#include 
#include /* 定义 ftrace 回调函数 */
static struct ftrace_hook my_hook = {.func = (void *)do_fork,.probe = my_ftrace_callback,.flags = FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_RECURSION_SAFE,
};/* ftrace 回调函数 */
static int my_ftrace_callback(struct ftrace_hook *hook, struct pt_regs *regs, pid_t pid, pid_t tgid, long clone_flags, struct task_struct *parent, int *err)
{printk(KERN_INFO "my_ftrace_callback hook called\n");printk(KERN_INFO "parent process: %s, pid: %d\n", current->comm, current->pid);/* 调用原函数 */return ((int(*)(struct pt_regs *))my_hook.orig_func)(regs);
}/* 模块初始化函数 */
static int __init my_module_init(void)
{int ret;/* 设置 ftrace 钩子 */ret = register_ftrace_function(&my_hook);if (ret) {printk(KERN_INFO "register_ftrace_function failed, returned %d\n", ret);return -1;}printk(KERN_INFO "ftrace hook installed\n");return 0;
}/* 模块卸载函数 */
static void __exit my_module_exit(void)
{unregister_ftrace_function(&my_hook);printk(KERN_INFO "ftrace hook uninstalled\n");
}module_init(my_module_init);
module_exit(my_module_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("ChatGPT");
MODULE_DESCRIPTION("Hook do_fork using ftrace");