对比ftrace追踪的函数

ffffffffb0721870 t __x64_sys_openat

使用gdb调试/proc/kcore

(gdb) x/16xw 0xffffffffb0721870
                         endbr64           nop 指令  0f 1f 44 00 00
0xffffffffb0721870:	0xfa1e0ff3	0x00441f0f	0xec834800	0xf8894820
0xffffffffb0721880:	0x0d8b4865	0x02606790	0x244c8948	0x7f8b4818
0xffffffffb0721890:	0x708b4870	0x508b4868	0x408b4838	0x81c18960
0xffffffffb07218a0:	0x7f7fc3e1	0xc9814800	0x00008000	0x240c8948

使用ftrace对__x64_sys_openat函数进行追踪

ffffffffa3721870 t __x64_sys_openat

(gdb) x/16xw 0xffffffffa3721870
                         endbr64      替换为call 指令 e8 87 67 ad 1e 
0xffffffffa3721870:	0xfa1e0ff3	0xad6787e8	0xec83481e	0xf8894820
0xffffffffa3721880:	0x0d8b4865	0x02606790	0x244c8948	0x7f8b4818
0xffffffffa3721890:	0x708b4870	0x508b4868	0x408b4838	0x81c18960
0xffffffffa37218a0:	0x7f7fc3e1	0xc9814800	0x00008000	0x240c8948

对应的汇编指令如下

ffffffff81721870 <__x64_sys_openat>:
ffffffff81721870:       f3 0f 1e fa             endbr64
ffffffff81721874:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)
ffffffff81721879:       48 83 ec 20             sub    $0x20,%rsp
ffffffff8172187d:       48 89 f8                mov    %rdi,%rax
ffffffff81721880:       65 48 8b 0d 90 67 60    mov    %gs:0x2606790(%rip),%rcx        # ffffffff83d28018 <__ref_stack_chk_guard>