File tree Expand file tree Collapse file tree 1 file changed +3
-3
lines changed
Expand file tree Collapse file tree 1 file changed +3
-3
lines changed Original file line number Diff line number Diff line change @@ -78,14 +78,14 @@ from ctypes import c_void_p, c_int64
7878@section (" tracepoint/syscalls/sys_enter_execve" )
7979def hello_world (ctx : c_void_p) -> c_int64:
8080 print (" Hello, World!" )
81- return c_int64( 0 )
81+ return 0
8282```
8383
8484* ` @bpf ` - Marks this function to be compiled to BPF bytecode
8585* ` @section("tracepoint/syscalls/sys_enter_execve") ` - Attaches to the execve syscall tracepoint (called when processes start)
8686* ` ctx: c_void_p ` - Context parameter (required for all BPF functions)
8787* ` print() ` - In BPF context, this outputs to the kernel trace buffer
88- * ` return c_int64(0) ` - BPF functions must return an integer
88+ * ` return 0 ` - BPF functions must return an integer
8989
9090### License Declaration
9191
@@ -128,7 +128,7 @@ from ctypes import c_void_p, c_int64
128128def track_exec (ctx : c_void_p) -> c_int64:
129129 process_id = pid()
130130 print (f " Process with PID: { process_id} is starting " )
131- return c_int64( 0 )
131+ return 0
132132
133133@bpf
134134@bpfglobal
You can’t perform that action at this time.
0 commit comments