@@ -68,7 +68,7 @@ from ctypes import c_void_p, c_int64
6868* ` section ` - Decorator to specify which kernel event to attach to
6969* ` bpfglobal ` - Decorator for BPF global variables
7070* ` BPF ` - Class to compile, load, and attach BPF programs
71- * ` trace_pipe ` - Utility to read kernel trace output
71+ * ` trace_pipe ` - Utility to read kernel trace output (similar to BCC)
7272* ` c_void_p ` , ` c_int64 ` - C types for function signatures
7373
7474### The BPF Function
@@ -84,7 +84,7 @@ def hello_world(ctx: c_void_p) -> c_int64:
8484* ` @bpf ` - Marks this function to be compiled to BPF bytecode
8585* ` @section("tracepoint/syscalls/sys_enter_execve") ` - Attaches to the execve syscall tracepoint (called when processes start)
8686* ` ctx: c_void_p ` - Context parameter (required for all BPF functions)
87- * ` print() ` - In BPF context, this outputs to the kernel trace buffer
87+ * ` print() ` - the PythonBPF API for ` bpf_printk ` helper function
8888* ` return 0 ` - BPF functions must return an integer
8989
9090### License Declaration
@@ -114,6 +114,14 @@ trace_pipe()
114114* ` b.attach_all() ` - Attaches all BPF programs to their specified hooks
115115* ` trace_pipe() ` - Reads and displays output from the kernel trace buffer
116116
117+ Alternatively, you can also use the ` compile() ` function to compile the BPF code to an object file:
118+
119+ ``` python
120+ from pythonbpf import compile
121+ ```
122+
123+ This object file can then be loaded using any other userspace library in any language.
124+
117125## Next Example: Tracking Process IDs
118126
119127Let's make a more interesting program that tracks which processes are being created:
0 commit comments