoXXTX X ^B(&(& h@@c @ @`nGGwGGA@} P:PP, ``hhpp rX H